Edge-ready operations intelligence with an evidence-linked entity graph.

kafSIEM watches Kafka agent traffic and OSINT feeds, materializes entities and relationships in SQLite, and serves analyst workflows through a web desk and typed OpenAPI. Deploy with Docker on a single host. No cluster database required.

Keywords: entity graph, Kafka SIEM, OSINT dashboard, drone fleet operations, SCADA security, edge deployment, ontology packs, provenance, SQLite analyst API.

OSINT | Operations / Drones | Operations / SCADA

No Kafka, API keys, or Docker required.

git clone https://github.com/scalytics/kafSIEM.git && cd kafSIEM
make help          # list all targets
make demo-osint    # public OSINT relations demo (fixtures, no Docker)
make demo-ontology # Operations ontology desk
make demo-fusion   # Fusion desk

make demo-osint opens the OSINT console with bundled alert and incident fixtures — cyber, malware, ICS/energy, and terror clusters in the Relations panel. No Kafka or Docker required.

• Entity graph stored in SQLite: platforms, faults, devices, agents, tasks. Graph edges can cite the source Kafka record.
• Analyst desk: flow queue, topology graph, map, replay studio, entity profiles, provenance drawer.
• Domain packs: YAML ontology for drones and SCADA. Detectors, queries, views, map layers, report templates. No pack executable code.
• Typed API: /api/v1/... with generated OpenAPI. Integrates with existing enterprise platforms.
• Edge deployment: collector writes, API reads, shared volume. Docker Compose or Helm.

Unmanned systems teams tracking readiness, sorties, EW events, software lineage, and signoff evidence across a fleet.

SCADA and critical infrastructure teams connecting plants, devices, change audit, alarms, firmware, vulnerabilities, and engineer sessions.

KafClaw agents
      |
      v
KafScale / Kafka
      |
      v
kafsiem-collector  --->  /data/agentops.db (+ WAL/SHM)
      |                           |
      | legacy /api/*             v
      +---------------->  kafsiem-api  --->  Caddy + web UI

The collector ingests OSINT sources and, when enabled, consumes Kafka traffic. It is the sole writer for observed operational state. kafsiem-api serves read-only analyst resources and enqueues replay requests. See Architecture.

Set mode via UI_MODE and mounted policy files. User-facing copy uses OSINT, Operations, and Fusion. Runtime env values stay AGENTOPS and HYBRID for compatibility.

cp .env.example .env
docker compose up --build

UI: http://localhost:8080

Make targets for local HTTP dev:

make dev-start
make dev-stop
make dev-restart
make dev-logs

wget -qO- https://raw.githubusercontent.com/scalytics/kafSIEM/main/deploy/install.sh | bash

The installer checks Docker, clones or updates the repo, prompts for profile (OSINT, Operations, or Fusion), site address, and profile-specific settings, then starts GHCR images.

curl -s http://localhost:8080/api/v1/ontology/packs | jq .
curl -s http://localhost:8080/api/v1/flows | jq .
curl -s http://localhost:8080/api/v1/entities/platform/auv-7 | jq .

Full contract: api/openapi.yaml. Client notes: docs/api-clients.md.

kafSIEM complements enterprise intelligence platforms. It exposes typed entity and graph APIs, pack-defined ontology, and provenance back to source records.

make check
make ci
make docker-build

Node 25.8.1 and npm 11.11.0 are pinned in package.json, .nvmrc, and .node-version. The Go collector powers scheduled feed refresh, Docker runtime, and local collection commands.

Local workflows (make help for the full list):

Browse corroborated clusters: header Relations → filter by attack type (cyber, terror, maritime, conflict). See docs/userguide.md.

Apache-2.0. See LICENSE.