oste/loghunter repository overview

⁠LOGHUNTER — Threat Intelligence Platform

A modern, dark-themed log analysis and threat hunting tool for security teams.

⁠Features

• Upload log files or mount system logs directly
• Auto-detects log type: auth.log, access.log, error.log
• Color-coded events by severity and threat type
• Full-text search across all fields
• Advanced filters: severity, event type, color category
• Sortable columns (click any header to sort asc/desc)
• Clickable IPs/usernames for instant filtering
• Export filtered results as CSV or JSON
• Intelligence panel: Top IPs, Top usernames, statistics
• Pagination for large log files (50/100/200/500 per page)

⁠Color Coding

⁠Quick Start

⁠Docker Compose (Recommended)

# Clone or copy the project
cd loghunter

# Build and start
docker compose up -d

# Open in browser
open http://localhost:5000

The container will automatically detect and show any mounted system logs in the UI.

⁠Development (no Docker)

pip install -r requirements.txt
python app.py

⁠Volume Mounts

The docker-compose.yml mounts the following host paths as read-only:

To mount a custom logs directory, uncomment the last volume line in docker-compose.yml:

- ./sample-logs:/logs:ro

⁠Supported Log Formats

⁠Auth / SSH (auth.log, /var/log/secure)

• Failed/successful password logins
• Invalid user attempts
• Session open/close events
• PAM authentication failures

⁠Apache/Nginx Access Log (Combined Log Format)

• All HTTP status codes
• Attack detection: path traversal, Mozi malware, RCE attempts, SQLi, XSS, LFI
• Scanner/bot detection: zgrab, Censys, Shodan, Masscan, Nikto, etc.
• Sensitive file probes: .git, .env, wp-config.php, etc.

⁠Apache/Nginx Error Log

• Error, warning, notice levels
• Connection refused / proxy errors
• Invalid URI path attempts

⁠API Endpoints

⁠Security Notes

• The container runs as a non-root user (loghunter, UID 1000)
• System log volume mounts are read-only (:ro)
• Only paths under /var/log/ and /logs/ can be loaded via API
• Max upload size: 50MB