TLDR Tech / InfoSec
sigwood
sigwood is a local-first, command-line threat-hunting tool for self-hosters. Point it at logs you already have - Zeek, Pi-hole/dnsmasq, syslog, or CloudTrail - and it profiles what's in them, then runs a handful of detectors over them: beaconing, suspicious DNS, port scans, rare syslog events, over-long connections, and unusual CloudTrail activity.
Read the full story