🛡️ SIB - SIEM in a Box

One-command security monitoring for containers and Linux systems, powered by Falco and VictoriaMetrics.

SIB provides a complete, self-hosted security monitoring stack for detecting threats in real-time. Built on Falco's runtime security engine with VictoriaLogs for log storage and Grafana for visualization. Loki/Prometheus available as an alternative backend.

🌟 Features

Runtime Security: Detect suspicious behavior in real-time using Falco's eBPF-based syscall monitoring
Alert Forwarding: Falcosidekick routes alerts to 50+ destinations (Slack, PagerDuty, Loki, etc.)
Log Aggregation: VictoriaLogs (default) or Loki stores security events with efficient querying
Pre-built Dashboards: Grafana dashboards for security overview and event exploration
MITRE ATT&CK Coverage: Dashboard mapping detections to the ATT&CK framework
Demo Mode: Generate realistic security events to see dashboards in action
Sigma Rules: Convert Sigma rules to Falco/LogsQL format
Threat Intel: IP blocklists from Abuse.ch, Spamhaus, and more
Remote Collectors: Ship logs/metrics from multiple hosts (Vector+vmagent or Alloy)
Fleet Management: Dockerized Ansible for deploying agents across infrastructure (no local Ansible needed)
Smart Deployment: Auto-detects Docker, installs from static binaries if needed — works on any Linux
AI-Powered Analysis (Beta): LLM-based alert analysis with attack vectors, MITRE ATT&CK mapping, and mitigation strategies
One Command Setup: Get started with make install

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                              SIEM in a Box                                   │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  ┌──────────────┐     ┌─────────────────┐     ┌───────────────────────────┐ │
│  │    Falco     │     │  Falcosidekick  │     │      VictoriaLogs         │ │
│  │  (Detection) │────▶│   (Fan-out)     │────▶│      (Log Storage)        │ │
│  │  modern_ebpf │     │                 │     │                           │ │
│  └──────────────┘     └─────────────────┘     └───────────────────────────┘ │
│                                                            │                 │
│                                                            ▼                 │
│  ┌──────────────┐                             ┌───────────────────────────┐ │
│  │ node_exporter│                             │        Grafana            │ │
│  │   (Metrics)  │────────────────────────────▶│   • Security Overview     │ │
│  └──────────────┘                             │   • Events Explorer       │ │
│         │                                     │   • MITRE ATT&CK          │ │
│         ▼                                     │   • Fleet Overview        │ │
│  ┌──────────────┐                             └───────────────────────────┘ │
│  │VictoriaMetrics│                                         ▲                │
│  │   (Metrics)  │──────────────────────────────────────────┘                │
│  └──────────────┘                                                           │
│                                                                              │
└─────────────────────────────────────────────────────────────────────────────┘

📋 Prerequisites

Docker CE 20.10+ from docker.com with Docker Compose v2+, or Podman 4.0+ in rootful mode with podman-compose
- ⚠️ Podman must run as root (rootful mode) — Falco requires kernel access to monitor syscalls
Linux kernel 5.8+ (for modern_ebpf driver)
4GB+ RAM recommended

⚠️ Note: Docker Desktop is not supported. Install Docker CE (Community Edition) directly from docker.com or use Podman.

Hardware Requirements

Deployment	CPU	RAM	Disk	Notes
SIB Server (single host)	2 cores	4GB	20GB	Runs Falco + full stack
SIB Server (with fleet)	4 cores	8GB	50GB+	More storage for logs from multiple hosts
Fleet Agent	1 core	512MB	1GB	Falco + collectors (vmagent or Alloy)

💡 Not a network sniffer! SIB uses Falco's eBPF-based syscall monitoring — it watches what programs do at the kernel level, not network packets. No mirror ports, TAPs, or bridge interfaces needed. Just install on any Linux host and it sees everything that host does.

