Author: Aarón Mizrachi aaron@unmanarc.com
License: GPLv3

uAuditAnalyzer2 is a high-performance tool designed to efficiently process auditd logs received through rsyslog. Widely deployed in enterprise environments, it excels at identifying potential security threats and delivering real-time alerts via messaging platforms, bots, or other notification systems.

Additionally, uAuditAnalyzer2 can aggregate and decode auditd messages into JSON structures, making it easy to forward the data to other systems such as ELK stacks for further analysis and visualization.

This module is responsible for converting raw auditd log entries into structured JSON format. This facilitates easier integration with data analysis tools and platforms that consume JSON input, such as ELK stacks.

Designed to monitor processed audit logs for suspicious activities or security threats in real-time. It triggers alerts through configured messaging systems when potential issues are detected, ensuring timely responses to potential breaches.

Provides a web-based interface to view and manage audit logs and alerts generated by uAuditAnalyzer2. This module allows administrators to access log data and security alerts via a user-friendly web portal for better visibility into system activity.

• Manual build guide
• COPR Packages (Fedora/CentOS/RHEL/etc):
  

To activate our repo's and download/install the software:

In RHEL7:

# Install EPEL Repo + COPR
yum -y install epel-release
yum -y install yum-plugin-copr

# Install unmanarc's copr
yum copr enable amizrachi/unmanarc -y
yum -y install uAuditAnalyzer2

In RHEL8:

# Install EPEL Repo
dnf -y install 'dnf-command(config-manager)'
dnf config-manager --set-enabled powertools
dnf -y install epel-release

# Install unmanarc's copr
dnf copr enable amizrachi/unmanarc -y
dnf -y install uAuditAnalyzer2

This should be built on top of:

• libMantids libraries (2.8.26) - https://github.com/unmanarc/libMantids
• JSONCPP (AT LEAST v1.7.7, for RHEL7 you will have to build it by hand or install an external RPM)
• BOOST libs
• C++11

• CPU: 1 to N processors (optimized to be multithreaded)
• MEM: Min: 256M (depending on your configuration you may want more)
• Storage: Min: 16Gb including the whole container/OS), you may want to add more storage to keep some logs for long periods of time.

So... would it run in my Raspberry PI 4?

YES. But in our experience, RPI4 only delivers enough power to analyze some thousands of simultaneous servers with an average usage.

Contributions are welcome! Please follow these guidelines:

1. Fork the repository and create a new branch.
2. Implement your changes with thorough testing.
3. Submit a pull request detailing the improvements or fixes made.

Tekium is a cybersecurity company specializing in incident response and threat management based in Mexico. Tekium serves clients across various sectors including finance, telecommunications, and retail. As an active contributor to this project, Tekium offers professional installation support for organizations requiring assistance with deployment.

For integration with other platforms such as the Elastic stack, SIEMs, managed security providers in-house solutions, or for any other requests for extending current functionality that you wish to see included in future versions, please contact: info at tekium.mx