Big Brother, a tiny self-hosted SOC for linux
this is a very lightweight SIEM/SOC for linux with agents that are only 6mb in size, if you compare that to more common systems like Wazuh which has agents big as hell upto 2GB per system!!!!
this is an MVP (v0.1.0) that is only made for experimental and learning purposes right now, it can work on production environment but it is not recommended to use it, cuz it has no auth and some other factors (read “security” in readme)
it can detect process events and auth (ssh) events right now, with built in rule and detection engine where you create rules right there in dashboard instead of YAML stuff
very easy to setup, one docker compose on dashboard system and one line script for agent hosts, with a demo python script that can fake some detections too.
watch the youtube video demo and have fun! ik its a bit fast sorry lmao realised it too late that i went too deep into “no one gonna watch a long ahhh video for voting” 😭
- 28 devlogs
- 45h




and weird data types too