# Docker CE
docker --version          # Should be 20.10+
docker compose version    # Should be v2+

# Or Podman
podman --version          # Should be 4.0+
podman-compose --version  # Alternative to docker compose

# Kernel (both)
uname -r                  # Should be 5.8+ for eBPF

🚀 Quick Start

# Clone the repository
git clone https://github.com/matijazezelj/sib.git
cd sib

# Configure environment
cp .env.example .env
# Edit .env if needed (defaults work for local testing)

# Install everything
make install

# Verify it's working
./scripts/test-pipeline.sh

Storage Backend

SIB supports two monitoring stacks. Choose based on your preferences:

Stack	Components	Best For
`vm` (default)	VictoriaLogs + VictoriaMetrics + node_exporter	10x less RAM, faster queries, recommended
`grafana`	Loki + Prometheus	Grafana ecosystem, native integration

# In .env - choose your stack (one simple setting)
STACK=vm         # Default - VictoriaMetrics ecosystem (recommended)
STACK=grafana    # Alternative - Grafana ecosystem (Loki + Prometheus)

The make install command automatically:

Deploys the correct storage stack
Configures Falcosidekick to send alerts to the chosen backend
Sets up Grafana with the appropriate datasources and dashboards
For VM stack: includes node_exporter for host metrics

🌐 Access Points

Service	URL	Stack
Grafana	http://localhost:3000	Both
Sidekick API	http://localhost:2801	Both
Loki	http://localhost:3100	`grafana` only
Prometheus	http://localhost:9090	`grafana` only
VictoriaLogs	http://localhost:9428	`vm` only
VictoriaMetrics	http://localhost:8428	`vm` only

Default Grafana credentials: admin / admin

Note: Only the services for your selected STACK will be running.

🔒 Safe defaults: Grafana, Falcosidekick, storage APIs, and AI analysis bind to 127.0.0.1 by default. To expose them on a LAN, set GRAFANA_BIND_ADDR=0.0.0.0, SIDEKICK_BIND_ADDR=0.0.0.0, STORAGE_BIND=0.0.0.0, or ANALYSIS_BIND=0.0.0.0 intentionally.

⚠️ Fleet Security Note: If fleet hosts need to send events to Sidekick (2801), expose it deliberately and use firewall rules to restrict access to your fleet nodes only:
# UFW example: allow only from fleet subnet
ufw allow from 192.168.1.0/24 to any port 2801

🎯 What Gets Detected?

Category	Examples
Credential Access	Reading /etc/shadow, SSH key access
Container Security	Shells in containers, privileged operations
File Integrity	Writes to /etc, sensitive config changes
Process Anomalies	Unexpected binaries, shell spawning
Persistence	Cron modifications, systemd changes
Cryptomining	Mining processes, pool connections

🔍 Comparison (Wazuh, Splunk, Elastic)

Tool	Pros	Cons	Best for
SIB	One-command setup, Falco runtime detection, curated Grafana dashboards, self-hosted	Not a full log SIEM platform, Linux-only detection	Homelabs, startups, lean SecOps teams
Wazuh	Strong host-based SIEM, broad OS support, built-in agents	Heavier setup, more tuning required, multi-component stack	Organizations needing HIDS + log SIEM
Splunk	Powerful search/analytics, enterprise-grade scale	Expensive at scale, complex operations	Large enterprises with budget and dedicated SIEM team
Elastic SIEM	Flexible, open-source core, great search	Requires careful sizing/tuning, operational overhead	Teams already using Elastic Stack

Takeaway: SIB prioritizes speed of deployment and actionable runtime detection. For large-scale log analytics and complex compliance reporting, Wazuh/Splunk/Elastic may be a better fit.

