Overview
LogRadar is a defensive security tool for analyzing HTTP access logs in live or batch workflows. It reads log files, stdin, or synthetic demo traffic, detects suspicious request patterns, and presents alerts through a terminal UI, JSON Lines output, and Prometheus metrics.
The project is built around a practical idea: web logs already contain useful security signals, but those signals need to be parsed, prioritized, and exposed in a way operators can actually use.
Capabilities
- Signature detection for SQL injection, XSS, path traversal, RCE, LFI, and Log4Shell-style probes.
- Behavioral detection for repeated failures, high request rates, and suspicious client behavior.
- Local threat-intel matching for known malicious IPs.
- Support for combined, JSON, and auto-detected log formats.
- Interactive Bubble Tea TUI for live triage.
- JSON alert output for scripts, replay jobs, and pipelines.
- Prometheus metrics with readiness and liveness endpoints.
Technical Shape
LogRadar uses a clear separation between domain types, application orchestration, adapters, and output surfaces. The analyzer coordinates a configurable worker pool, detectors, alerters, and processing observers.
The detection model is intentionally explainable: signatures, behavior, and threat-intel lookups. Rules and thresholds can be inspected and tuned without treating the system like a black box.
Engineering Highlights
The project includes operational details that matter outside of a demo:
- Configuration via files and
LOGRADAR_*environment variables. - Batch mode that exits with code
2when active alerts are emitted. - JSON output with redaction and alert-size controls.
- Prometheus metrics for throughput, parser errors, queue state, latency, and detections.
- Documentation for deployment, monitoring, alert schema, log formats, and runbooks.
The benchmark notes document methodology rather than making a universal claim. One smoke test observed about 185k demo events per second with 12 workers, but actual throughput depends on hardware, log format, output mode, and enabled detectors.
Lessons Learned
LogRadar was useful practice in building security tooling that is not only “correct” in a unit test, but usable while running. The main design pressure was decoupling ingestion speed from rendering and output work, so the detector can keep processing while the UI remains responsive.