Your rule catalog is not a detection engine.
SocEyes makes it one.
SocEyes captures raw packets off the wire, evaluates 6,500+ detection rules from Sigma, Elastic, Wazuh and Panther against live traffic, triages every hit with AI, and can contain confirmed threats in-kernel — from one self-hosted stack.
Packet in, containment out
Four stages, one data path. Every stage is watermark-tracked and survives restarts; nothing is re-processed and nothing is dropped silently.
Raw packets on the wire
A Go agent reads AF_PACKET directly from the interface — no pcap middleman. Ethernet, IPv4, TCP, UDP and ICMP are decoded; 512-byte payload snapshots ship with every event.
Every rule, every event
The rule engine compiles your full catalog — Sigma, Elastic detection-rules, Wazuh XML and Panther Python — into matchers and evaluates each captured event against all of them.
AI decides what matters
Fired alerts go through LLM triage with a true/false-positive verdict and confidence score before any human or automation sees them.
Containment on the wire
Confirmed hits trigger response playbooks. block_egress writes an nftables set entry, packets drop in-kernel, and TTL rollback restores connectivity automatically.
Built for the 3 a.m. shift
Thirteen operator views on a single flight-deck design system: severity is the only loud color, every table streams live, and the state of the whole stack is visible from the top bar.
Four platforms. One matcher loop.
The compiler turns each platform's native format into event matchers — verified with true-positive and false-positive probes on real payloads. Rules that can't discriminate (empty enrich indices, upstream stubs) are skipped with a stated reason.
| Engine | Compiled | Notes |
|---|---|---|
| Sigma | 3,103 / 3,108 | Full detection grammar: selections, keywords, |contains|all, 1 of, not/and/or |
| Elastic | 1,503 / 1,764 | KQL, EQL and Lucene parsed natively; ESQL and threat-match joins skipped |
| Wazuh | 1,089 / 1,305 | match/regex from source XML, program_name and level filtering |
| Panther | 867 / 1,024 | Real rule() Python executed in a restricted namespace |
Everything an operator asks for next
▸Behavioral network detectors
Port scans (T1046), SSH brute force (T1110), SYN floods (T1498), C2 beaconing with jitter analysis (T1071) and volume-based data exfiltration (T1041) run continuously over the capture stream.
▸Threat-intel enrichment
Abuse.ch Feodo and URLhaus feeds sync into a local indicator store on a schedule you control. Events touching a known-bad IP or domain are enriched and the corresponding TI rules fire.
▸A catalog that actually runs
Most tools treat imported rules as documentation. SocEyes compiles them into executable matchers — a rule that can't evaluate against real events is skipped loudly, never silently.
▸Self-hosted, one binary per role
API + detection loop in one FastAPI process, capture agent as a static Go binary, embedded SQLite with Elasticsearch as an optional accelerator. No cluster required.
▸Flight-deck console
A dense operator UI: ECAM-style status bar, KPI strip with sparklines, timeline, severity donut, MITRE playbook view and live alert tables — all streaming from real data.
▸Full audit trail
Every detection, triage verdict, response action and rollback is recorded in the unified store with actor, rule citation and timestamp. Query it from the console or the API.
Running in minutes
Linux host with Docker (for test traffic) and root access for capture. Everything else — Python env, Go toolchain for the agent build — is handled by the installer.
Clone and install
One command sets up the Python environment and builds the Go capture agent.
git clone https://github.com/devansh/soceyes.gitcd soceyes./soceyes install
Start the stack
The API boots with the detection loop, rule engine and response engine. First start indexes the full rule catalog.
./soceyes start./soceyes status # health, rule counts, detector state
Point an agent at an interface
Run the capture agent as root (AF_PACKET needs CAP_NET_RAW) on the interface you want watched.
# e.g. watch container trafficsudo SOC_API_URL=http://127.0.0.1:8088 \SOC_AGENT_INTERFACE=docker0 ./bin/soceyes-agent
Open the console
The flight-deck UI runs on port 3000 and streams live from the API on 8088.
cd frontend && npm install && npm run dev# http://localhost:3000