By Delta Security

🦅 FalconDefender 2.0.0

FalconDefender 2.0.0 is an advanced, daemon-powered cybersecurity system for threat detection, response, and automation.
Built with Python, it leverages YARA for high-performance signature matching and includes a persistent scheduler, a secure quarantine database, and both a Text-based User Interface (TUI) and Command-Line Interface (CLI).

This is not just a scanner; it is a full-featured, persistent security service designed for continuous monitoring and management.

---

🌟 Core Features

🧩 Daemon-Powered Scheduler

• Runs as a background service (falcon_daemon.py) using APScheduler and SQLAlchemy.
• Ensures scans and updates continue even after reboot.

💻 Dual Interface (TUI & CLI)

• Interactive TUI (app.py) – Real-time dashboard for monitoring, logs, and scheduling.
• Full CLI (cli.py) – Scriptable, automation-ready control system.

⚡ High-Performance Engine

• Concurrent scanning with ThreadPoolExecutor for parallel file checks.
• Optimized rule management with precompiled YARA caches (.yarac).
• Incremental and smart scanning (checks modified files only).

🔒 Secure Quarantine Vault

• Isolates threats in a protected directory.
• Uses an SQLite database (quarantine.db) to log metadata, hashes, and timestamps.

📄 Comprehensive Reporting

• On-demand plain-text or PDF reports.
• Email delivery via SMTP (TLS) to security admins.

🧠 Service Installation

• Built-in CLI commands:
  • install-service
  • uninstall-service
• Registers falcon_daemon as a systemd service for 24/7 operation.

🔁 Secure Updater

• Safely updates YARA rules or program components.
• Supports SHA256 checksum verification for integrity.

---

🏗️ Architecture Overview

graph TD
subgraph User_Interaction
User(User)
User -- "falcon.cli tui" --> TUI[TUI_app_py]
User -- "falcon.cli command" --> CLI[CLI_cli_py]
end
subgraph System_Services_Daemon
Daemon[Falcon_Daemon_py]
Daemon -- "Manages" --> Scheduler[APScheduler]
Scheduler -- "Triggers" --> ScanTask[Scheduled_Scan]
Scheduler -- "Triggers" --> UpdateTask[Scheduled_Update]
end
subgraph Core_Components
Scanner[Scanner_py]
YaraManager[Yara_Manager_py]
Quarantine[Quarantine_Manager_py]
Updater[Updater_py]
ReportMgr[Report_Manager_py]
end
subgraph Data_Stores
Config[config_json]
Rules[YARA_Rules_yar]
Cache[Compiled_Rules_yarac]
QuarantineDB[Quarantine_DB_quarantine_db]
SchedulerDB[Scheduler_DB_scheduler_sqlite]
end
CLI -- "Controls" --> Daemon
TUI -- "Controls_Views" --> Daemon
CLI -- "Uses" --> Core_Components
TUI -- "Uses" --> Core_Components
Daemon -- "Uses" --> Core_Components
ScanTask -- "Uses" --> Scanner
ScanTask -- "Uses" --> ReportMgr
UpdateTask -- "Uses" --> Updater
Scanner -- "Reads" --> YaraManager
Scanner -- "Writes" --> Quarantine
YaraManager -- "Reads_Writes" --> Rules
YaraManager -- "Reads_Writes" --> Cache
Quarantine -- "Writes" --> QuarantineDB
Scheduler -- "Writes" --> SchedulerDB
Core_Components -- "Reads" --> Config

Loading

---

📁 Project Structure

falcon-defender/
├── falcon/
│ ├── app.py # Text-based User Interface (TUI)
│ ├── cli.py # Command-Line Interface (CLI)
│ ├── config.py # ConfigurationManager (handles config.json)
│ ├── quarantine.py # QuarantineManager (handles SQLite DB)
│ ├── report.py # ReportManager (PDF, Email)
│ ├── scheduler.py # SchedulerManager (APScheduler)
│ ├── scheduled_tasks.py # Functions for the scheduler to run
│ ├── scanner.py # Core YARA scanning engine
│ ├── tui_integration.py # TUI to Core bridge
│ ├── updater.py # Secure rule & program updater
│ ├── utils.py # Platform-specific helpers
│ └── yara_manager.py # YARA rule compiler & cache manager
├── falcon_daemon.py # Persistent background service
├── rules/ # YARA rule files
├── config.json # Main configuration file
├── requirements.txt
├── README.md
└── MIGRATION_GUIDE.md

---

📦 Installation

Prerequisites

• Python 3.8+
• yara-python
• build-essential or Visual C++ Build Tools
• Dependencies in requirements.txt

1️⃣ From Source (Recommended)

git clone https://github.com/Delta-Security/falcon-defender.git
cd falcon-defender
python3 -m venv venv
source venv/bin/activate # Linux/macOS
.�env\Scripts�ctivate # Windows
pip install -r requirements.txt

Add your .yar rules to the rules/ directory.

First Run:

python3 -m falcon.cli tui

2️⃣ As a Persistent Service (Linux/systemd)

sudo python3 -m falcon.cli install-service
systemctl status falcon-scheduler.service
journalctl -u falcon-scheduler.service -f
sudo python3 -m falcon.cli uninstall-service

---

🛠️ Usage

1. Interactive TUI

python3 -m falcon.cli tui

Monitor scans, view logs, and manage schedules.

2. Command-Line Examples

Scanning

python3 -m falcon.cli scan /var/www
python3 -m falcon.cli scan /home/user/file.zip --quarantine-matches
python3 -m falcon.cli scan / --output-pdf --email-report

Scheduler

python3 -m falcon.cli schedule add --name "daily_home_scan" --task scan --cron-expression "0 0 3 * * *" --task-args '["/home/user"]' --task-kwargs '{"quarantine_matches": true}'

Quarantine

python3 -m falcon.cli quarantine list
python3 -m falcon.cli quarantine restore 15
python3 -m falcon.cli quarantine delete 16

Updates

python3 -m falcon.cli update-rules --source file:///opt/new-rules.zip
python3 -m falcon.cli update-rules --source https://rules.example.com/latest.zip --checksum "a1b2c3d4..."

---

⚙️ Configuration

Example config.json:

{
"scanner_threads": 8,
"max_file_size_mb": 100,
"blocked_extensions": [".tmp", ".log", ".bak"],
"allowed_extensions": [],
"yara_timeout": 60,
"quarantine_dir": "/home/user/.local/share/falcondefender/quarantine",
"rules_dir": "/home/user/.local/share/falcondefender/rules",
"report_dir": "/home/user/.local/share/falcondefender/reports",
"email_reporting": {
"enabled": false,
"smtp_server": "smtp.example.com",
"smtp_port": 587,
"smtp_username": "your_email@example.com",
"sender_email": "falcondefender@example.com",
"recipient_emails": ["security_admin@example.com"],
"use_tls": true
}
}

---

📜 License

Licensed under the MIT License.
See the LICENSE file for full terms.

---

🦅 FalconDefender 2.0.0 — By Delta Security
Advanced. Persistent. Secure.