Free & open source Kubernetes-native Air-gap ready

The open-source SIEM that speaks Kubernetes.

Skaldhall runs inside your cluster. Its operator onboards log sources, normalizes them to OCSF and runs Sigma detections — then gives you a console to act on what it finds: whitelist, blacklist, suppress, triage and investigate.

Self-host it free, or let us run it for you — Skaldhall Cloud is in early access →

$ helm install bragi oci://ghcr.io/skaldhall/bragi/charts/bragi
59 VRL pipelines in the open registry, parsing known sources
90+ Sigma rules on OCSF fields, every one mapped to MITRE ATT&CK
OCSF 1.5 one schema for every source you onboard
0 outbound calls needed in air-gapped mode
How it works

Point it at a workload. Get normalized, detected events.

No hand-written parsers, no log shippers to babysit. One Vector DaemonSet does collection and transformation; the operator decides how each log shape is parsed.

CRD LogSource Select a workload by label
collect Vector Tails pod logs, one DaemonSet
bus NATS JetStream Durable, replayable raw stream
operator bragi Fingerprint → parse → OCSF
store OpenSearch ocsf-* indices + Sigma
act Console + MCP Triage, suppress, investigate
01 · Declare

One LogSource per workload

apiVersion: bragi.skaldhall.io/v1alpha1
kind: LogSource
metadata:
  name: myapp
spec:
  sourceId: myapp
  workloadSelector:
    matchLabels:
      app.kubernetes.io/name: myapp
02 · Resolve

The best parser wins, per log shape

The operator fingerprints every raw line shape and picks the highest-priority pipeline for it:

  1. 1Your manual override
  2. 2Community registry — 59 validated VRL pipelines
  3. 3Optional AI draft — gated by vector validate, held for your review
03 · Detect & act

Findings land where you can work them

OCSF events stream through NATS JetStream into OpenSearch — at-least-once, with replay, so a pipeline promoted today still processes what arrived while it was being drafted.

Sigma rules fire through OpenSearch Security Analytics, and every finding opens in the Skaldhall console or your AI agent.

Built on open standards

OCSF for the data. MITRE ATT&CK for the detections.

No proprietary schema to learn and no lock-in. Your events speak the Open Cybersecurity Schema Framework; your findings speak the language your whole security team already uses.

OCSF v1.5

One schema, whatever produced the log.

Every pipeline normalizes into OCSF — a catalog of 75 event classes. A rule on process.name works the same on Tetragon, Falco, Tracee or auditd.

  • Nothing left unmappedEvery pipeline is tested to emit class, time, severity and metadata — no leftover raw blobs.
  • Unknown means held, not mislabeledEvents that can't be classified wait in their own index with a reason attached, instead of being filed under the wrong class.
  • Coverage by OCSF categoryThe dashboard shows which System, Network, IAM, Application and Findings classes you actually collect.
raw · nginx-ingress
10.0.4.17 - - [20/Sep/2026:07:41:02 +0000] "POST /checkout HTTP/2.0" 502 157 "-" "curl/8.5.0" 412 0.031 [payments-checkout-api-80]
ocsf · 4002 HTTP Activity
{
  "class_uid": 4002,
  "activity_id": 6,
  "http_request": {
    "http_method": "POST",
    "url": "/checkout"
  },
  "http_response": {
    "code": 502
  },
  "severity_id": 3,
  "metadata": {
    "uid": "01J7X...",
    "product": { "name": "nginx-ingress" }
  }
}
MITRE ATT&CK

90 Sigma rules mapped to ATT&CK

Every detection is tagged with its tactic and technique.
Techniques covered by the rules shipped in skaldhall-rules today.
A platform, not a viewer

Most SIEMs show you the noise. Skaldhall lets you do something about it.

Every event you look at can become a decision — and that decision keeps working after you close the tab.

suppress

Whitelist false positives

Build suppression rules from any event field in a guided builder. Nothing is whitelisted by default — a shipped whitelist would hide real attacks.

block

Blacklist and flag IPs

Mark addresses as trusted or hostile once; every past and future event involving them inherits the verdict.

drop

Drop at ingest

Noise you never want stored is discarded in the pipeline, before it costs you disk or attention.

triage

Triage in bulk

Acknowledge, resolve or raise one event, a selection, or everything matching a filter. State lives in a side index keyed by event uid.

incidents

Run incidents end to end

Open, acknowledge, escalate and close incidents with a timeline and notes attributed to the responder who wrote them.

alerting

Route alerts

Rules go from source to condition to severity to routing, so the right team hears about the right finding.

See the cluster

Traffic, policy and configuration — drawn from the live API.

Topology comes straight from your NetworkPolicies and workloads, flows from your CNI's logs. No agents to install beyond what you already run.

Network policy topology allowed denied no policy
ns/ingress ns/payments ns/data nginx-ingress legacy-cron checkout-api ledger postgres redis
Config drift, as detections OCSF 6003
NetworkPolicy "default-deny" deleted ns/payments · 2m ago
Pod started with privileged: true ns/data · redis-0
ClusterRoleBinding grants cluster-admin subject: sa/ci-deployer
Namespace PSA set to privileged ns/legacy
Service exposed as LoadBalancer ns/ingress · nginx-ingress

Live traffic flows

Aggregated flows from Cilium Hubble, Calico, Antrea, Zeek or Suricata — filter by protocol, find top talkers, jump to the workload.

