SecureWatch AI – Cloud Anomaly Detection & Early Alerting

I run Linux servers on both Azure and AWS and need a practical way to detect issues before they escalate into security incidents.

The goal is to build a Python-based cloud monitoring and anomaly detection system that continuously observes system metrics and logs, learns what “normal” behavior looks like, and flags anything that deviates from that baseline.

The system should help identify early signs of:

Unusual CPU or memory usage

Suspicious network activity

Brute-force login attempts or abnormal authentication behavior

When an anomaly is detected, the solution must immediately generate alerts by writing to structured log files and sending email notifications, allowing for fast response.

A lightweight, web-based dashboard is required to provide at-a-glance visibility into system status and recent alerts. Deployment should be simple (single host or container-based), suitable for teams without a full Security Operations Center.

Clear documentation is expected, including installation steps, configuration options, usage examples, and known limitations.