AECID Demo - Logdata Anomaly Miner (AMiner)
This video shortly introduces the logdata-anomaly-miner (AMiner) and its capabilities. The component allows to create log analysis pipelines to analyze log data streams and detect violations or anomalies. It can be run from console, as daemon with e-mail alerting and interfacing message queues or embedded as library into own programs. It was designed to run the analysis with limited resources and lowest possible permissions to make it suitable for production server use.
Analysis methods demonstrated in this video include:
Pattern detection similar to logcheck but with extended syntax and options (open-source)
ComboDetector for the detection of new data elements (IPs, user names, MAC addresses) and their combined occurrences (open-source)
VariableTypeDetector for statistical anomalies of parameter values, distributions, and frequencies (not open-source)
CorrelationDetector for generating and checking event correlation rules (not open-source)
The tool is suitable to replace logcheck but also to operate as a sensor feeding a SIEM.
Documentation:
https://git.launchpad.net/logdata-ano... (intro)
https://git.launchpad.net/logdata-ano... (analysis component docu)
https://git.launchpad.net/logdata-ano... (installation guide)
https://aecid.ait.ac.at/ (ÆCID website)
Binary packages:
https://launchpad.net/~mwurzenberger/... (bionic all)
https://packages.debian.org/sid/logda... (sid all)
https://launchpad.net/logdata-anomaly... (CentOS - alien build!)