Home
Softono

Altprobe

Open source Apache-2.0 Dockerfile
GitHub
64
Stars
18
Forks
0
Issues
4
Watchers
3 months
Last Commit
SIEM & Threat Detection

 About Altprobe

collector

Platforms

Web Self-hosted Docker

Languages

Dockerfile

Links

Source Code

Need Help Installing Altprobe?

We provide expert installation service for this software. Our team will install, configure, and secure Altprobe on your server. plans start at just $30.

Hire an Expert

Alternatives to Altprobe

View All

Matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

1.7K

Windows Event Logging

Windows Event Forwarding subscriptions, configuration files and scripts that assist with implementing ACSC's protect publication, Technical Guidance for Windows Event Logging.

229

Openbsm

OpenBSM open audit implementation

168

Project Sauron

Tools to create a Native Windows Audit Collection Platform. Active Directory example provided

77
Published by
olegzhr
Visit View Profile

Altprobe

View on GitHub

Altprobe

Altprobe is a collector for monitoring and controlling API and MCP services.

It collects runtime and network events from sensors, normalizes them into OCSF, stores events in OpenSearch/ELK, and can additionally analyze them using an embedded log-based WAF that provides reactive protection through Suricata IPS.

Overview

Altprobe is built for environments where API services, AI agents, MCP servers, and service-to-service traffic need continuous visibility without deploying a full SIEM.

Altprobe architecture

Requirements

  • Operating System: Ubuntu 20.04 or higher (for binary package)
  • Optional (depending on configured sinks/sources):
    • OpenSearch / ELK stack
    • Redis
    • Falco, Suricata, or proxy logs from Nginx/Envoy

Installation

From DEB package

# Install system dependencies
sudo apt-get update
sudo apt-get -y install libyaml-cpp-dev libdaemon-dev libboost-all-dev libmodsecurity3

# Download the package
wget https://github.com/alertflex/altprobe/releases/download/v1.0.6/altprobe_1.0-6.deb

# Install the package
sudo dpkg -i altprobe_1.0-6.deb
sudo ldconfig

Configure

Modify the file /etc/altprobe/altprobe.yaml according to your configuration

Run altprobe

altprobe-start   # start in daemon mode
altprobe-status  # check status
altprobe-stop    # stop altprobe
altprobe run     # start in cli mode

Run container

docker run -d \
  --name altprobe \
  -v /var/log/:/var/host/:ro \
  -e ALTPROBE_ASSET_NAME="envoy" \
  -e ALTPROBE_LOG_DEBUG="true" \
  -e SINKS_OS_URL="https://192.168.1.X:9200" \
  -e SINKS_OS_USER="admin" \
  -e SINKS_OS_PWD="Password-12345" \
  -e SOURCES_PROXY_LOG="/var/host/envoy_access.log" \
  altprobe/altprobe:latest