Compilation

Simply type ant at the root of the project. The script takes care of downloading all dependencies and compiling a stand-alone JAR file called siem-monitor-1.0.jar.

Example usage

Let's simulate the monitoring of a log file, where lines are regularly appended. The log is called example.log.

To simulate the log being written progressively, a script called playback.fish fetches lines from a source file, called source.log, and appends one line to example.log every second.

To run the simulation:

1. Open two command prompts
2. In the first, empty the contents of example.log by typing echo '' > example.log.
3. Start the monitor by typing tail -f example.log | java -jar siem-monitor-1.0.jar. The monitor starts "listening" to the contents of the log.
4. In the second command prompt, start the "playback" of the log by typing ./playback.fish.
5. In the first command prompt, a message will be printed every time a lifecycle violation has been detected.