Inventory that notices

NetworkPolicies, namespace PSA posture, privileged pods, hostPath mounts, exposed Services and risky RBAC bindings — mirrored and diffed continuously.

Every IP, explained

Geography, ASN and owner, AWS / GCP / Cloudflare ranges, and categorical reputation — botnet C2, malware TLS, Tor exit — from a dataset compiled into the image.

Sources

Your stack is probably already covered.

The open registry parses the Kubernetes security ecosystem into OCSF out of the box. Missing one? Adding a pipeline is a documented, testable pull request.

  1. 1Write the VRL in pipelines/<source>.yaml
  2. 2Add real log lines to samples/<source>.txt
  3. 3Validate with scripts/validate.sh
Browse the registry →
antrea-flowapparmorcalico-dnscalico-felixcalico-flowcertmanagercloudflaredcorazacosign-verifycrowdsecenvoy-rbacetcd-accessetcd-auditexternalsecrets-eventfalcogatekeeper-auditgatekeeper-violationhaproxyharbor-audithubble-flowhubble-policyinspektor-gadgetistio-authzpolicy-denyistio-envoy-accessjournaldjspolicy-violationkube-apiserver-auditkube-apiserver-serverkube-controller-managerkube-eventskube-schedulerkubearmorkubebenchkubehunterkubeletkubewarden-auditkuma-dpkyverno-admissionkyverno-policyreportlinkerd-proxylinux-auditdnginx-ingress-accessnginx-ingress-errorpixiepolaris-findingsealedsecretsselinuxstackroxsuricata-evesysdig-osstekton-chainstetragontraceetraefik-accesstrivy-configaudittrivy-exposedsecrettrivy-vulnerabilityreportvault-auditzeek
Access

Your IdP decides who sees what.

OAuth2 / OIDC single sign-on against any provider. Map IdP groups to roles and they re-sync on every login — remove someone from a group and they're downgraded at next sign-in.

Capability RBACPer-resource full / read / none
Five built-in rolesAdmin to read-only, or define your own
API tokensScoped to the user who minted them
Audit trailEvery action attributed to a person
MCP server

Hand an investigation to your agent — safely.

Claude Code, Claude Desktop or any MCP client can search, correlate, triage and tune — under the caller's own Skaldhall role.

search_events class=1007 ns=payments
correlate_event by workload · node · IP
get_network_topology ns=payments
suppress_events drop=true confirm=true
1Role is the ceiling — each session acts as its token's user
2Tool tiers — read-only by default; writes and destructive ops opt-in
3Explicit confirmation — destructive calls need confirm:true in the transcript
Air-gapped by design

Pull the network cable. It keeps working.

Everything Skaldhall needs to parse, detect and enrich ships inside the images. Nothing phones home, and your data never leaves the cluster.

  • Embedded parser registryThe full pipeline index is vendored into the operator.
  • Embedded Sigma rulesDetections attach without fetching anything.
  • Embedded IP intelligenceGeo, ASN, cloud ranges and reputation, offline.
  • No LLM requiredTurn AI drafting off and no parser-generator pod runs at all.
  • Bring your own OpenSearchManaged or self-hosted, private CAs supported.
  • No inline secretsCredentials come from your Vault, SOPS or sealed-secrets.
Install
# 1 · the pipeline (operator + NATS + Vector)
helm install bragi \
  oci://ghcr.io/skaldhall/bragi/charts/bragi \
  -n siem --create-namespace \
  --set opensearch.url=https://os.example:9200

# 2 · the console
helm install skaldhall \
  oci://ghcr.io/skaldhall/charts/skaldhall \
  -n siem --set app.seedDemo=false

Registry updates are fetched every five minutes. Optionally add an LLM key to draft parsers for sources nobody has written yet.

Kubernetes 1.27+·OpenSearch 2.11+·amd64 / arm64

Self-host

Free forever
$0open source
  • Everything: operator, console, MCP server, registry and rules
  • Runs in any Kubernetes 1.27+ cluster with OpenSearch
  • Air-gapped, fully embedded — no outbound calls
  • No licence keys, seat limits or per-GB pricing
  • Community support on GitHub

Skaldhall Cloud

Early access
SaaSpricing on request
  • We host and operate the console, storage and detections
  • Upgrades, parser registry and Sigma updates handled for you
  • Sign in with your own IdP over OIDC
  • Same open-source engine as self-hosted — no lock-in
Need a hand rolling it out? Consultation on architecture, multi-cluster rollout, custom pipelines and detection engineering — from the people who build Skaldhall.
Book a consultation
Coming next

Less noise in. Less exposure out.

On the roadmap, not yet shipped. Follow along — or help build it — on GitHub.

Roadmap

Event clusterization

Group thousands of similar events into a handful of patterns you can review — and whitelist — at once.

Roadmap

Denoising

Separate the routine heartbeat of a cluster from the events that deserve a human's attention.

Roadmap

Data anonymization

Mask personal and sensitive fields before they're stored, so events can be shared and retained with confidence.

Run a real SIEM in your cluster this afternoon.

Free and open source when you self-host. Prefer it managed, or want help getting there? Talk to us →