An open-source SIEM built around Kubernetes data.
Skaldhall is an open-source, Kubernetes-native security information and event management platform. It collects workload and cluster logs, normalizes them to the Open Cybersecurity Schema Framework (OCSF), evaluates Sigma detection rules in OpenSearch, and gives responders a console and MCP interface for investigation and action.
What problem does Skaldhall solve?
Kubernetes environments emit logs in many incompatible formats. Traditional SIEM onboarding often requires a custom parser for each source. Skaldhall's Bragi operator fingerprints raw lines, resolves a validated community pipeline when one exists, or drafts a Vector Remap Language parser and OCSF normalizer for review. The resulting events share a stable schema, so detections and investigations do not depend on vendor-specific field names.
The system is designed for platform and security teams that want Kubernetes-aware detection without sending telemetry to a proprietary ingestion service. It can run connected or air-gapped and uses an OpenSearch cluster supplied by the operator.
Design principles
- Kubernetes-native
- Custom resources describe log sources and parser lifecycles. The operator continuously reconciles the data plane.
- Open standards
- Normalized events use OCSF v1.5. Detection content uses Sigma and maps to MITRE ATT&CK.
- Evidence before automation
- Generated parsers are validated against held-out samples and can require explicit human approval before promotion.
- Local control
- Telemetry stays in the deployment's OpenSearch cluster. Credentials come from Kubernetes Secrets rather than chart values.
- Offline operation
- Parser definitions, Sigma rules, and IP-enrichment data can ship inside the operator image for disconnected clusters.
- Permission-aware agents
- The MCP server calls the backend as the requesting identity instead of flattening all agents into one privileged account.
Current project facts
These values are generated from the project repositories during website builds, not written as unsupported marketing claims.
| Catalog | Current coverage | Source |
|---|---|---|
| Parser pipelines | 59 | skaldhall-registry |
| Sigma rules | 90 | skaldhall-rules |
| ATT&CK tactics represented | 11 | Rule metadata |
| OCSF classes catalogued | 75 | Bragi OCSF catalog |
Which repositories make up Skaldhall?
Bragi
The Kubernetes operator, event pipeline, parser generator, review UI, and primary Helm chart.
SkaldHall
The Go and React security console for search, triage, incidents, access control, and investigation.
Parser registry
Validated Vector VRL pipelines and representative log samples for known sources.
Sigma rules
Detection rules written against normalized OCSF fields and mapped to MITRE ATT&CK.
MCP server
Model Context Protocol tools that let agents investigate through the same backend permissions as human users.
Requirements and boundaries
- Kubernetes 1.27 or newer is required.
- OpenSearch 2.11 or newer is required and is not bundled.
- NATS JetStream is required for durable event delivery and replay.
- LLM-assisted parser generation is optional for air-gapped operation; known-source pipelines remain available from the embedded registry.
- Automated parser generation reduces onboarding work but does not replace validation, monitoring, or security engineering judgment.
Authoritative sources
This page is maintained from the public source repositories. For implementation detail and current release behavior, consult the repository documentation and release history on GitHub.
Last reviewed: September 20, 2026.