📊 Dashboards

Security Overview

Total events, Critical/Error/Warning/Notice counts
Events over time by priority
Events by rule (pie chart)
🚨 Critical Events panel - Dedicated view for high-priority events
Recent security events log

Events Explorer

Query help with LogQL examples
Event volume by rule
Filterable log view with priority and rule filters

MITRE ATT&CK Coverage

Detection events mapped to ATT&CK tactics
Visual matrix showing coverage across 12 tactics
Events over time by tactic
Technique breakdown and priority distribution
Hostname filter to focus on specific hosts

Fleet Overview

Active hosts with collectors
CPU, memory, disk usage per host
Network traffic graphs
Log volume by host
Hostname selector to filter all panels by host

🛠️ Commands

# Installation (reads STACK from .env: vm or grafana)
make install              # Install all stacks (auto-configures based on STACK)
make uninstall            # Remove everything

# Storage (Manual override)
make install-storage-vm              # Install VictoriaLogs + VictoriaMetrics (default)
make install-storage-grafana         # Install Loki + Prometheus (alternative)

# Management
make start                # Start all services
make stop                 # Stop all services
make restart              # Restart all services
make status               # Show service status
make health               # Quick health check
make doctor               # Diagnose common issues

# Logs
make logs                 # Tail all logs
make logs-falco           # Tail Falco logs
make logs-sidekick        # Tail Falcosidekick logs
make logs-storage         # Tail storage logs (auto-detects stack)
make logs-grafana         # Tail Grafana logs

# Demo & Testing
make demo                 # Run comprehensive security demo (~30 events)
make demo-quick           # Run quick demo (1s delay)
make test-alert           # Generate a test security alert
./scripts/test-pipeline.sh  # Run full pipeline test

# Threat Intel & Sigma
make update-threatintel   # Download threat intel feeds
make convert-sigma        # Convert Sigma rules to Falco/LogsQL

# AI Analysis (Optional)
make install-analysis     # Install AI analysis API (integrated with Grafana)
make logs-analysis        # View analysis API logs

# Utilities
make open                 # Open Grafana in browser
make info                 # Show all endpoints

# Backup & Restore
make backup               # Create timestamped backup of configs, rules, and Grafana dashboards
make restore              # Restore from a backup file

📚 Documentation

docs/installation.md
docs/minimal-install.md
docs/quickstart.md
docs/security-hardening.md
docs/troubleshooting.md
docs/faq.md
ROADMAP.md
Kubernetes deployment: sib-k8s
VictoriaLogs backend: docs/victorialogs.md

📁 Project Structure

sib/
├── Makefile                    # Main entry point
├── .env.example                # Environment template (STACK config)
├── scripts/
│   └── test-pipeline.sh        # Pipeline verification script
├── detection/                  # Falco stack
│   ├── compose.yaml
│   └── config/
│       ├── falco.yaml          # Falco config (modern_ebpf)
│       └── rules/
│           └── custom_rules.yaml  # Custom detection rules
├── alerting/                   # Falcosidekick
│   ├── compose.yaml
│   └── config/
│       ├── config.yaml         # Generated from .env on install (do not edit)
│       └── custom-outputs.yaml.example  # Optional user-managed extra outputs
├── storage/                    # Log storage backends
│   ├── compose-vm.yaml         # VictoriaLogs + VictoriaMetrics (default)
│   ├── compose-grafana.yaml    # Loki + Prometheus (alternative)
│   └── config/
│       ├── loki-config.yml
│       └── prometheus.yml
├── grafana/                    # Dashboards
│   ├── compose.yaml
│   └── provisioning/
│       ├── datasources/
│       │   └── templates/      # Datasource templates
│       └── dashboards/
│           ├── loki/           # Loki-specific dashboards
│           └── victorialogs/   # VictoriaLogs-specific dashboards
├── ansible/                    # Fleet management (Dockerized)
│   ├── inventory/
│   │   ├── hosts.yml.example   # Host inventory template
│   │   └── group_vars/all.yml  # Deployment settings
│   ├── roles/
│   │   ├── falco/              # Falco deployment role
│   │   ├── vm_collectors/      # Vector + vmagent deployment (VM stack)
│   │   ├── alloy/              # Alloy deployment role (Grafana stack)
│   │   ├── certs/              # mTLS certificate distribution
│   │   └── common/             # Shared tasks (Docker checks, etc.)
│   └── playbooks/
├── collectors/                 # Remote host collectors
│   ├── compose-vm.yaml         # VM stack collectors (Vector + vmagent)
│   ├── compose-grafana.yaml    # Grafana stack collectors (Alloy)
│   ├── config/
│   │   ├── vector.toml         # Vector log shipping config
│   │   ├── vmagent.yml         # vmagent metrics scraping config
│   │   └── config.alloy        # Alloy configuration (Grafana stack)
│   └── scripts/
│       └── deploy.sh           # Remote deployment script
└── examples/
    └── rules/                  # Example custom rules

