The open-source SIEM that speaks Kubernetes.
Skaldhall runs inside your cluster. Its operator onboards log sources, normalizes them to OCSF and runs Sigma detections — then gives you a console to act on what it finds: whitelist, blacklist, suppress, triage and investigate.
Self-host it free, or let us run it for you — Skaldhall Cloud is in early access →
Point it at a workload. Get normalized, detected events.
No hand-written parsers, no log shippers to babysit. One Vector DaemonSet does collection and transformation; the operator decides how each log shape is parsed.
One LogSource per workload
apiVersion: bragi.skaldhall.io/v1alpha1 kind: LogSource metadata: name: myapp spec: sourceId: myapp workloadSelector: matchLabels: app.kubernetes.io/name: myapp
The best parser wins, per log shape
The operator fingerprints every raw line shape and picks the highest-priority pipeline for it:
- 1Your manual override
- 2Community registry — 59 validated VRL pipelines
- 3Optional AI draft — gated by vector validate, held for your review
Findings land where you can work them
OCSF events stream through NATS JetStream into OpenSearch — at-least-once, with replay, so a pipeline promoted today still processes what arrived while it was being drafted.
Sigma rules fire through OpenSearch Security Analytics, and every finding opens in the Skaldhall console or your AI agent.
OCSF for the data. MITRE ATT&CK for the detections.
No proprietary schema to learn and no lock-in. Your events speak the Open Cybersecurity Schema Framework; your findings speak the language your whole security team already uses.
One schema, whatever produced the log.
Every pipeline normalizes into OCSF — a catalog of 75 event
classes. A rule on process.name works the same on Tetragon,
Falco, Tracee or auditd.
- Nothing left unmappedEvery pipeline is tested to emit class, time, severity and metadata — no leftover raw blobs.
- Unknown means held, not mislabeledEvents that can't be classified wait in their own index with a reason attached, instead of being filed under the wrong class.
- Coverage by OCSF categoryThe dashboard shows which System, Network, IAM, Application and Findings classes you actually collect.
{
"class_uid": 4002,
"activity_id": 6,
"http_request": {
"http_method": "POST",
"url": "/checkout"
},
"http_response": {
"code": 502
},
"severity_id": 3,
"metadata": {
"uid": "01J7X...",
"product": { "name": "nginx-ingress" }
}
} 90 Sigma rules mapped to ATT&CK
Every detection is tagged with its tactic and technique.Most SIEMs show you the noise. Skaldhall lets you do something about it.
Every event you look at can become a decision — and that decision keeps working after you close the tab.
Whitelist false positives
Build suppression rules from any event field in a guided builder. Nothing is whitelisted by default — a shipped whitelist would hide real attacks.
Blacklist and flag IPs
Mark addresses as trusted or hostile once; every past and future event involving them inherits the verdict.
Drop at ingest
Noise you never want stored is discarded in the pipeline, before it costs you disk or attention.
Triage in bulk
Acknowledge, resolve or raise one event, a selection, or everything matching a filter. State lives in a side index keyed by event uid.
Run incidents end to end
Open, acknowledge, escalate and close incidents with a timeline and notes attributed to the responder who wrote them.
Route alerts
Rules go from source to condition to severity to routing, so the right team hears about the right finding.
Traffic, policy and configuration — drawn from the live API.
Topology comes straight from your NetworkPolicies and workloads, flows from your CNI's logs. No agents to install beyond what you already run.
Live traffic flows
Aggregated flows from Cilium Hubble, Calico, Antrea, Zeek or Suricata — filter by protocol, find top talkers, jump to the workload.
Inventory that notices
NetworkPolicies, namespace PSA posture, privileged pods, hostPath mounts, exposed Services and risky RBAC bindings — mirrored and diffed continuously.
Every IP, explained
Geography, ASN and owner, AWS / GCP / Cloudflare ranges, and categorical reputation — botnet C2, malware TLS, Tor exit — from a dataset compiled into the image.
Your stack is probably already covered.
The open registry parses the Kubernetes security ecosystem into OCSF out of the box. Missing one? Adding a pipeline is a documented, testable pull request.
- 1Write the VRL in
pipelines/<source>.yaml - 2Add real log lines to
samples/<source>.txt - 3Validate with
scripts/validate.sh
Your IdP decides who sees what.
OAuth2 / OIDC single sign-on against any provider. Map IdP groups to roles and they re-sync on every login — remove someone from a group and they're downgraded at next sign-in.
Hand an investigation to your agent — safely.
Claude Code, Claude Desktop or any MCP client can search, correlate, triage and tune — under the caller's own Skaldhall role.
Pull the network cable. It keeps working.
Everything Skaldhall needs to parse, detect and enrich ships inside the images. Nothing phones home, and your data never leaves the cluster.
- Embedded parser registryThe full pipeline index is vendored into the operator.
- Embedded Sigma rulesDetections attach without fetching anything.
- Embedded IP intelligenceGeo, ASN, cloud ranges and reputation, offline.
- No LLM requiredTurn AI drafting off and no parser-generator pod runs at all.
- Bring your own OpenSearchManaged or self-hosted, private CAs supported.
- No inline secretsCredentials come from your Vault, SOPS or sealed-secrets.
# 1 · the pipeline (operator + NATS + Vector) helm install bragi \ oci://ghcr.io/skaldhall/bragi/charts/bragi \ -n siem --create-namespace \ --set opensearch.url=https://os.example:9200 # 2 · the console helm install skaldhall \ oci://ghcr.io/skaldhall/charts/skaldhall \ -n siem --set app.seedDemo=false
Registry updates are fetched every five minutes. Optionally add an LLM key to draft parsers for sources nobody has written yet.
# mirror the OCI charts + images first helm install bragi \ oci://registry.internal/skaldhall/bragi \ -n siem --create-namespace \ --set opensearch.url=https://os.internal:9200 \ --set llm.enabled=false \ --set operator.registryAirgapped=true helm install skaldhall \ oci://registry.internal/skaldhall/skaldhall \ -n siem --set app.seedDemo=false
The operator resolves every source from its embedded index and makes zero outbound requests.
Self-host
Free forever- ✓Everything: operator, console, MCP server, registry and rules
- ✓Runs in any Kubernetes 1.27+ cluster with OpenSearch
- ✓Air-gapped, fully embedded — no outbound calls
- ✓No licence keys, seat limits or per-GB pricing
- ✓Community support on GitHub
Skaldhall Cloud
Early access- ✓We host and operate the console, storage and detections
- ✓Upgrades, parser registry and Sigma updates handled for you
- ✓Sign in with your own IdP over OIDC
- ✓Same open-source engine as self-hosted — no lock-in
Every line is on GitHub.
Read it, audit it, fork it, and send the parser or rule your stack is missing.
Less noise in. Less exposure out.
On the roadmap, not yet shipped. Follow along — or help build it — on GitHub.
Event clusterization
Group thousands of similar events into a handful of patterns you can review — and whitelist — at once.
Denoising
Separate the routine heartbeat of a cluster from the events that deserve a human's attention.
Data anonymization
Mask personal and sensitive fields before they're stored, so events can be shared and retained with confidence.
Run a real SIEM in your cluster this afternoon.
Free and open source when you self-host. Prefer it managed, or want help getting there? Talk to us →