Fengarde, a newly released open-source Security Information and Event Management (SIEM) system, has hit Hacker News with a promise to transform raw log lines into verified incidents and draft NIS2 notifications. Licensed under Apache-2.0, the tool distinguishes itself by being native to the Open Cybersecurity Schema Framework (OCSF) and leveraging local AI for triage. The project emphasizes a decoupled architecture where nine distinct services communicate via a message bus rather than direct calls, allowing individual stages to be restarted, swapped, or scaled independently.

Decoupled Architecture and Pipeline Transparency

The core technical differentiator of Fengarde is its event-driven design. The repository describes a system where 'No service calls another.' Instead, each component reads from and writes to specific topics on a central bus. This modular approach ensures that if one stage of the log processing pipeline fails or needs updating, it can be isolated without bringing down the entire SIEM. The project provides a 'Departure board' visualization that tracks pipeline stages and alarms in real-time, offering builders a clear view of how attack data propagates through the system during replays.

Detection Rules and MITRE ATT&CK Mapping

Fengarde ships with 46 detection rules, all of which are explicitly listed and categorized by severity levels: critical, high, medium, and low. Each rule is tagged with references to major threat intelligence frameworks, including MITRE ATT&CK, ATLAS, and ICS. This mapping is crucial for security engineers who need to align their detection logic with industry standards. The project maintains a 'Capability board' that honestly labels features as 'on time,' 'on request,' 'replacement,' or 'cancelled,' providing transparency about what is fully functional versus what is still in development or stubbed out.

Practical Deployment and Testing

For developers looking to test the tool, Fengarde offers a streamlined setup process requiring Docker Desktop with sufficient memory for OpenSearch. The documentation provides a clear path: clone the repository, run 'make preflight' to check ports and limits, and then execute 'make demo' to simulate an SSH brute force attack. This demo generates a real alarm in the console, which runs on localhost:8080. The project also includes end-to-end testing scripts in the tools/console_e2e directory, allowing users to verify views for different user roles (admin, analyst, read-only) and re-record demonstration videos.

Key Takeaways

  • Fengarde uses a message-bus architecture to decouple nine SIEM services, enabling independent scaling and restarting of pipeline stages.
  • The tool is OCSF-native and includes 46 detection rules mapped to MITRE ATT&CK, ATLAS, and ICS frameworks.
  • Setup is streamlined via Docker and Makefiles, with a built-in demo that simulates SSH brute force and DNS burst attacks.
  • The project maintains a transparent 'Capability board' that clearly distinguishes between implemented, stubbed, and cancelled features.

The Bottom Line

Fengarde’s honest capability board and decoupled bus architecture make it a compelling choice for builders tired of monolithic SIEMs that break under load. While the low Hacker News score suggests it’s still early days, the focus on OCSF native support and local AI triage addresses real pain points in log management.