🔧 Configuration

Custom Rules

Add detection rules in detection/config/rules/custom_rules.yaml:

- rule: Detect Cryptocurrency Mining
  desc: Detect cryptocurrency mining processes
  condition: >
    spawned_process and 
    proc.name in (xmrig, minerd, cpuminer)
  output: "Crypto miner detected (user=%user.name cmd=%proc.cmdline)"
  priority: CRITICAL
  tags: [cryptomining, mitre_impact]

Alert Outputs

Configure outputs in .env, then re-run make install-alerting to apply:

SLACK_WEBHOOK_URL=https://hooks.slack.com/services/XXX/YYY/ZZZ
SLACK_CHANNEL=#security-alerts
SLACK_MINIMUM_PRIORITY=warning

PAGERDUTY_ROUTING_KEY=your-routing-key
PAGERDUTY_MINIMUM_PRIORITY=critical

Slack, Discord, PagerDuty, Opsgenie, Teams, and Elasticsearch have .env settings. For any of Falcosidekick's other outputs, copy alerting/config/custom-outputs.yaml.example to custom-outputs.yaml — it is appended to the generated config and never overwritten.

⚠️ alerting/config/config.yaml is regenerated on every install. Do not hand-edit it.

Environment Variables

Key variables in .env:

# Auto-generated on install (leave as CHANGE_ME to regenerate)
GRAFANA_ADMIN_PASSWORD=<auto-generated>
GRAFANA_PORT=3000
LOKI_PORT=3100
PROMETHEUS_PORT=9090
SIDEKICK_PORT=2801

🔒 Security Notes

Internal services (Loki, Prometheus) bind to localhost only
Grafana and Sidekick API are externally accessible (for fleet support)
Falco requires privileged access for syscall monitoring
Change default Grafana password in production
mTLS available for encrypted fleet communication

Hardening Checklist

Restrict external ports to trusted IPs
Put Grafana behind TLS + auth (reverse proxy)
Rotate default credentials before production use
Set retention limits for Loki/Prometheus
Back up Grafana and Loki volumes
Enable mTLS for production fleet deployments (make generate-certs)

See docs/security-hardening.md for full guidance.

🤖 AI-Powered Alert Analysis (Beta)

SIB includes an optional AI-powered analysis feature that uses LLMs to analyze security alerts and provide:

Attack Vector Identification - What technique is being used
MITRE ATT&CK Mapping - Tactic and technique IDs
Risk Assessment - Severity, confidence, and potential impact
Mitigation Strategies - Immediate, short-term, and long-term actions
False Positive Assessment - Likelihood and common legitimate causes

Privacy-First Design

Sensitive data is obfuscated before sending to the LLM:

IPs → [INTERNAL-IP-1], [EXTERNAL-IP-1]
Usernames → [USER-1]
Hostnames → [HOST-1]
Container IDs → [CONTAINER-1]
Secrets/credentials → [REDACTED]

The analyzer auto-detects the storage backend from the STACK env var — it queries VictoriaLogs when STACK=vm (default) or Loki when STACK=grafana.

Quick Start

# Install the Analysis API service
make install-analysis

Your server's IP is auto-detected, and an ANALYSIS_API_TOKEN is generated into .env if you haven't set one. Then open Grafana and use the Events Explorer dashboard to analyze any event with AI — the provisioned data links carry the token for you.

