How cisagov/lme works
Logging Made Easy (LME) is a self-hosted logging, threat-detection, and alerting platform aimed at smaller organizations. The main workflow is administrator deployment, endpoint log collection, centralized indexing and detection, then alert review in dashboards. Ansible and Podman provide an internal deployment layer; Wazuh, Elastic, Kibana, and ElastAlert form the security-monitoring stack. The repository also includes an AI-enabled dashboard and documentation RAG ingestion, plus optional Caldera threat emulation. The README documents the overall capabilities; some subsystem links below reflect documented integration rather than inspected implementation.
Main entry points: tasks/main.yml Elasticsearch · site.yml Ansible Playbooks · tasks/main.yml Endpoint Agents · lme-litellm.container LiteLLM Proxy
Components 21
Deployment
- Ansible Playbooks
ansible/site.yml - Host Preparation
ansible/roles/base/tasks/main.yml - Podman Setup
ansible/roles/podman/tasks/main.yml - Container Services
quadlet
Security Monitoring
- Endpoint Agents
ansible/roles/ludus_lme_agents/tasks/main.yml - Wazuh Manager
ansible/roles/wazuh/tasks/main.yml - Elasticsearch
ansible/roles/elasticsearch/tasks/main.yml - Elastic Fleet
ansible/roles/fleet/tasks/main.yml - ElastAlert
config/elastalert2
Dashboards and AI
- Kibana
ansible/roles/kibana/tasks/main.yml - Security Dashboards
dashboards/elastic - LME Dashboard API
lme-dashboard/app.py - Alert Analyzer
lme-log-analyzer/app_simple.py - LiteLLM Proxy
quadlet/lme-litellm.container
Enrichment and Emulation
- Docs Ingestion
scripts/ingest_docs.py - Embedding Service
quadlet/lme-embeddings.container - Documentation Vector Store
quadlet/lme-pgvector.container - Caldera Emulation
ansible/roles/ludus_caldera_server/tasks/main.yml
Other components
- Administrator
- Network Endpoints
- LLM Provider
Connections 20
- Administrator → Ansible Playbooks: runs deployment
- Ansible Playbooks → Host Preparation: configures host
- Ansible Playbooks → Podman Setup: sets up containers
- Podman Setup → Container Services: runs services
- Network Endpoints → Endpoint Agents: generate logs
- Endpoint Agents → Wazuh Manager: send telemetry
- Endpoint Agents → Elastic Fleet: send telemetry
- Wazuh Manager → Elasticsearch: index events
- Elastic Fleet → Elasticsearch: manage collection
- Elasticsearch → ElastAlert: provide indexed events
- Elasticsearch → Kibana: serve searches
- Kibana → Security Dashboards: display monitoring
- Elasticsearch → LME Dashboard API: query alerts
- Elasticsearch → Alert Analyzer: query alerts
- LME Dashboard API → LiteLLM Proxy: request analysis
- Alert Analyzer → LiteLLM Proxy: request analysis
- LiteLLM Proxy → LLM Provider: dispatch prompts
- Docs Ingestion → Embedding Service: request vectors
- Docs Ingestion → Documentation Vector Store: store chunks
- Administrator → Caldera Emulation: run emulation