Skip to content
Open source incident management and response platform.
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
cyphon Replace Dunbar with ControlScan (#691) Feb 22, 2019
docs Replace Dunbar with ControlScan (#691) Feb 22, 2019
entrypoints Replace Dunbar with ControlScan (#691) Feb 22, 2019
etc Replace Dunbar with ControlScan (#691) Feb 22, 2019
.dockerignore Include default configuration and pull secrets from SSM (#134) (#151) Jul 31, 2017
.travis.yml Replace Dunbar with ControlScan (#691) Feb 22, 2019 Hotfix/1.6.6 (#574) Jun 14, 2018
LICENSE.txt Initial commit Mar 25, 2017 Hotfix/sphinx py3 (#396) Feb 14, 2018 Replace Dunbar with ControlScan (#691) Feb 22, 2019
docker-compose.travis.yml Replace Dunbar with ControlScan (#691) Feb 22, 2019
setup.cfg Replace Dunbar with ControlScan (#691) Feb 22, 2019

Build Status Coverage Status Codacy Badge Updates Documentation Status Gitter chat



Collect, Alert, Respond

Cyphon is an incident-response platform that receives, processes, and triages events to create a more efficient analytic workflow — aggregating data, bundling and prioritizing alerts, and empowering analysts to investigate and document incidents.


Cyphon collects data from a variety of sources, including emails, log messages, and social media. It lets you shape the data however you like, so it’s easier for you to analyze. You can also enhance your data with automated analyses, like geocoding.

Cyphon admin dashboard


Cyphon creates alerts for important data as it arrives, so you’re notified when something of interest happens. You can prioritize alerts using custom rulesets, and bundle related alerts so you don't get inundated.

Cyclops UI dashboard view


Analysts can quickly investigate alerts by exploring related data, and annotate alerts with their findings. With JIRA integration, they can escalate important alerts by creating a ticket in Service Desk.

Cyclops UI alert view

Cyclops UI related data panel

Use Cases

Incident Management

Many organizations manage post-processed security events as email notifications, which is incredibly inefficient. An inbox flooded with alert notifications creates an environment where critical issues are overlooked and rarely investigated.

Cyphon eliminates this issue by throttling events and prioritizing them based on user-defined rules. Analysts can quickly investigate incidents by correlating other data sets against indicators that matter. They can then annonate alerts with the results of their analysis.

Today, Cyphon supports integrations with Bro, Snort, Nessus, and other popular security products.

Social Media Monitoring

Leveraging publicly available APIs, Cyphon can collect data from streaming sources. Search is based on keywords, geofencing, and adhoc parameters. Cyphon supports the current version of the Twitter Public Streams API.

IoT and Sensor Data Processing

Cyphon can process events from any sensor type, offering a unique way to analyze information from physical environments.


  • Aggregate data from numerous sources: email, logs, social media, and APIs
  • Enhance data with automated analyses, like geoip
  • Generate custom alerts with push notifications
  • Throttle alerts and bundle related incidents
  • View alerts by category, priority, and source
  • Investigate alerts and track work performed


The Cyphon platform is made up of a backend data processing engine ("Cyphon Engine") and a security operations front end UI for visualization ("Cyclops"). They are maintained in separate projects. The Cyclops project can be found here.


Cyphon works with the help of several open source projects. To get Cyphon up and running, you'll need to install all of its dependencies. We've simplified this process by using Docker, which allows you to easily deploy an application as a set of microservices. Additionally, we've created a set of files for running Cyphon in both development and production environments. Employing a Docker Compose file enables you to quickly install and run Cyphon and the other services it uses, including:

Our Docker Compose files are available on GitHub as Cyphondock. If you'd like to work with our Docker image directly, you can find it on Docker Hub:


Consult our official documentation to learn more about Cyphon. The docs include set-up instructions and a description of Cyphon’s API. Documentation for Cyclops can be found here.


Cyphon is free software and available for personal or professional use. The Cyphon Project is maintained by ControlScan and is distributed under a dual license. The Cyphon Engine is distributed under the GPLv3 License. Cyclops is subject to a non-commercial use license.

You can’t perform that action at this time.