🔒 Every endpoint except /health requires that token (Authorization: Bearer <token> or ?token=<token>). Analysis triggers billed LLM calls, so do not run this API without one. If you rotate the token in .env, re-run make install-analysis to refresh the dashboard links.

Grafana Integration

Once installed, the Events Explorer dashboard includes a table where you can click any event to analyze it with AI:

Open Events Explorer dashboard in Grafana
Scroll to the "🤖 Select Event to Analyze" table
Click on any log line to see the "🤖 Analyze with AI" link
View the analysis with attack vectors, MITRE mapping, and mitigations

The analysis page shows:

Original Alert - The raw event
What Was Sent to AI - The obfuscated version (your sensitive data stays private)
Attack Vector & MITRE ATT&CK mapping
Risk Assessment with severity and confidence
Mitigations (immediate, short-term, long-term)
False Positive Assessment

Browse past analyses from the API history page:

LLM Providers

Provider	Privacy	Setup
Ollama (local)	✅ Data stays on-premises	`ollama pull llama3.1:8b`
OpenAI	⚠️ Data sent to API (obfuscated)	Set `OPENAI_API_KEY`
Anthropic	⚠️ Data sent to API (obfuscated)	Set `ANTHROPIC_API_KEY`

Configure in analysis/config.yaml. See analysis/README.md for full documentation.

📡 Remote Collectors

Deploy lightweight collectors to ship logs and metrics from remote hosts to your central SIB server.

Collector Stacks

SIB Stack	Collectors	Components
`vm` (default)	VM Collectors	Vector (logs) + vmagent + node_exporter (metrics)
`grafana`	Alloy	Grafana Alloy (logs + metrics)

Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                         Hub and Spoke Model                                  │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐                   │
│  │   Host A     │    │   Host B     │    │   Host C     │                   │
│  │ (Collectors) │    │ (Collectors) │    │ (Collectors) │                   │
│  └──────┬───────┘    └──────┬───────┘    └──────┬───────┘                   │
│         │                   │                   │                            │
│         │           Logs  +  Metrics (Remote Write)                         │
│         │                   │                   │                            │
│         └───────────────────┼───────────────────┘                            │
│                             ▼                                                │
│                   ┌──────────────────┐                                       │
│                   │    SIB Server    │                                       │
│                   │  ┌────────────┐  │                                       │
│                   │  │VictoriaLogs│  │  ◀── Logs (or Loki for grafana stack)│
│                   │  └────────────┘  │                                       │
│                   │  ┌────────────┐  │                                       │
│                   │  │VictoriaM.  │  │  ◀── Metrics (or Prometheus)         │
│                   │  └────────────┘  │                                       │
│                   │  ┌────────────┐  │                                       │
│                   │  │  Grafana   │  │  ◀── Fleet Overview dashboard        │
│                   │  └────────────┘  │                                       │
│                   └──────────────────┘                                       │
│                                                                              │
└─────────────────────────────────────────────────────────────────────────────┘

Enable Remote Mode

On the SIB server, enable external access for collectors:

make enable-remote

This exposes storage endpoints externally:

VM stack: VictoriaLogs (9428), VictoriaMetrics (8428)
Grafana stack: Loki (3100), Prometheus (9090)

Ensure your firewall is configured appropriately.

Deploy Collector to Remote Host

# Using the Makefile (recommended)
make deploy-collector HOST=user@remote-host

# Or using the deploy script directly
./collectors/scripts/deploy.sh user@192.168.1.50 192.168.1.163

The deploy script will:

Copy collector configuration to the remote host
Configure the SIB server address
Start collectors via Docker Compose
Verify the deployment

What Gets Collected

Type	Sources	Labels
System Logs	`/var/log/syslog`, `/var/log/messages`	`job="syslog"`
Auth Logs	`/var/log/auth.log`, `/var/log/secure`	`job="auth"`
Kernel Logs	`/var/log/kern.log`	`job="kernel"`
Journal	systemd journal	`job="journal"`
Docker Logs	All containers	`job="docker"`, `container=...`
Node Metrics	CPU, memory, disk, network	`job="node"`

All data is tagged with host (hostname of the remote machine).

