// op_005 — case study Open Source
SiemLess
[ Ingest ] Syslog UDP/TCP :514 . REST API . Batch (1k events/req) . File Upload
|
v
[ Parser Layer ] SSH auth . Apache/Nginx . iptables . sudo audit
Windows Security . CEF . syslog RFC3164/5424 . JSON
|
v
[ Storage ] PostgreSQL (structured + full-text search)
[ Pub/Sub ] Redis --> decouples alerting from ingest, high-volume never blocks
|
v
[ Detection Engine ] YAML correlation rules, version-controlled, no Python required
|
v
[ Enrichment ] AbuseIPDB . VirusTotal [ Alerting ] SMTP . Slack . HTTP webhooks
// the problem
Commercial SIEMs — Splunk, IBM QRadar, Microsoft Sentinel — price out small security teams, freelance analysts, and homelab practitioners. Worse, tuning detection logic in black-box platforms means filing support tickets and waiting. Security engineers needed a self-hosted alternative where detection rules are just files in version control, not locked behind a vendor API.
// architecture decisions
API Layer
FastAPI over Django or Flask — async-first for high-throughput log ingestion, automatic OpenAPI docs, and Pydantic validation at every boundary. Ingestion and query paths never block each other.
Storage
PostgreSQL for structured event storage with full-text search on log content. Redis as a pub/sub layer so alert delivery never blocks the ingestion pipeline — two separate concerns, two separate systems.
Detection Engine
YAML-based correlation rules — analysts write detections without touching Python. Rules live in version control, diffs are readable, and swapping out detection logic is a file edit, not a deployment.
Deployment
Docker Compose for the full stack — single command deploy, no Kubernetes overhead for a self-hosted tool. Self-hosted premise: your logs stay on your infrastructure, not a vendor's cloud.
// capabilities
Ingests via Syslog (UDP/TCP), HTTP API, batch API (up to 1,000 events), and file upload. Parses SSH auth, Apache/Nginx access logs, iptables firewall events, sudo commands, Windows Security event logs, CEF, syslog RFC3164/5424, and JSON. Built-in YAML correlation rules cover SSH brute force, port scans, privilege escalation via sudo, and malware C2 traffic — threshold and sliding-window detections included. Threat intelligence enrichment via AbuseIPDB and VirusTotal. Real-time alerting to email, Slack, and arbitrary webhooks. Live dashboard with event timeline, top sources, and severity distribution charts. Full-text search with structured filter syntax.
// related builds