Building a Custom SIEM Platform After an Insider Incident
Insider-incident detection and alert time
Across agent, central, and control planes
Production Ubuntu hosts under surveillance
After an insider SSH'd into production, ran a refund script from /tmp, and deleted it, the company needed real-time code-and-execution surveillance across ~30 Ubuntu hosts — with deterministic detection, not just log aggregation.
We designed a 10-service platform across three planes: a lightweight Go host agent (auditd netlink, fanotify content capture, cgroup actor classification), a central plane (Go Ingester with mTLS gRPC, ClickHouse store, NATS JetStream, Python AI Brain for code analysis), and a control plane with ed25519-signed manifests and internal CA.
Facing a similar challenge?
We'll tell you how this approach adapts to your problem — and what it would take to ship it.
Book a strategy call