FENGARDE

Summary from the TLDR InfoSec newsletter

FENGARDE is an open source (Apache-2.0) SIEM aimed at European industrial Mittelstand operators, normalizing 16 parsers spanning Cisco ASA, Windows Event Log, Sysmon, Kubernetes audit, CloudTrail, Modbus/TCP, OPC UA, n8n, and MCP tool-call audit logs into OCSF, running 27 correlation rules over a sliding window into OpenSearch, and rendering alerts as draft NIS2 Article 23 and §32 BSIG incident notifications with every entity-specific fact left as an explicit analyst placeholder rather than fabricated. Triage runs against a local Ollama instance with a documented passthrough stub, so alert data never reaches a third-party LLM API, and the whole detection path is demonstrable without Docker through a zero-infra acceptance test.