🛡️ Termux SIEM

A lightweight, CLI-based Security Information and Event Management (SIEM) system for Termux on Android.

Monitor your device for suspicious files, permission issues, network activity, and more—all from your phone!

---

✨ Features

• File Monitoring: Scan for suspicious files (malware, viruses, hidden files).
• Permission Auditing: Detect world-writable or unusual permissions.
• Network Monitoring: Track active connections and unusual ports.
• Process Monitoring: Alert on unknown or suspicious processes.
• Threat Intelligence: Check files against a database of malicious hashes - automatically updated from romainmarcoux list.
• Log Correlation: Detect patterns (e.g., suspicious files + permission issues = critical alert).
• Automated Alerts: Get notifications for critical issues via Termux notifications.
• Daily Reports: Summarized logs with ASCII bar charts.
• Quarantine System: Automatically isolate malicious files.

---

📥 Installation

Prerequisites

• Termux (from F-Droid)
• Termux:API (for notifications, optional but recommended)
• Cron (for scheduling scans)

Quick Setup

1. Clone the repo:

 git clone https://github.com/CtrlAltBeard/termux-siem.git
 cd termux-siem

2. Source the config:

 source ~/siem/termux_siem_config

3. Set up cron (optional):

 crontab -e

Add this line to run the dashboard daily at 2 AM:

---

🚀 Usage

Run a Full Scan

bash ~/siem/scripts/security_dashboard.sh

• Results are saved in ~/siem/logs/security_dashboard.log.

View Latest Logs

cat ~/siem/logs/security_dashboard.log

Check for Alerts

grep "🚨" ~/siem/logs/security_dashboard.log

Update Threat Intelligence DB

bash ~/siem/scripts/update_threat_intel.sh

(Uses termux-gui-dialog for a simple popup menu.)

Show Dashboard Results in Popup

bash ~/siem/scripts/show_dashboard_results.sh

---

📂 Project Structure

siem/
├── scripts/                          # All SIEM scripts
│   ├── security_dashboard.sh         # Main dashboard script
│   ├── scan_suspicious.sh           # Scan for suspicious files
│   ├── permission_auditor.sh        # Check file permissions
│   ├── update_threat_intel.sh        # Update malicious hash DB
│   ├── integrity_checker.sh          # Check file integrity
│   ├── log_monitor.sh                # Monitor login activity
│   ├── network_monitor.sh            # Monitor network connections
│   ├── process_monitor.sh            # Monitor running processes
│   ├── clean_cache.sh                # Clean cache files
│   ├── clear_clipboard.sh            # Clear clipboard
│   ├── daily_security_report.sh     # Generate daily security report
│   ├── sensitive_cleaner.sh          # Clean sensitive data
│   ├── vpn_monitor.sh                # Monitor VPN status
│   └── show_dashboard_results.sh     # Show latest results
├── logs/                             # Log files (ignored in Git)
├── intel/                            # Threat intelligence (ignored in Git)
│   └── malicious_hashes.txt
├── quarantine/                       # Quarantined files (ignored in Git)
├── termux_siem_config                # Configuration file
└── LICENSE                           # MIT License

---

🔧 Customization

Add Custom Scan Directories

Edit ~/siem/termux_siem_config and update SCAN_DIRS:

export SCAN_DIRS=(
    "$HOME/Download"
    "$HOME/DCIM"
    "$HOME/Pictures"
    "$HOME/your/custom/path"
)

Adjust Threat Intelligence Source

Edit THREAT_INTEL_URL in termux_siem_config to use a different hash database.

Change Notification Priority

Edit the termux-notification commands in security_dashboard.sh to adjust priority (e.g., --priority low).

---

📜 Configuration

The main configuration file is termux_siem_config. Edit it to:

• Change scan directories (SCAN_DIRS).
• Adjust log file locations (SIEM_LOGS_DIR).
• Modify threat intelligence settings (THREAT_INTEL_URL).

---

⏰ Scheduling with Cron

Example cron jobs (add via crontab -e):

# Run full SIEM dashboard daily at 2 AM
0 2 * * * ~/siem/scripts/security_dashboard.sh

# Update threat intelligence every 6 hours
0 */6 * * * ~/siem/scripts/update_threat_intel.sh

# Run a quick scan every 12 hours
0 */12 * * * ~/siem/scripts/scan_suspicious.sh

---

🤝 Contributing

• Report bugs or suggest features via GitHub Issues.
• Pull requests are welcome!
• Star the repo if you find it useful.

---

📜 License

This project is MIT Licensed. See LICENSE for details.

---

Happy monitoring! 🛡️