Manual Deployment

If you prefer manual deployment:

# On the remote host
mkdir -p ~/sib-collector/config

# For VM stack (default): copy Vector and vmagent configs
scp collectors/config/vector.toml user@remote:~/sib-collector/config/
scp collectors/config/vmagent.yml user@remote:~/sib-collector/config/
scp collectors/compose-vm.yaml user@remote:~/sib-collector/compose.yaml

# For Grafana stack: copy Alloy config
# scp collectors/config/config.alloy user@remote:~/sib-collector/config/
# scp collectors/compose-grafana.yaml user@remote:~/sib-collector/compose.yaml

# Edit configs - replace SIB_SERVER with your SIB server IP

# Start the collector
ssh user@remote "cd ~/sib-collector && SIB_SERVER=192.168.1.100 HOSTNAME=\$(hostname) docker compose up -d"

Verify Collector is Working

# VM stack (default) - check Vector and vmagent
ssh user@remote "docker logs sib-vector --tail 20"
ssh user@remote "docker logs sib-vmagent --tail 20"

# Grafana stack - check Alloy
# ssh user@remote "docker logs sib-alloy --tail 20"

# Query logs on SIB server
curl -s "http://localhost:9428/select/logsql/query?query=*" | head   # VM stack
# curl -s "http://localhost:3100/loki/api/v1/query?query={job=~\".+\"}" | head  # Grafana stack

# Check metrics
curl -s 'http://localhost:8428/api/v1/query?query=node_uname_info'   # VM stack
# curl -s 'http://localhost:9090/api/v1/query?query=node_uname_info'  # Grafana stack

See collectors/README.md for detailed configuration.

Fleet Overview Dashboard

The Fleet Overview dashboard in Grafana shows:

Number of active hosts with collectors
CPU, memory, disk utilization per host
Network traffic graphs
Log volume by host

🚀 Fleet Management with Ansible

For managing multiple hosts at scale, SIB includes a Dockerized Ansible setup. No local Ansible installation required.

Deployment Strategy

SIB supports both native packages and Docker containers:

Strategy	Description
`docker`	Run agents as containers. Recommended for simplicity.
`native`	Falco from repo as systemd service
`auto` (default)	Use Docker if available, otherwise native

Note: VM stack collectors (Vector, vmagent, node_exporter) always run as Docker containers. The strategy setting primarily affects Falco deployment.

⚠️ LXC Limitation: Falco cannot run in LXC containers due to kernel access restrictions. Use VMs or run Falco on the LXC host itself.

Quick Start

# Configure your hosts
cp ansible/inventory/hosts.yml.example ansible/inventory/hosts.yml
vim ansible/inventory/hosts.yml  # Add your servers

# Test connectivity
make fleet-ping

# Deploy to all hosts
make deploy-fleet

# Or target specific hosts
make deploy-fleet LIMIT=webserver

Fleet Commands

Command	Description
`make deploy-fleet`	Deploy Falco + collectors to all fleet hosts
`make update-rules`	Push detection rules to fleet
`make fleet-health`	Check health of all agents
`make fleet-docker-check`	Check/install Docker on fleet hosts
`make fleet-ping`	Test SSH connectivity
`make fleet-shell`	Open shell in Ansible container
`make remove-fleet`	Remove agents from fleet

See ansible/README.md for detailed configuration options.

🎭 Demo Mode

Generate realistic security events locally on your SIB server — no fleet setup required! Perfect for first-time users, demonstrations, or testing detection capabilities.

# Run comprehensive demo (~30 events across 9 MITRE ATT&CK categories)
make demo

# Quick demo with 1-second delays
make demo-quick

The demo spins up a temporary container and triggers various Falco rules. Watch your Grafana dashboards light up in real-time at http://localhost:3000.

