vgls is a Python-based CLI tool for monitoring file integrity, detecting changes, analyzing logs and identifying potential security threats.

• System Integrity Monitoring: Detect changes in file content, metadata, and structure. Monitor directories for unauthorized or suspicious changes (permissions, owner, etc).
• Log Analysis (In Progress): Analyze logs for security threats and anomalies.

pip install vigilant-scanner

1. Initialize Snapshot Create a snapshot of the current directory state and store metadata in the database:

   vgls integrity-init <directory>

   

2. Scan and Compare Scan the directory and compare results with the last snapshot:

   vgls integrity-scan <directory>

   

3. Update the Database Update the database with the current state of the directory:

   vgls integrity-update <directory>

4. Log analysis Analyse all logs (all files with .log extension) in provided directory on matching with malicious patterns.

   vgls log-scan <directory>

   Work is still in progress. Mostly working on malicious signature collection that will be used here.

# Create database with the current state of a target directory
vgls integrity-init /var/www

# Perform a scan to detect changes
vgls integrity-scan /var/www

# Update the database after legitimate changes are made (deploy was conducted etc.)
vgls integrity-update /var/www

1. Initialization (init)

   • Scans a directory and stores metadata (file path, hash, size, permissions, etc.) in a SQLite database.

2. Scanning and Comparison (scan)

   • Scans the directory again and compares the current state with the stored metadata.
   • Outputs new, modified, and deleted files.

3. Updating the Database (update)

   • Updates the database to reflect the latest directory state.
   • Inserts new files, updates modified files, and removes deleted files.

• Python 3.10+

To contribute or run the tool locally:

1. Clone the repository:

   git clone https://github.com/ivpel/vigilant-scanner.git

2. Navigate to the project directory:

   cd vigilant-scanner

3. Install dependencies:

   pip install .
   # for development
   pip install -e ".[dev]"

4. Run tests:

   pytest

This project is licensed under the GNU General Public License v3 or later (GPLv3+). See the LICENSE file for details.

If you encounter any issues, feel free to open a ticket on the GitHub Bug Tracker.

• Homepage: Vigilant Scanner on GitHub
• Bug Tracker: Report Issues