SEC (Simple Event Correlator)

What SEC (Simple Event Correlator) is

SEC (Simple Event Correlator) reads event streams and applies rules to identify and act on groups of events within defined time windows. It can read lines from files, named pipes, or standard input, matching patterns such as regular expressions or Perl subroutines. Rule files configure correlation; documented types include threshold, event group, suppression, calendar, and pair rules. SEC can execute external programs, write files, send data to TCP or UDP servers, and call precompiled Perl subroutines. Examples in the documentation include invoking snmptrap or mail and emailing an alert for an SSH failed-login rule. The lightweight program runs as one process, either as a daemon, in a shell pipeline, or interactively in a terminal. Listed uses include event log monitoring, network and security management, and fraud detection. SEC is written in Perl and recommends Perl 5.8 or newer; it otherwise depends on standard Perl modules, with Sys::Syslog and JSON::PP optional. It is free under GPL-2.0. It has primarily been tested on Linux and Solaris, and some Unix-native functionality is disabled on Windows.