siem

A practical guide to bolting a small, auditable AI layer onto Linux logs with journald, Bash pipelines, and a tiny Python Isolation Forest that learns normal SSH patterns, flags anomalies, and alerts via Slack/syslog; includes cross-distro installs, train/stream scripts, systemd service and weekly retrain timer, tuning guardrails, and extensions to sudo, kernel, packages, and containers.