Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
41 lines
1.6 KiB
Markdown
41 lines
1.6 KiB
Markdown
# Interface
|
|
|
|
**English** · [Português](pt-BR/interface.md)
|
|
|
|
The interface is a vanilla HTML/CSS/JS dashboard embedded directly into the
|
|
`acaua` binary via `rust-embed` and served by `acaua serve`. There is no
|
|
frontend build step and no heavy framework runtime.
|
|
|
|
## Layout
|
|
|
|
- **Sidebar:** brand logo, navigation, daemon connection indicator, version and update check.
|
|
- **Overview:** monitoring scope notice, authorized-use warning and four detection pillar cards.
|
|
- **Analysis:** dataset path entry, analyze button, refresh and raw JSON output inspection.
|
|
- **Alerts:** list of alerts with deterministic evidence metadata.
|
|
- **Settings:** language and theme preferences, stored in browser local storage.
|
|
|
|
## Language
|
|
|
|
The source text is Portuguese. `i18n.js` applies English translations from
|
|
`i18n-en.js` at runtime and persists the selection in `localStorage`. `Auto`
|
|
detects the browser language. The automated test `node scripts/check-ui-i18n.mjs`
|
|
guarantees that every visible Portuguese string has an exact English pair.
|
|
|
|
## Theme
|
|
|
|
Light, dark and `Auto` modes are supported. `Auto` reacts to system
|
|
`prefers-color-scheme`. Preferences stay local; no telemetry is sent.
|
|
|
|
## Connection state
|
|
|
|
The interface communicates with `/api/health` and displays:
|
|
|
|
- **Connecting:** initial connection in progress.
|
|
- **Local service online:** daemon is responding.
|
|
- **Service unavailable:** connection to daemon failed; interface remains accessible for offline settings.
|
|
|
|
## Analysis view
|
|
|
|
Posting a directory path to `/api/analyze` triggers the Zeek ingestion and
|
|
analytical detection pipeline.
|