EXCUBITOR 0.1.0: detection leads, in a terminal

An alert is useful when it shows the source, the account, the number of observations and the time window. EXCUBITOR 0.1.0, now available as a first public pre-release, puts that evidence in a terminal console.

Vigilantia ex indiciis. Vigilance from evidence.

What this release does

There are nine rules. They cover vertical and horizontal scan patterns, repeated authentication failures, password-spray patterns, failures against one account from several sources, a successful login after failures, HTTP path scans, and bursts of denied HTTP requests. The ninth preserves alerts supplied by an upstream sensor.

Each alert includes its threshold, time window, evidence samples, and a suggested next check. These are investigation leads. Six accounts failing from one address does not prove that somebody tried the same password against all six. A successful login after failures can be legitimate.

The input adapters support native JSON, Suricata EVE, Zeek JSON, and selected OpenSSH syslog messages. Server authentication logs provide account-specific evidence; encrypted SSH observations often do not contain usernames.

A first run

The console supports live monitoring of several files, filtering, evidence inspection, acknowledgement, and local exports. An optional SQLite database stores findings and acknowledgement state. The interface uses bold and reverse-video emphasis without relying on colored severity badges.

git clone https://github.com/artifexignotvs/excubitor.git
cd excubitor
python3 -m excubitor demo

The demo replays 93 synthetic events and triggers all nine rules. It sends no network traffic. Python 3.11 or later is required, with no runtime dependencies. The interactive console uses the standard curses module on Linux and macOS.

Evidence and limits

All 118 tests pass on Linux and macOS with Python 3.11 and 3.13. They check thresholds, time boundaries, parser behavior, file rotation, bounded state, exports, persistence, and command-line workflows. That validates implemented behavior; it is not a measured real-world detection rate.

This release analyzes logs. It does not capture packets, inspect payloads, block traffic, or replace Suricata. Live following has documented collection limits, including no durable read checkpoints. Thresholds need tuning against benign traffic, and capacity eviction can reduce coverage.

The dashboard retains the latest 1,000 alerts. JSONL output streams every emitted alert; a selected database persists findings locally. Exports and databases can contain sensitive addresses, usernames, and paths. They are not encrypted.

Next priorities are labeled evaluation data, reproducible false-positive measurements, durable collector checkpoints, and more authentication adapters. A useful bug report includes sanitized input, the expected result, and the actual result.

Source, installation, and input contracts · Release 0.1.0 · Test results

Artifex Ignotvs