Demo Coverage

The demo script generates events across these MITRE ATT&CK categories:

Tactic	Events Generated
Credential Access	Shadow file access, /etc/passwd reads
Execution	Shell spawning, script execution
Persistence	Cron job creation, systemd manipulation
Defense Evasion	Log clearing, history deletion
Discovery	System enumeration, network scanning
Impact	Crypto miner detection
Container Escape	Docker socket access, namespace breakout
Lateral Movement	SSH key access, authorized_keys reads
File Integrity	/etc/ file modifications

Each event triggers corresponding Falco rules and flows through to Grafana in real-time.

📐 Sigma Rules Integration

Sigma is the universal language for security detection rules. SIB includes a converter to translate Sigma rules to Falco rules and LogsQL alerts (VictoriaLogs).

# Convert all Sigma rules in sigma/rules/
make convert-sigma

# Convert to LogsQL for VictoriaLogs (default)
./sigma/sigma2sib.py sigma/rules/ -o logsql

# Convert a specific rule
./sigma/sigma2sib.py sigma/rules/crypto_mining.yml

Included Sample Rules

Rule	Description	MITRE Tactic
`crypto_mining.yml`	Detects cryptocurrency miners	Impact (T1496)
`shadow_access.yml`	Password file access	Credential Access (T1003)
`ssh_keys.yml`	SSH private key access	Credential Access (T1552)
`reverse_shell.yml`	Reverse shell patterns	Execution (T1059)
`container_escape.yml`	Container breakout attempts	Privilege Escalation (T1611)

Adding More Sigma Rules

Download rules from the Sigma community rules repo
Place .yml files in sigma/rules/
Run make convert-sigma
Copy generated Falco rules to detection/config/rules/custom_rules.yaml

🎯 MITRE ATT&CK Coverage

SIB includes a MITRE ATT&CK dashboard that maps all detections to the ATT&CK framework, providing visibility into your security coverage.

Dashboard Features

Tactic Coverage: 12 stat panels showing detection counts for each ATT&CK tactic
Timeline View: Events over time grouped by tactic
Technique Breakdown: Table showing most-triggered techniques
Priority Distribution: Pie chart of event severities

Covered Tactics

The dashboard tracks events across all ATT&CK tactics:

┌──────────────┬───────────────┬────────────────┬───────────────────┐
│ Initial      │ Execution     │ Persistence    │ Privilege         │
│ Access       │               │                │ Escalation        │
├──────────────┼───────────────┼────────────────┼───────────────────┤
│ Defense      │ Credential    │ Discovery      │ Lateral           │
│ Evasion      │ Access        │                │ Movement          │
├──────────────┼───────────────┼────────────────┼───────────────────┤
│ Collection   │ Command &     │ Exfiltration   │ Impact            │
│              │ Control       │                │                   │
└──────────────┴───────────────┴────────────────┴───────────────────┘

Viewing the Dashboard

Open Grafana at http://localhost:3000
Navigate to Dashboards → MITRE ATT&CK Coverage
Run make demo to generate events across multiple tactics

🕵️ Threat Intelligence

SIB can enrich detections with threat intelligence from public IP blocklists.

# Download/update threat intel feeds
make update-threatintel

Included Feeds

Source	Feed Type	URL
Feodo Tracker	C&C IPs	abuse.ch
SSL Blacklist	SSL abuse IPs	abuse.ch
Emerging Threats	Compromised IPs	rules.emergingthreats.net
Spamhaus DROP	Spam/DDoS	spamhaus.org
Blocklist.de	Attack IPs	blocklist.de
CINSscore	Bad reputation	cinsscore.com

