Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
2.2 KiB
2.2 KiB
Terminal
English · Português
The acaua binary serves both as the CLI command runner and the background daemon.
This page describes the commands available in the engine.
acaua <command> [options]
Commands:
serve Start the API and embedded web dashboard
analyze Analyze a Zeek log directory
doctor Check the local environment
update Check for available releases
acaua serve
Starts the HTTP API and the embedded web dashboard.
acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
| Option | Default | Meaning |
|---|---|---|
--bind |
127.0.0.1:8787 |
Listen address |
--data-dir |
.acaua |
Store and runtime files |
The default bind is loopback-only. Exposing the daemon on a network requires a reverse proxy with authentication. The API is documented in architecture.md.
acaua analyze
acaua analyze /var/log/zeek/current
acaua analyze /var/log/zeek/current --json
Validates the target directory, ingests conn.log traffic into Parquet partitions,
and runs threat detection algorithms.
acaua doctor
acaua doctor
acaua doctor --json
Runs environment checks:
zeek: verifieszeek --versionor detects containerized execution (ACAUA_RUNTIME=container).curl: confirms HTTP download availability.duckdb: confirms dynamic linkage againstlibduckdb.soin runtime.research: verifies that the research workspace remains isolated.
acaua update
acaua update
Queries the Gitea Releases API, compares the latest tag against the running
version, and prints upgrade instructions (docker compose pull && docker compose up -d
when running inside a container).
Exit codes
| Code | Meaning |
|---|---|
0 |
Success |
1 |
Runtime error (invalid path, query error, I/O error) |
2 |
Invalid command-line usage (clap) |
Environment
| Variable | Meaning |
|---|---|
ACAUA_RUNTIME |
Set to container inside Docker images to adapt service checks |
DUCKDB_LIB_DIR |
Path to directory containing libduckdb.so when compiling natively |
LD_LIBRARY_PATH |
Shared library load path for libduckdb.so outside standard paths |