FENGARDE

FENGARDE is an open-source, self-hosted security pipeline that turns raw log lines into incidents.

FENGARDE is an open-source, self-hosted security pipeline built for IT, AI, and OT environments. It ingests raw log lines and transforms them into verified security incidents along with draft NIS2 notifications. The architecture utilizes nine decoupled services communicating over a single message bus, allowing individual stages to be scaled, swapped, or restarted independently. It features 46 rules categorized with MITRE ATT&CK, ATLAS, and ICS tags, and includes twelve console views to inspect recorded attack data. The system operates locally via Docker with preflight checks and provides complete visibility into proven versus claimed capabilities. The entire codebase, console, and documentation are open source under the Apache-2.0 license.

FENGARDE at a glance

Best for: Software engineer
Runs on: self-hosted, open source
Pricing: Free
Released: October 2026
Category: AI productivity tool
Website: supermhel.github.io

Key features

Turns raw log lines into verified incidents
Generates draft NIS2 notifications
Uses nine decoupled services on one message bus
Includes 46 rules with MITRE ATT&CK, ATLAS, or ICS tags
Provides twelve console views for recorded data
Runs preflight checks for ports and limits
Exposes an unauthenticated UDP syslog listener on port 5514

Use it for

Replaying recorded lab attacks through a real console
Analyzing security incidents from raw log data
Generating draft NIS2 regulatory notifications
Monitoring IT, AI, and OT pipeline traffic

Alternatives to FENGARDE

Nuvrail — Stages every AI agent email write and send for human sign-off before reaching the mail server.
KloudMate 2.0 — Unifies logs, metrics, traces, and an SRE Copilot in one platform.
Formalini V2 — Basic scans are free with no monthly subscription and firm prices per run.
CVE 2026 109618 exploit — Demonstrates unauthenticated RCE via session upload progress in PHP.
SwarmVault — Compiles raw sources into a local-first knowledge graph without requiring cloud access.
CISO Assistant — It centralizes 130+ cybersecurity frameworks with automatic control mapping.

All FENGARDE alternatives