FENGARDE console tour
Captured live off a running stack

Every alert is real.
Every screenshot proves it.

FENGARDE is an open-source SIEM pipeline — collect → normalize → detect → correlate → index, self-hosted, Apache-2.0. The eight views below aren't mockups: each one is a render from a live Docker stack, seconds after the HTTP request that produced it.

View on GitHub Quickstart Live status
Quickstart Zero-infra demo
fengarde — 10 min
$ git clone https://github.com/supermhel/fengarde.git
$ cd fengarde && make preflight
$ make demo
# real SSH brute-force alert in the dashboard within ~30-60s
# open http://localhost:8080
Architecture

Eight independent services.
One message bus between them.

No service calls another directly. Every arrow below is a real Redis Streams topic — swap, restart, or scale any one stage without touching the rest.

01

Collect

Syslog UDP, SNMP, NetFlow → raw.events

02

Normalize

17 parsers → restricted OCSF profile

03

Detect

28 rules, MITRE-tagged, stateful windows

04

Correlate

Cross-alert tracks → incidents

05

Triage

Local Ollama or deterministic stub — never leaves the network

06

Inventory

MAC-keyed asset history, IP-over-time

07

Index

OpenSearch, idempotent under redelivery

08

Console

This dashboard — read-only over HTTP

The console

What an analyst actually sees

Eight views, one running stack. Every number in every screenshot below came back from a real HTTP request made seconds before capture. Scroll — the panel on the right follows.

01 / Overview

Live triage, MITRE-tagged, AI-assisted

Real alerts with real severity, a MITRE ATT&CK chip pulled straight off the firing rule, and an inline "Why" panel joining the AI verdict back onto its alert without ever overwriting it.

WS-3 · WS-4 · WS-5
FENGARDE Overview: stat cards, system posture, top sources, and a live alert table with MITRE tags and severity pills
$ curl /api/alerts → 200 — 50 real alerts, live pipeline connected
02 / Coverage

MITRE ATT&CK, measured not asserted

One cell per rule that actually carries a technique tag, shaded by real fired-alert counts. The rule table below it shows exactly which rules are enabled, stateful, and how they're weighted — per tenant.

WS-4
FENGARDE MITRE ATT&CK coverage heatmap by tactic and technique, plus a table of all 28 detection rules with sector, level, score weight, stateful, and enabled columns
28 rules loaded · 96% carry a real technique mapping
03 / Inventory

Asset history that survives DHCP

Every device is keyed by MAC, not IP — so a lease renewal doesn't fork one host into two records. Full IP-over-time history, per tenant, one click away.

WS-6
FENGARDE Inventory view: a table of network assets by MAC address, hostname, current IP, and status, with an API keys panel below
GET /assets → 200 — real WS-6 inventory, not a mock fallback
04 / Events

Every event, not just the ones that fired

The full pre-detection OCSF stream — what WS-2 actually normalized, before any rule ever saw it. Class and activity codes are decoded against the project's own restricted 8-class profile, not guessed.

WS-2
FENGARDE raw event browser showing normalized OCSF events with human-readable class names like Authentication and Network Activity, plus activity, status, source, actor, and sector
Authentication (3002) · Network Activity (4001) — named, not numbered
05 / Sources

Which parser actually did the work

A real per-parser event count, derived from whatever's already indexed — no separate breakdown endpoint exists, so this reads the same data the Events tab does and counts it honestly.

WS-2
FENGARDE Sources view showing real event counts by parser: Linux Ssh with 99 events, Cisco Asa with 1
linux_ssh: 99 · cisco_asa: 1 — real siem.source_type counts
06 / Ops

Health, including the parts that aren't healthy

Per-topic acked/failed/dead-lettered counts read live off every workstream's own metrics endpoint. Nothing is hidden — including a real 24-message backlog sitting in one service's dead-letter queue.

WS-1 · 2 · 3 · 4 · 8
FENGARDE Ops view showing per-service health cards for five workstreams with real acked event counts, a dead-letter depth of 24 on WS-2, and correlator track counts
raw.events.deadletter_depth → 24 — shown, not swept under the rug
07 / Audit

Every admin action, appended forever

Login, logout, MFA enrollment, triage changes, report generation — an append-only trail the backend gates to admins by session role, not by hiding a button in the UI.

WS-3
FENGARDE admin audit trail table with real timestamped events including triage_update, login_success, and mfa_reauth_failure, actor, tenant, and human-readable detail columns
GET /audit → 200 — real login, MFA, and triage history
08 / Incidents

Multi-stage attacks, correlated across alerts

A single actor, IP, or device that crosses two distinct MITRE tactics gets promoted from N separate alerts into one incident — evidence of an attack that stayed under any single rule's own threshold. Empty here on purpose: no attacker in this run ever crossed that bar.

WS-8
FENGARDE Incidents view with zero correlated incidents and an honest empty-state message explaining why, rather than a blank table
0 incidents · the honest answer, not a hidden failure
FENGARDE Overview: stat cards, system posture, top sources, and a live alert table with MITRE tags and severity pills
$ curl /api/alerts → 200 — 50 real alerts, live pipeline connected
Product principle

Real data or nothing.
Every empty state says so.

Every card, every panel, every empty state in this console either shows something the backend actually computed — or says plainly that it can't.

0 fabricated percentages 0 stock chart libraries 1 Docker Compose file to run it all