{"slug": "show-hn-fengarde-ocsf-native-open-source-siem-with-local-ai-triage-apache-2-0", "title": "Show HN: Fengarde–OCSF-native open-source SIEM with local AI triage (Apache-2.0)", "summary": "Developer supermhel released Fengarde, an Apache-2.0 open-source SIEM that ingests raw log lines and produces verified incidents plus draft NIS2 notifications, with local AI triage built in. Fengarde runs as nine services communicating only over a message bus, ships 46 detection rules tagged to MITRE ATT&CK, ATLAS or ICS, and includes a demo in which an SSH brute force and a DNS burst sent over unauthenticated UDP port 5514 become a real alarm; the repository's SSOT.md separates proven capabilities from stubbed or unbuilt ones.", "body_md": "# Logs in.\n\n*Evidence out.*\n\nFENGARDE turns a raw log line into a **verified incident** and a **draft NIS2 notification**.\n\n## Departures\n\npipeline · lab stack Idle: nothing replayed\n| Departure board: pipeline stages and the alarms raised by the replayed attack |  |  |  |  | \n|---|---|---|---|---|\n| Time | Source | Event | Track | Status | \n|---|---|---|---|---|\n\n**Track**= bus topic.\n\n## One pipeline. Receipts included.\n\nSeven things FENGARDE does that a log viewer does not. Each names the place in the repository where you can check it.\n\n## Nine services. One bus.\n\nNo service calls another. Each reads topics from the bus and writes topics back, so any stage can be restarted, swapped or scaled alone. Every box opens its directory on GitHub, and during a replay the boxes light as the attack passes through them.\n\nSwipe sideways to see the whole bus.\n\n## What runs. What does not.\n\nEvery capability gets the board's honest word. Anything stubbed, opt-in or not built says so.\n\n| Capability board |  |  |  | \n|---|---|---|---|\n| Service | What | Interface | Status | \n|---|---|---|---|\n\n## 46 rules, all listed.\n\nRead straight from the rule files in the repository: level, title and the MITRE ATT&CK (or ATLAS, or ICS) tag each one carries.\n\n## Twelve views. Open any.\n\nEach tile opens that view of the real console on the recorded data.\n\n## One take, no cuts.\n\nRecorded in a scripted browser against a running stack. A real SSH brute force and a DNS burst go in over UDP 5514 at about 0:30.\n\n## Run it in ten minutes.\n\n``` bash\n$ git clone https://github.com/supermhel/fengarde.git\n$ cd fengarde && make preflight\n$ make demo          # an SSH brute force becomes a real alarm\n# console on http://localhost:8080\n\n$ cd tools/console_e2e && npm install\n$ node check.mjs       # every view as admin, analyst, read-only\n$ node tour.mjs out    # re-records the video, sends the attack\n```\n\n- Docker Desktop with enough memory for OpenSearch. make preflight checks ports and limits before the first start.\n- The console, its checks and this page's video all come from the repository: `services/ws7-dashboard/app` ,`tools/console_e2e` .\n- The UDP syslog listener is unauthenticated: expose port 5514 on a trusted network or VPN only.\n- Status, proven versus claimed: [SSOT.md](https://github.com/supermhel/fengarde/blob/main/SSOT.md) . Features per view:[console feature matrix](https://github.com/supermhel/fengarde/blob/main/docs/console-feature-matrix.md) .", "url": "https://wpnews.pro/news/show-hn-fengarde-ocsf-native-open-source-siem-with-local-ai-triage-apache-2-0", "canonical_source": "https://supermhel.github.io/fengarde/", "published_at": "2026-10-29 00:24:55+00:00", "updated_at": "2026-10-29 00:42:02.238320+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["Fengarde", "supermhel", "MITRE ATT&CK", "MITRE ATLAS", "NIS2", "OpenSearch", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-fengarde-ocsf-native-open-source-siem-with-local-ai-triage-apache-2-0", "markdown": "https://wpnews.pro/news/show-hn-fengarde-ocsf-native-open-source-siem-with-local-ai-triage-apache-2-0.md", "text": "https://wpnews.pro/news/show-hn-fengarde-ocsf-native-open-source-siem-with-local-ai-triage-apache-2-0.txt", "jsonld": "https://wpnews.pro/news/show-hn-fengarde-ocsf-native-open-source-siem-with-local-ai-triage-apache-2-0.jsonld"}}