Home

Prohori (প্রহরী)

A laptop-sized mini-SOC: from raw logs to detections, enriched incidents and analyst-ready reports, with honest machine-learning evaluation and a streaming data pipeline.

Prohori is Bengali for "guard". It is an open-source, defensive security-operations toolkit written in Python that runs on a single laptop using free tools only.

Status: alpha (v0.1.0 on PyPI). The batch core works today: prohori demo and prohori triage take a log file to scored incidents and shareable reports. See Quick Start and Roadmap.

What Prohori does

1. Parses web-app, web-server and Linux authentication logs into one common event schema.
2. Detects suspicious activity with readable YAML rules and machine-learning models.
3. Enriches indicators such as IP addresses with geolocation and reputation data.
4. Groups related alerts into scored incidents mapped to MITRE ATT&CK.
5. Reports each incident as a shareable Markdown, HTML or JSON document.
6. Streams and stores events through a message queue and a warehouse for dashboards.
7. Explains incidents in plain language through an optional, safety-constrained LLM assistant.

Prohori only recommends actions. It never blocks addresses, disables accounts or touches remote systems.

Start here

If you want to...	Read
Install Prohori	Installation
Try it out	Quick Start
Understand the design	Architecture
Write rules against log fields	Event Schema
Parse your logs	Parsers
Write detection rules	Detection Rules
Look up IP addresses	Enrichment
Understand incidents and scores	Incidents
Write and share reports	Reports
Simulate attacks and measure the rules	Simulator
Contribute code	Development Guide and Testing
Understand the security posture	Security Model
Look up a term	Glossary
Find answers to common questions	FAQ

Links

• Repository: https://github.com/UtshaBasak/Prohori
• Design documents: docs/
• Decision log: docs/DECISIONS.md
• Report a vulnerability: SECURITY.md