LogLens v0.1.0 is the first public MVP release of the repository.
- Parses Linux authentication logs in both
syslog_legacyandjournalctl_short_fullmodes. - Normalizes authentication evidence and applies configurable detections for SSH brute force, multi-user probing, and sudo burst activity.
- Reports parser coverage telemetry so unsupported lines are visible instead of silently ignored.
- Ships with deterministic Markdown and JSON reports, unit tests, CI, CodeQL, and baseline repository hardening.
- This release is intentionally narrow in scope and focused on a clean, public-safe baseline.
- Parser coverage is limited to a small set of common
sshd,sudo, andpam_unixpatterns. - Repository protections are designed for PR-based development with CI and CodeQL gating merges into
main.