Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
83 lines
2.2 KiB
Markdown
83 lines
2.2 KiB
Markdown
# Terminal
|
|
|
|
**English** · [Português](pt-BR/cli.md)
|
|
|
|
The `acaua` binary serves both as the CLI command runner and the background daemon.
|
|
This page describes the commands available in the engine.
|
|
|
|
```text
|
|
acaua <command> [options]
|
|
|
|
Commands:
|
|
serve Start the API and embedded web dashboard
|
|
analyze Analyze a Zeek log directory
|
|
doctor Check the local environment
|
|
update Check for available releases
|
|
```
|
|
|
|
## `acaua serve`
|
|
|
|
Starts the HTTP API and the embedded web dashboard.
|
|
|
|
```bash
|
|
acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
|
|
```
|
|
|
|
| Option | Default | Meaning |
|
|
|---|---|---|
|
|
| `--bind` | `127.0.0.1:8787` | Listen address |
|
|
| `--data-dir` | `.acaua` | Store and runtime files |
|
|
|
|
The default bind is loopback-only. Exposing the daemon on a network requires a
|
|
reverse proxy with authentication. The API is documented in
|
|
[architecture.md](architecture.md#api).
|
|
|
|
## `acaua analyze`
|
|
|
|
```bash
|
|
acaua analyze /var/log/zeek/current
|
|
acaua analyze /var/log/zeek/current --json
|
|
```
|
|
|
|
Validates the target directory, ingests `conn.log` traffic into Parquet partitions,
|
|
and runs threat detection algorithms.
|
|
|
|
## `acaua doctor`
|
|
|
|
```bash
|
|
acaua doctor
|
|
acaua doctor --json
|
|
```
|
|
|
|
Runs environment checks:
|
|
- `zeek`: verifies `zeek --version` or detects containerized execution (`ACAUA_RUNTIME=container`).
|
|
- `curl`: confirms HTTP download availability.
|
|
- `duckdb`: confirms dynamic linkage against `libduckdb.so` in runtime.
|
|
- `research`: verifies that the research workspace remains isolated.
|
|
|
|
## `acaua update`
|
|
|
|
```bash
|
|
acaua update
|
|
```
|
|
|
|
Queries the Gitea Releases API, compares the latest tag against the running
|
|
version, and prints upgrade instructions (`docker compose pull && docker compose up -d`
|
|
when running inside a container).
|
|
|
|
## Exit codes
|
|
|
|
| Code | Meaning |
|
|
|---|---|
|
|
| `0` | Success |
|
|
| `1` | Runtime error (invalid path, query error, I/O error) |
|
|
| `2` | Invalid command-line usage (clap) |
|
|
|
|
## Environment
|
|
|
|
| Variable | Meaning |
|
|
|---|---|
|
|
| `ACAUA_RUNTIME` | Set to `container` inside Docker images to adapt service checks |
|
|
| `DUCKDB_LIB_DIR` | Path to directory containing `libduckdb.so` when compiling natively |
|
|
| `LD_LIBRARY_PATH` | Shared library load path for `libduckdb.so` outside standard paths |
|