🛡️ LOCO - Secured Log Collector

Loco is a specialized cross-platform security monitoring system designed for threat hunting and incident response in hybrid environments. It combines a lightweight, embeddable Windows Agent with a powerful Linux-based Admin Dashboard to provide real-time visibility into security events.

---

🚀 Key Features

🔍 Advanced Threat Detection

Detects modern attack techniques mapped to MITRE ATT&CK:

• Behavioral Analysis: Identifies suspicious parent-child process relationships (e.g., Office spawning PowerShell).
• Credential Dumping: Monitors LSASS memory access and specific Mimikatz command lines.
• Persistence: Detects new service installations, scheduled tasks, and registry backdoors (Sticky Keys).
• Sigma Rules Engine: Built-in interpreter for parsing and executing industry-standard Sigma detection rules (YAML).

🔒 Security-First Architecture (DevSecOps)

Built with "Secure by Design" principles to protect sensitive log data:

• Encrypted Transport: All communication between Agents and Admin is secured via TLS/HTTPS.
• Private PKI: Agents deploy with embedded self-signed RSA-3072 certificates (keystore.jks), eliminating external PKI dependencies.
• Input Validation: Strict whitelisting prevents Command Injection on the Agent side.

⚡ Smart Network Discovery

• Automated Scanning: Multi-threaded scanner (100 parallel threads) automatically discovers active agents across local subnets.
• Zero-Config: Agents are identified and onboarded without manual IP entry.

---

🛠️ Architecture

The system follows a distributed Client-Server model:

flowchart TD
    %% Define Nodes
    Input[("Agent Log Stream
    (JSON Payload)")]
    Parse[("Data Normalization
    (Jackson Parser)")]
    
    subgraph Engine ["Hybrid Detection Engine"]
        direction TB
        
        subgraph Static ["Heuristic Layer (Hardcoded)"]
            T1[("Check T1003
            (LSASS Access)")]
            T2[("Check T1204
            (Office Spawn)")]
        end
        
        subgraph Dynamic ["Sigma Layer (Dynamic)"]
            YAML[("Load Rules(.yml Files)")]
            Match[("Field-Value Matching
            (Case Insensitive)")]
        end
    end
    
    Decision{"Match Found?"}
    WhiteList{"Is Whitelisted?"}
    Alert[("Generate Alert Object
    (Severity/Metadata)")]
    DB[("Persist to SQLite")]
    UI[("Update Admin Dashboard")]

    %% Define Connections
    Input --> Parse
    Parse --> T1
    Parse --> T2
    Parse --> Match
    YAML --> Match
    
    T1 --> Decision
    T2 --> Decision
    Match --> Decision
    
    Decision -- Yes --> WhiteList
    Decision -- No --> End((Discard))
    
    WhiteList -- No --> Alert
    WhiteList -- Yes --> End
    
    Alert --> DB
    DB --> UI

    %% Styling
    classDef storage fill:#f9f,stroke:#333,stroke-width:2px;
    classDef process fill:#e1f5fe,stroke:#01579b,stroke-width:2px;
    classDef decision fill:#fff9c4,stroke:#fbc02d,stroke-width:2px;
    
    class Input,DB,YAML storage;
    class Parse,T1,T2,Match,Alert,UI process;
    class Decision,WhiteList decision;

Loading

• Loco Admin: JavaFX application running on Linux. Handles visualization, rule management, and network scanning.
• Loco Agent: Background Windows Service (via WinSW) providing a secure REST API on port 9876. specialized in collecting logs from Application, System, Security, Sysmon, and PowerShell channels.

---

💻 Tech Stack

Component	Technology	Description
Core	Java 17 LTS	Primary language for performance and type safety.
Admin UI	JavaFX 17	Modern, hardware-accelerated GUI toolkit.
Agent Server	Javalin / Jetty	Lightweight web framework for the Agent REST API.
Database	SQLite	Serverless, zero-configuration local storage.
Parsing	Jackson / SnakeYAML	JSON processing and Sigma Rule (YAML) interpretation.
Security	JSSE (SSLContext)	Custom Trust Managers for self-signed certificate handling.
Packaging	WinSW / Inno Setup	Windows Service wrapper and native .exe installer.

---

� Installation

Prerequisites

• Java JDK 17+
• Maven 3.8+

1. Build the Project

Clone the repository and build both modules:

mvn clean package -DskipTests

2. Run the Admin Dashboard (Linux)

cd loco
./mvnw javafx:run

3. Deploy the Agent (Windows)

Option A: Using Installer (Recommended)

1. Download LocoAgentInstaller.exe.
2. Run as Administrator.
3. Follow the setup wizard to install the "Loco Agent Service".
4. The agent will automatically start and runs as a background Windows Service.

Option B: Manual / Developer Run

• Run as JAR:

  java -jar loco-agent-1.0-SNAPSHOT.jar

• Verify Health:

  curl -k https://localhost:9876/ping
  # Returns: pong|<username>|<hostname>

---

📊 Usage Guide

1. Start the Admin Dashboard: Launch the application on your Linux workstation.
2. Discover Agents: The system automatically scans local subnets on startup. Detected agents connect automatically.
3. Monitor Events: Navigate to the Analyzye tab to see real-time alerts.
4. Manage Rules: Use the Rules Engine to view active detection logic or import new Sigma rules.

---

🤝 Contributing

Contributions are welcome! Please submit a Pull Request or open an issue for bug reports.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.