Generic SIEM engine detector
Project description
Clickdetect
Made in 🇧🇷
Clickdetect is a SIEM engine on steroids, no lock-in with any vendors and powerfull detection.
Follow the doc: https://clickdetect.souzo.me
Starting guide
First of all, create your runner.yml file. (Follow doc for the creation) You will put detectors, webhooks and datasources in the configuration file.
uv
Follow uv installation in https://docs.astral.sh/uv
uv sync --no-dev
uv run clickdetect --api
Docker/Podman
Local
podman build -t clickdetect .
podman run -v ./runner.yml:/app/runner.yml -p 8080 clickdetect --api -p 8080
Github Packages
podman run -v ./runner.yml:/app/runner.yml -p 8080 ghcr.io/clicksiem/clickdetect:latest --api -p 8080
Options
| Flag | Default | Description |
|---|---|---|
--api |
off | Start the REST API server |
-p, --port |
8080 |
Port for the API server |
-r, --runner |
runner.yml |
Path to the runner configuration file |
--stdin |
off | Read the runner configuration from stdin |
--verbose |
off | Verbose mode |
--reload |
off | Hot reload rules |
--list-webhooks |
off | List webhooks |
--list-datasources |
off | List datasources |
Roadmap
Webhooks
- Complete DFIR-IRIS webhook integration
- Add Slack webhook
- Add Discord webhook
- Add PagerDuty webhook
- Add Telegram webhook
- Add Opsgenie webhook
Alert Management
- Implement timeframe-based alert grouping (avoid duplicate alerts within a window)
- Implement alert silencing (suppress alerts by rule/group/tenant for a duration)
- Add API endpoints to manage silences (
POST /silence,DELETE /silence/{id})
Rule Management
- Hot reload rules without restarting (
--reloadflag or file watcher) ✅ - API endpoints to add/update/remove rules dynamically (depends on hot reload)
- Sigma rule conversion support (
sigma: truein rule definition)
Datasources
- Add support for Splunk
- Add support for OpenSearch
- Add support for Prometheus/VictoriaMetrics (metrics-based detection)
API & Observability
- Implement an endpoint to create, edit and delete rules
- Alert history endpoint to query past triggered rules
Contact-me
- E-mail: me@souzo.me
- Matrix: @souzo:matrix.org
- Linkedin: https://www.linkedin.com/in/vinicius-m-a76ba51b5/
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
clickdetect-1.3.0.tar.gz
(17.7 kB
view details)
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file clickdetect-1.3.0.tar.gz.
File metadata
- Download URL: clickdetect-1.3.0.tar.gz
- Upload date:
- Size: 17.7 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: uv/0.11.3 {"installer":{"name":"uv","version":"0.11.3","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
ee2e0d5f0a5ccfc1f110bd69e384a368bc56978f6aa14de775fd1490c93e9043
|
|
| MD5 |
23f2fd263ebf4b1fcee44ca5a914ab29
|
|
| BLAKE2b-256 |
11dafd0ad66a989d093602b755e440409ae59949cb5b6d7706fd45c5c867f0e4
|
File details
Details for the file clickdetect-1.3.0-py3-none-any.whl.
File metadata
- Download URL: clickdetect-1.3.0-py3-none-any.whl
- Upload date:
- Size: 30.0 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: uv/0.11.3 {"installer":{"name":"uv","version":"0.11.3","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
355c5bcf73619507e872b4948b8981305a7aae9df674fe8afe9fcde83e748303
|
|
| MD5 |
b0aa0c18c6e208dcbd3b4633e24a78aa
|
|
| BLAKE2b-256 |
106e3186e5e2cd01c65646afaf718af156806a2fb0aa7a0f0e4c3d8756ef1329
|