Generated Files

After running make update-threatintel:

threatintel/
├── feeds/                      # Individual feed downloads
│   ├── feodo_ipblocklist.txt
│   ├── sslbl_aggressive.txt
│   ├── emerging_threats.txt
│   ├── spamhaus_drop.txt
│   ├── blocklist_de_ssh.txt
│   ├── blocklist_de_all.txt
│   └── cinsscore.txt
├── combined_blocklist.txt      # Unified blocklist
├── falco_threatintel_rules.yaml # Generated Falco rules
└── lookup-ip.sh                # IP lookup utility

Using Threat Intel

# Look up an IP against all feeds
./threatintel/lookup-ip.sh 1.2.3.4

# Add generated rules to Falco
cat threatintel/falco_threatintel_rules.yaml >> detection/config/rules/custom_rules.yaml
make restart

Automating Updates

Add to crontab to update feeds daily:

# Update threat intel every day at 2 AM
0 2 * * * cd /path/to/sib && make update-threatintel

🐛 Troubleshooting

Falco won't start

# Check kernel version (need 5.8+ for modern_ebpf)
uname -r

# Check Falco logs
docker logs sib-falco

# Verify privileged mode is working
docker run --rm --privileged alpine echo "OK"

No events in Grafana

# Run the pipeline test
./scripts/test-pipeline.sh

# Check Falcosidekick is receiving events
docker logs sib-sidekick --tail 20

# Query Loki directly (Grafana stack)
curl -s "http://localhost:3100/loki/api/v1/query?query={source=\"syscall\"}" | jq .

# Query VictoriaLogs directly (VM stack — default)
curl -s 'http://localhost:9428/select/logsql/query?query=source:syscall&limit=5'

📜 License

Apache 2.0 License - See LICENSE for details.

🙏 Acknowledgments

Falco - Cloud native runtime security
Falcosidekick - Alert routing
Grafana - Observability platform
Loki - Log aggregation
Prometheus - Metrics monitoring
VictoriaMetrics - Fast metrics & logs storage (thanks @valyala for the suggestion!)

Name		Name	Last commit message	Last commit date
Latest commit History 100 Commits
.ansible		.ansible
.github/workflows		.github/workflows
alerting		alerting
analysis		analysis
ansible		ansible
certs		certs
collectors		collectors
detection		detection
docs		docs
examples		examples
grafana		grafana
scripts		scripts
secrets		secrets
sigma		sigma
storage		storage
threatintel		threatintel
.env.example		.env.example
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
ROADMAP.md		ROADMAP.md
SECURITY.md		SECURITY.md
ruff.toml		ruff.toml

Folders and files

Latest commit

History

Repository files navigation

🛡️ SIB - SIEM in a Box

🌟 Features

🏗️ Architecture

📋 Prerequisites

Hardware Requirements

🚀 Quick Start

Storage Backend

🌐 Access Points

🎯 What Gets Detected?

🔍 Comparison (Wazuh, Splunk, Elastic)

📊 Dashboards

Security Overview

Events Explorer

MITRE ATT&CK Coverage

Fleet Overview

🛠️ Commands

📚 Documentation

📁 Project Structure

🔧 Configuration

Custom Rules

Alert Outputs

Environment Variables

🔒 Security Notes

Hardening Checklist

🤖 AI-Powered Alert Analysis (Beta)

Privacy-First Design

Quick Start

Grafana Integration

LLM Providers

📡 Remote Collectors

Collector Stacks

Architecture

Enable Remote Mode

Deploy Collector to Remote Host

What Gets Collected

Manual Deployment

Verify Collector is Working

Fleet Overview Dashboard

🚀 Fleet Management with Ansible

Deployment Strategy

Quick Start

Fleet Commands

🎭 Demo Mode

Demo Coverage

📐 Sigma Rules Integration

Included Sample Rules

Adding More Sigma Rules

🎯 MITRE ATT&CK Coverage

Dashboard Features

Covered Tactics

Viewing the Dashboard

🕵️ Threat Intelligence

Included Feeds

Generated Files

Using Threat Intel

Automating Updates

🐛 Troubleshooting

Falco won't start

No events in Grafana

📜 License

🙏 Acknowledgments

About

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages