FENGARDE

About

FENGARDE is a self-hosted security pipeline that normalizes logs from IT, AI and OT sources into the OCSF schema, applies 46 detection rules tagged with MITRE ATT&CK, ATLAS or ICS, and groups alerts into incidents with a causal graph and a hash-chained evidence package. It can draft a NIS2 incident notification, and AI triage runs through a local Ollama model or a labelled stub so alert data stays on the network. The README reports poor triage accuracy in the two models measured, and the project page marks stubbed or unbuilt capabilities.