Practical overview
When it fits
Use it when you want to examine supported application-log formats for anomalous entries and can configure the log parsing, detection settings and, for AI analysis, an LLM service.
Who it is for
- Security operations teams reviewing unusual activity in application or HTTP logs.
- Analysts who want command-line options for clustering, reporting, CVE lookup or AI-assisted analysis.
- Teams seeking to route detections into a Webhawk interface or an existing SIEM through its API.
Documented uses
- Cluster application-log entries and flag unusual points for security review.
- Generate an HTML report from a log scan.
- Request AI analysis and recommendations on detections.
- Collect logs from configured endpoint files and forward them to the detection engine.
- Submit findings to the Webhawk app or feed results into a SIEM.
Requirements & limits
The project is a public GitHub repository listed under the MIT license.
- The README describes PCA feature extraction and DBSCAN clustering, with settings for values such as minimum cluster size and maximum distance.
- The command-line interface includes options for HTML reporting, CVE lookup, AI advice, plots, data standardization and submission to the Webhawk app.
- The production setup uses separate detection, Ollama and web-application services orchestrated with Docker Compose.
- An endpoint agent reads logs from a configured file and transmits them to the detection engine through its API.
- The first request from an agent may take longer while Ollama downloads the selected model.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Scan an Apache log and create an analysis report
Run unsupervised detection against an Apache log, generate an HTML report, look for related CVEs and request AI advice.
Before you start
- The Webhawk repository and its Python dependencies installed in a virtual environment.
- A settings.conf file copied from settings.conf.template and configured.
- An Apache log file and an LLM endpoint/model configured for AI advice.
Steps
From the webhawk directory, create and activate a Python virtual environment, then install requirements.txt.
Copy settings.conf.template to settings.conf and configure the log, feature and LLM settings.
Run catch.py with the log file, Apache log type, standardization, report, CVE lookup and AI-advice options.
Expected outcome
The command-line workflow performs unsupervised detection and requests an HTML report, CVE lookup and AI advice for the findings.
Guide limitations
- AI advice depends on the configured LLM service and model.
- The README documents the command and options but does not establish detection accuracy or the usefulness of findings.
Build and launch the Webhawk services with Docker Compose
Start the detection engine, Ollama LLM service and Webhawk web application.
Before you start
- The Webhawk repository.
- A configured webhawk/settings.conf file.
- Docker Compose.
Steps
Configure webhawk/settings.conf using the repository's development setup instructions.
Run docker compose build.
Run docker compose up.
Expected outcome
The README says the detection engine, Ollama service and web application will be running.
Guide limitations
- The first agent request may be delayed while the selected Ollama model downloads.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 8 October 2026
- Original website title
- slrbl/Intrusion-and-anomaly-detection-with-machine-learning · Official homepage title · retained in its source language