Apache real-time log analysis tool: ARTLAS usage details

Supported output methods

Zabbix Version 2.4 and 3.0

SySlog

SIEM

Telegram

Supported web servers

Apache

Apache vHost

Nginx

Nginx vHost

Install

Clone project

Git clone https://github.com/mthbernardes/ARTLAS.git
Install dependency Library

Pip install-r dependencies.txt

Python version 2.7.11 (lastet)
Install screen

Sudo apt-get install screen # Debian Like
Sbopkg-I screen # Slackware 14 .*
Yum install screen # CentOS/RHEL
Dnf install screeen # Fedora
Configuration

Configure through The etc/artlas. conf file

TELEGRAM configuration

[Telegram]
Api = your Token API
Group_id = Group/User ID of the notification recipient
Enable = True indicates that notifications are sent, and False indicates that notifications are not sent.
ZABBIX configuration

[Zabbix]
Server_name = server host name in zabbix
Agentd_config = Zabbix agent configuration file
Enable_advantage_keys = True or False. Whether to use an advanced trigger
Events = true enabled, false disabled trigger notification
Enable = true indicates enabled, false indicates disabled
SYSLOG/SIEM configuration

[CEF_Syslog]
Server_name = IP address or host name of the SySlog/SIEM server
Enable = True or False, whether to enable
General configuration

[General]
Apache_log = full path of apache access. log
Apache_mask = mask that identifies the region in the apache access log
Vhost_enable = True or False, whether to enable vhosts
Rules = etc/default_filter.json, which is the OWASP filter file [do not modify]
Run

Screen-S artlas
Python artlas. py
CTRL + A + D