Project Jupiter
Composable tools for log ingestion, OCSF normalization, ClickHouse storage, detection, hunting, and threat intelligence — each module can ship on its own or plug into a full SIEM when connected.
Overview
I split threat intelligence from log processing so each part can ship, run, and mature on its own timeline — not one monolithic SIEM that only ships when everything is done.
CVE feeds, change deltas, IOC enrichment, MITRE context, Forge detection packs, and analyst investigation — answering what's exploited, what changed, and whether it affects my stack.
Open source · monthly public intel snapshots for self-hosters
Ingest logs, normalize to OCSF, enrich with intel and asset context, store in ClickHouse for search and retention.
Pipeline in design (e.g. Apache NiFi).
Rules, playbooks, and alerts first — context-aware analytics after rule-based detection works. Hunting and cases tie logs and intel together.
Detection design in progress.
Module 1
Apache 2.0 open-source, self-hosted CVE and IOC intelligence for analysts — BRIEF, FEED, IOC LOOKUP, INVESTIGATE, ADVISORIES & INTEL, and FORGE in one shell. Intel-side correlation today, not log ingestion or SIEM replacement.
My landing screen every morning. A digest of what actually needs attention — not a raw NVD dump — answering what broke overnight and whether it matters to my environment.
The full paginated CVE list behind the brief — stack filtering, asset-profile matching, and everything I need to get a CVE out the door as a report.
The investigation surface for a single CVE — operational priority, enrichment, Sigma/SIEM snippets, and explainable correlation without leaving the feed.
Enrich IPs, file hashes, and domains across the sources I actually use — with quota tracking so I know when I am about to hit a limit.
Graph browser over intel BRIEFR already stores — CVE, IOC, technique, and publication hops. Search once, expand nodes to pivot like an Obsidian map; no live enrichment on each click.
Real-world attack context alongside CVE work — curated headlines, structured security publications, and MITRE ATLAS case studies with technique mapping, served from scheduler-built snapshots.
Detection engineering inside the intel pane — not log execution. See where ATT&CK techniques linked to my CVE feed have community rules, saved packs, or gaps, then generate hunt content per CVE.
The analyst-facing admin slice — enough visibility to trust the feeds and tune alerts without touching scheduler jobs, API secrets, or destructive operator actions.
Full operator console for keys, rate limits, feed freshness, and scheduler health — the surfaces I check when something stops syncing or a provider quota is exhausted.
Cross-tab pivots during real analysis — CVE feed to IOC lookup to advisories context without leaving the pane.
Platform
Each module has a defined role and outputs. They run alone where it makes sense; full SIEM mode connects them through OCSF events and shared APIs.
Threat intelligence and investigation
Self-hosted analyst intelligence pane — CVE context, IOC enrichment, stored-intel investigation graph, change deltas, and detection engineering (Forge). Not log ingestion.
Log and event ingestion
Ingest security events from network devices, servers, cloud platforms, and applications into a dedicated pipeline.
Parsing and OCSF schema
Parse heterogeneous log formats and map fields to a consistent Open Cybersecurity Schema Framework (OCSF) event model.
Pipeline intelligence and context
Add threat intel, asset context, and IOC matches to events before storage and detection.
Log management and search
Durable storage, retention tiers, indexing, and a query API for search and aggregations.
Rules, playbooks, and alerting
Turn stored events into alerts using configurable rules, playbooks, watchlists, and IOC-driven logic.
Context-aware detection
Advanced analytics and context-aware algorithms layered on top of a working rule-based Detect module.
Investigation and cases
Analyst workflows across logs and intel: search, timelines, pivots, and case management.
Compliance and platform policy
Retention enforcement, access audit, and compliance reporting across all modules.
Architecture
Events flow left to right through the data plane. Briefr sits on the intel plane and feeds Enrich and Detect. Analyze is dashed because I plan to ship it after rule-based detection is working.
Solid connectors are designed interfaces. Dashed Analyze is a later phase for me. Ingestion pipeline example: Apache NiFi — final stack still under evaluation.
Roadmap
I'm not publishing dates. This is the sequence that makes engineering sense to me — dependency order, not marketing promises.
Open source — threat intel, investigation, and open-core intel snapshots
Minimal OCSF pipeline into ClickHouse (NiFi-class ingestion)
Rules, playbooks, IOC-driven alerts; automation platform TBD
Wire intel APIs into the live event pipeline
Log timelines, pivots, and case records
Context-aware and ML-assisted detection after rules prove out
Retention, audit, and compliance across modules
Status
Self-hosted by design — not building a hosted SaaS.
Detection rule format and automation orchestration under active design.
Contact
I'm Harsha Vardhan — a security engineer building practical, self-hosted tools for analysts and small teams. Project Jupiter is my long-term platform for that work.