Mikrocata

Mikrocata is an internal Python service that monitors Suricata eve.json, blocks suspicious IPs on MikroTik, stores state in SQLite, and exposes a small REST API for status and manual control.

Russian documentation: README.ru.md

What Changed

The repo now contains a rebuilt architecture under mikrocata:

• API on FastAPI

• background worker process for log ingestion and blocking

• SQLite state for blocked_ips, alert_events, app_state, ignore_rules

• .env-driven configuration

• Telegram notifications preserved from the legacy monolith

• router reboot detection with automatic block resync

• main.py

• worker.py

Quick Start

1. Install dependencies:

python -m pip install -r requirements.txt

2. Copy env template and fill in your values:

cp .env.example .env

3. Start the API:

python main.py

4. Start the worker in a second process:

python worker.py

API

• GET /health
• GET /status
• GET /blocked-ips
• POST /blocked-ips
• DELETE /blocked-ips/{ip_address}
• GET /alerts
• POST /reload-config
• POST /worker/resync

Once the API is running, interactive docs are available at /docs.

Configuration

Use .env.example as the source of truth for available settings.

Main groups:

• APP_*: API host/port, DB path, state directory, logging
• WORKER_*: polling, startup behavior, router reboot checks
• MIKROTIK_*: router connection and firewall list settings
• TELEGRAM_*: bot token and chat target
• SURICATA_*: eve.json, ignore rules file, listened interfaces, severity filter
• SECURITY_*: whitelist, IPv6, comment timestamp format

Tests

python -m pytest tests -q

Current test coverage includes:

• whitelist and ignore matching
• deduplication
• Telegram message formatting
• worker ingestion and persistence
• repeat alert update behavior
• reboot-triggered resync

Notes

• The user-supplied monolith included live-looking MikroTik and Telegram secrets. Those should be rotated before production use.
• Running the worker requires access to the Suricata log path and the MikroTik API port.