{"repo":"supermhel/fengarde","free":true,"listed":false,"github":"https://github.com/supermhel/fengarde","clone":"git clone https://github.com/supermhel/fengarde.git","description":"Open-source SIEM pipeline: raw security logs → OCSF → correlation rules → alerts. OT and IT in one pipeline. Local-first AI triage, 10-minute self-hosted quickstart.","language":"Python","stars":11,"topics":["docker","homelab","intrusion-detection","log-analysis","ocsf","open-source","opensearch","python","security","siem"],"license":"Apache-2.0","category":"self-hosted-apps","readme_excerpt":"FENGARDE Badges above reflect the most recent real run on main , not a promise — CI/CodeQL/Scorecard have all run at least once as of 2026-07-19 (post-merge of PR#2); Scorecard's own findings drove a supply-chain pinning pass (workflow SHAs, Docker base image digests) that took its score from an initial 54 open alerts down to 19, all of which are accepted policy-level trade-offs (see SSOT.md §1), not unaddressed gaps. The open-source SIEM for the European industrial Mittelstand — turns your factory and IT logs into draft NIS2 incident notifications, with AI triage that never leaves your network. FENGARDE ingests logs from multiple sources, normalizes them to a single schema (OCSF), runs correlation rules over a sliding window, and surfaces alerts in a dashboard. Storage is OpenSearch. Every service is independent and talks to the rest of the system only through a message bus, so you can scale or replace any piece without rewriting the others. Three things make it different from a generic self-hosted SIEM: - OCSF-native, not retrofitted. Every source normalizes to the same open schema from day one, so one rule covers every source that emits the event — an SSH login, a Windows login and an Active Directory login are one brute-force detection, not three. Instrument once, stay portable, no vendor log-format lock-in. - OT and IT in one pipeline. OPC UA and Modbus/TCP normalize into the same OCSF schema as Active Directory, Windows and your firewall, so the plant floor runs through","default_branch":null,"files":null,"tree":[],"storefront":"/r/supermhel","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/supermhel/fengarde/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}