Azhir – Host Security & Log Auditing Framework
Key Features
Agent Enrollment
Secure agent registration with automatic API key provisioning.
API Security
Authenticated event ingestion using unique API keys.
SSH Log Parsing
Detects failed logins, invalid users, root access, and authentication events.
Reliable Event Queue
Disk-backed queue prevents data loss during outages.
Auto Retry Engine
Intelligent retry with exponential backoff for reliable delivery.
Dockerized Setup
Containerized PostgreSQL and FastAPI for consistent deployment.
Azhir was created as a practical cybersecurity project to explore the design and implementation of a modern SIEM architecture using Python.
The system is composed of two independent services. The Linux Agent continuously monitors the systemd journal, identifies security-related SSH events, converts raw log entries into structured objects, and stores them locally before transmission. This local persistence layer ensures that no security events are lost during temporary network failures or server downtime.
The FastAPI Server acts as the central ingestion service. Agents securely enroll using an enrollment token and receive unique API keys that authenticate every future request. Incoming events are validated, processed asynchronously, and stored in PostgreSQL using SQLAlchemy 2.0 and Alembic migrations.
The project follows a modular architecture with clearly separated layers for API endpoints, business logic, repositories, database models, security, and configuration. On the agent side, collectors, parsers, transport, and persistence components are isolated, making the system easy to extend with additional log sources and detection rules.
To improve reliability, the agent implements a disk-backed event queue together with an automatic retry worker using exponential backoff. This guarantees eventual delivery even when the server becomes temporarily unavailable.
The project is fully containerized for local development and demonstrates several backend engineering concepts, including:
- Secure API authentication and agent enrollment
- Asynchronous FastAPI application design
- SQLAlchemy 2.0 with typed ORM models
- Modular software architecture
- Linux system log collection using
systemd - Rule-based SSH log parsing
- Fault-tolerant event delivery
- Docker-based development environment
- Automated testing with Pytest
While Azhir is still a work in progress, its current implementation provides a solid foundation for future features such as a web dashboard, alert correlation engine, additional log collectors, and support for Windows agents.
Community Feedback(3reviews)