Skip to content

docs: sync README and changelog for current v0.3 status #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
stacknil wants to merge 1 commit into from
Closed

docs: sync README and changelog for current v0.3 status #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@ All notable user-visible changes should be recorded here.
### Added

- Added sanitized golden `report.md` / `report.json` regression fixtures to lock report contracts.
- Added conservative parser coverage for `Accepted publickey` plus selected `pam_faillock` / `pam_sss` variants.
- Added compact host-level summaries to Markdown and JSON reports for multi-host inputs.
- Expanded parser coverage for `Accepted publickey` and selected `pam_faillock` / `pam_sss` variants.
- Added compact host-level summaries for multi-host reports.

### Changed

Expand Down
11 changes: 5 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ LogLens currently detects:
- One IP trying multiple usernames within 15 minutes
- Bursty sudo activity from the same user within 5 minutes

LogLens currently parses and reports these additional auth patterns:
LogLens currently parses and reports these additional auth patterns beyond the core detector inputs:

- `Accepted publickey` SSH successes
- `Failed publickey` SSH failures, which count toward SSH brute-force detection by default
Expand Down Expand Up @@ -200,15 +200,14 @@ Tue 2026-03-10 08:31:18 UTC example-host sshd[2245]: Connection closed by authen

- `syslog_legacy` requires an explicit year; LogLens does not guess one implicitly.
- `journalctl_short_full` currently supports `UTC`, `GMT`, `Z`, and numeric timezone offsets, not arbitrary timezone abbreviations.
- Parser coverage is intentionally narrow and focused on common `sshd`, `sudo`, `pam_unix`, and selected `pam_faillock` / `pam_sss` variants.
- Parser coverage is still selective: it covers common `sshd`, `sudo`, `pam_unix`, and selected `pam_faillock` / `pam_sss` variants rather than broad Linux auth-family support.
- Unsupported lines are surfaced as parser telemetry and warnings, not as detector findings.
- `pam_unix` auth failures remain lower-confidence by default unless signal mappings explicitly upgrade them.
- Detector configuration uses a fixed `config.json` schema rather than partial overrides or alternate config formats.
- Findings are rule-based triage aids, not incident verdicts or attribution.

## Future Roadmap

- Additional auth patterns and PAM coverage
- Better host-level summaries
- Optional CSV export
- Larger sanitized test corpus
- Additional auth patterns and PAM coverage
- Optional CSV export
- Larger sanitized test corpus
Loading