Documentation

# Download the latest release
curl -fsSL https://1-sec.dev/get | sh

# Or build from source
git clone https://github.com/cutmob/1-SEC.git
cd 1-SEC && go build ./cmd/1sec/

# Start all modules with defaults
1sec up

# Start with a custom config file
1sec up --config /path/to/config.yaml

curl -s http://localhost:1780/api/v1/alerts?min_severity=CRITICAL&limit=10 | jq .

# Response:
# {
#   "alerts": [
#     {
#       "id": "a-29f1c...",
#       "module": "injection_shield",
#       "severity": "CRITICAL",
#       "title": "SQL injection detected in /api/users",
#       "status": "OPEN",
#       "timestamp": "2026-02-19T10:32:00Z"
#     }
#   ],
#   "total": 1
# }

curl -X POST http://localhost:1780/api/v1/events \
  -H "Content-Type: application/json" \
  -d '{
    "module": "external_scanner",
    "type": "vulnerability_found",
    "severity": "HIGH",
    "summary": "CVE-2026-1234 detected on host 10.0.0.5"
  }'

# Response:
# { "status": "accepted", "event_id": "ext-20260219103200.000" }

server:
  host: "0.0.0.0"
  port: 1780

bus:
  url: "nats://127.0.0.1:4222"
  embedded: true
  data_dir: "./data/nats"
  port: 4222
  cluster_id: "1sec-cluster"

alerts:
  max_store: 10000
  enable_console: true
  # webhook_urls:
  #   - "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"

logging:
  level: "info"       # debug, info, warn, error
  format: "console"   # console, json

modules:
  network_guardian:
    enabled: true
    settings:
      max_requests_per_minute: 1000
      burst_size: 100
  injection_shield:
    enabled: true
  auth_fortress:
    enabled: true
    settings:
      max_failures_per_minute: 10
      lockout_duration_seconds: 300
      stuffing_threshold: 50
  ransomware:
    enabled: true
    settings:
      encryption_threshold: 10
      exfil_mb_threshold: 100
  llm_firewall:
    enabled: true
    settings:
      token_budget_per_hour: 100000
  runtime_watcher:
    enabled: true
    settings:
      scan_interval_seconds: 300

  ai_analysis_engine:
    enabled: true
    settings:
      triage_model: "gemini-flash-lite-latest"
      deep_model: "gemini-flash-latest"
      triage_workers: 4
      deep_workers: 2

┌─────────────────────────────────────────────────┐
│                   1SEC CLI / API                 │
├─────────────────────────────────────────────────┤
│              NATS JetStream Event Bus            │
├────┬────┬────┬────┬────┬────┬────┬────┬────┬────┤
│Net │API │IoT │Inj │SC  │Ran │Auth│DF  │... │CP  │
└────┴────┴────┴────┴────┴────┴────┴────┴────┴────┘
         │              │              │
    ┌────┴────┐   ┌─────┴─────┐  ┌────┴────┐
    │  Rust   │   │  Python   │  │Dashboard│
    │ Engines │   │  AI Layer │  │React/TS │
    └─────────┘   └───────────┘  └─────────┘

type Module interface {
    Name() string
    Description() string
    Start(ctx context.Context, bus *EventBus, pipeline *AlertPipeline, cfg *Config) error
    Stop() error
    HandleEvent(event *SecurityEvent) error
}

# Download and run
curl -fsSL https://1-sec.dev/get | sh
1sec up

# From the repo root — uses deploy/docker/docker-compose.yml
cd deploy/docker
echo "GEMINI_API_KEY=your_key" > .env
docker compose up -d
docker compose logs -f

# Or use the CLI shortcut from anywhere in the repo:
1sec docker up
1sec docker logs
1sec docker status
1sec docker down

GEMINI_API_KEY        # Primary Gemini API key for AI Analysis Engine
GEMINI_API_KEY_2      # Additional keys for rotation (rate limit management)
GEMINI_API_KEY_3      # ...
ONESEC_API_KEY        # Secure the REST API (optional)
ONESEC_CLOUD_KEY      # Pro/Enterprise cloud dashboard key

# Install with defaults
helm install 1sec ./deploy/helm

# Install with Gemini AI key
helm install 1sec ./deploy/helm \
  --set env.GEMINI_API_KEY=your_key_here

# Install with custom config
helm install 1sec ./deploy/helm \
  --set env.GEMINI_API_KEY=your_key_here \
  --set-string config="$(cat my-config.yaml)"

# Upgrade
helm upgrade 1sec ./deploy/helm --reuse-values

# Check engine status
kubectl exec deploy/1sec -- 1sec status

# Run pre-flight diagnostics
kubectl exec deploy/1sec -- 1sec check

# Fetch recent critical alerts
kubectl exec deploy/1sec -- 1sec alerts --severity CRITICAL --json

# Follow logs
kubectl logs -l app.kubernetes.io/name=1sec -f

# Port-forward the REST API locally
kubectl port-forward svc/1sec 1780:1780

# Use an existing Kubernetes Secret instead of inline env vars
existingSecret: "my-1sec-secrets"

# Increase resource limits for high-traffic environments
resources:
  limits:
    cpu: "4"
    memory: 1Gi

# Enable Ingress for the REST API
ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: 1sec.example.com
      paths:
        - path: /api
          pathType: Prefix
  tls:
    - secretName: 1sec-tls
      hosts:
        - 1sec.example.com

# Expand NATS storage
persistence:
  size: 20Gi