teler is an open-source real-time intrusion detection and threat alert system designed for web log analysis. It operates in a terminal environment, primarily focused on identifying suspicious activity based on provided logs. It employs a simple configuration approach, allowing users to define log formats and customize threat detection rules. The tool provides alerts via various notification channels and can be monitored via Prometheus. A key feature is its ability to process log data incrementally, enabling persistent data handling. The project leverages a user-defined configuration file to specify log formats and rules.
teler distinguishes itself through its simplicity and ease of use, enabling quick setup and immediate threat analysis from log files. Unlike complex WAF solutions, teler is designed for real-time threat hunting and alert generation. It supports arbitrary log formats via a flexible configuration system, enhancing adaptability. The use of incremental processing ensures data retention, distinguishing it from purely streaming solutions. Flexible rule definitions provide customized threat protection beyond standard engine-based detections.
- Real-time Analysis: Analyzes web logs on-the-fly, providing immediate alerts for suspicious activities.
- Configurable Logging: Supports various log formats, enabling integration with diverse logging systems.
- Flexible Alerting: Supports notifications via Slack, Mattermost, Telegram, and Discord.
- Incremental Processing: Handles logs with persistent data storage.
- Customizable Rules: Allows tailoring threat rules to match specific security requirements.
- Monitoring Support: Integrates with Prometheus for easy monitoring of threats and system performance.
- Terminal Interface: Provides a user-friendly command-line interface for easy operation and configuration.
The project is actively maintained with recent commits and ongoing development efforts. It has a growing community and clear documentation, indicating increasing maturity. Staging test releases are available, with the project demonstrating stability in its core functionality. The developers are actively listening to feedback and engaging with the community for feature development.
teler benefits security professionals and system administrators who need a lightweight, real-time intrusion detection solution. It's particularly useful for threat hunting, log analysis, and proactive security monitoring. Unlike complex security appliances, teler offers a straightforward and adaptable approach to identifying and responding to web-based threats, integrating well with existing log management infrastructure. Real-time alerts and the ability to define custom rules make it a valuable addition to any security workflow.