Quick Start

Quick Start

Prohori is alpha (v0.1.0, pip install prohori). The whole batch flow works today, from a log file to incidents and reports; machine learning, the streaming pipeline and the LLM analyst come in later releases.

Set up

git clone https://github.com/UtshaBasak/Prohori.git
cd Prohori
uv sync

Run the demo

uv run prohori demo

The demo simulates an account takeover, an SSH brute force and a web scan, investigates each one offline and writes an HTML report per incident to prohori-demo/. It needs no configuration and sends nothing over the network. The table shows how many alerts and incidents each attack produced and whether every rule that should catch it fired.

Triage a log

uv run prohori triage samples/logs/account-takeover.jsonl -o triage/
uv run prohori triage /var/log/auth.log --year 2026 -o triage/ --redact-ips   # your own log

prohori triage runs the whole flow: parse, detect, look up IPs (offline unless you add --online), build incidents and write triage/summary.md, triage/incidents.jsonl and a report per incident (HTML by default; --format md|json|csv). With --redact or --redact-ips, every file in the folder hides account names (and IPs).

Exit codes: 0 no incidents, 3 incidents found (--exit-zero gives 0), 1 unreadable input or redaction failed (nothing written), 2 invalid usage.

Parse logs

uv run prohori parse samples/logs/auth.log                  # format detected, table output
uv run prohori parse samples/logs/access.log --format json  # one event per line (JSON Lines)
uv run prohori parse samples/logs/app-security.jsonl
cat samples/logs/auth.log | uv run prohori parse - --year 2026
uv run prohori parse samples/logs/payments.jsonl --parser generic_json \
    --mapping samples/mappings/payments.yaml

The table output shows the first events and a summary: how many lines were parsed, skipped (well-formed but not relevant) or malformed, with examples of the errors. With --format json, events go to standard output and the summary to standard error, so you can pipe the events into other tools.

Exit codes: 0 success, 1 every line failed to parse, 2 invalid usage or input.

See Parsers for the supported formats and options.

Detect attacks

uv run prohori detect samples/logs/auth.log                     # brute-force alert
uv run prohori detect samples/logs/access.log                   # probes and injection attempts
uv run prohori detect samples/logs/app-security.jsonl --format json > alerts.jsonl
uv run prohori detect my.log --rules my-rules/                  # add your own rules
uv run prohori rules list                                       # the 14 built-in rules

prohori detect parses the file and runs the built-in detection rules (plus any --rules). It prints a table of alerts and a summary, or one alert per line with --format json.

Exit codes: 0 no alerts, 3 alerts found (this is a result, not a failure; use --exit-zero to get 0), 1 unreadable input or an invalid rule file, 2 invalid usage.

See Detection Rules for the rules and how to write your own.

Enrich IP addresses

uv run prohori enrich 203.0.113.7 --offline                 # bundled demo data, no network
uv run prohori enrich 203.0.113.7 2001:db8:abcd::17 --offline --format json
uv run prohori enrich 8.8.8.8                               # uses the providers you configured

prohori enrich shows location, network owner and reputation for each address. With --offline it never touches the network. Without API keys or GeoLite2 files it says that no providers are configured and sends nothing. Private, reserved and documentation addresses are never sent to outside services.

Exit codes: 0 done (a failed lookup is a note on that address), 2 an argument that is not an IP address, invalid usage or an invalid setting.

See Enrichment for the providers, privacy rules and how to set up API keys.

Build incidents

uv run prohori incidents samples/logs/account-takeover.jsonl     # one critical incident
uv run prohori incidents samples/logs/auth.log --year 2026       # a brute-force incident
uv run prohori incidents samples/logs/app-security.jsonl -f json > incidents.jsonl

prohori incidents parses the file, runs the rules and groups related alerts into incidents, each with a score and its breakdown, severity, confidence, ATT&CK techniques, a timeline, recommended actions and limitations. IP lookups are offline unless you add --online.

Exit codes: 0 no incidents, 3 incidents found (--exit-zero gives 0), 1 unreadable input or an invalid rule file, 2 invalid usage.

See Incidents for how grouping and scoring work.

Write a report

uv run prohori report samples/incidents/INC-ee7c8818fbb34989.json -f html -o report.html
uv run prohori report samples/incidents/INC-ee7c8818fbb34989.json --redact-ips -o shareable.md

prohori report renders an incident as Markdown (default), a self-contained HTML page, JSON or a CSV timeline. --redact hides account names and emails; --redact-ips hides IP addresses too. On Windows use -o FILE instead of >.

Exit codes: 0 written, 1 redaction could not hide every value (nothing written), 2 invalid usage or input.

See Reports for the sections and how redaction works.

Simulate an attack

uv run prohori simulate --list
uv run prohori simulate account-takeover --seed 1 --out out/
uv run prohori incidents out/account-takeover.jsonl

prohori simulate writes a realistic, labelled attack hidden in normal activity, using only documentation IP addresses. See Simulator.

Other commands

uv run prohori --version
uv run prohori --help

Coming later

Later releases add score (machine learning), pipeline up / down / status, explain and ask.