Project Jupiter
I'm a security enthusiast putting together composable tools for log ingestion, OCSF normalization, ClickHouse storage, detection, hunting, and threat intelligence. They can plug into a full SIEM when connected — or run standalone where that makes more sense.
Overview
I don't want one monolithic SIEM that only ships when everything is done. I split threat intelligence from log processing so each part can ship, run, and mature on its own timeline.
CVE feeds, change deltas, IOC enrichment, MITRE context, Forge detection packs, and analyst investigation. This is what I use to answer: what's being exploited, what changed, what does this indicator mean, does it affect my stack?
Private beta — the part I ship and use today.
Ingest logs from diverse sources, normalize to OCSF, enrich with intel and asset context, and store in ClickHouse for search and retention.
Pipeline in design (e.g. Apache NiFi).
Rules, playbooks, and alerts first — that's what I'm designing next. Context-aware analytics come after rule-based detection works. Hunting and cases tie logs and intel together.
Detection design in progress.
Module 1
I started here because I wanted better CVE and IOC context in my own workflow. Briefr is a self-hosted analyst intelligence pane — five tabs (BRIEF, FEED, IOC LOOKUP, INCIDENTS & NEWS, FORGE). It does not ingest syslog or replace a log pipeline; correlation today is intel-side (CVE ↔ IOC ↔ incidents ↔ detection packs), not log correlation.
My landing screen every morning. A digest of what actually needs attention — not a raw NVD dump — answering what broke overnight and whether it matters to my environment.
The full paginated CVE list behind the brief — stack filtering, asset-profile matching, and everything I need to get a CVE out the door as a report.
Enrich IPs, file hashes, and domains across the sources I actually use — with quota tracking so I know when I am about to hit a limit.
Real-world attack context alongside CVE work — six RSS security sources plus MITRE ATLAS case studies with technique mapping, served from a scheduler-built snapshot.
Detection engineering inside the intel pane — not log execution. See where ATT&CK techniques linked to my CVE feed have community rules, saved packs, or gaps, then generate hunt content per CVE.
How I move through Briefr during real analysis — cross-tab pivots, not separate tools.
Private beta at briefr.projectjupiter.in (access restricted). Proprietary today; open-source licensing under evaluation. Not open for public access or beta requests at this time.
Platform
Each module has a defined role, dependencies, and outputs. I'm designing them to run alone where it makes sense; full SIEM mode connects them through OCSF events and shared APIs.
Threat intelligence and investigation
Self-hosted analyst intelligence pane — CVE context, IOC enrichment, change deltas, and detection engineering (Forge). Not log ingestion.
Log and event ingestion
Ingest security events from network devices, servers, cloud platforms, and applications into a dedicated pipeline.
Parsing and OCSF schema
Parse heterogeneous log formats and map fields to a consistent Open Cybersecurity Schema Framework (OCSF) event model.
Pipeline intelligence and context
Add threat intel, asset context, and IOC matches to events before storage and detection.
Log management and search
Durable storage, retention tiers, indexing, and a query API for search and aggregations.
Rules, playbooks, and alerting
Turn stored events into alerts using configurable rules, playbooks, watchlists, and IOC-driven logic.
Context-aware detection
Advanced analytics and context-aware algorithms layered on top of a working rule-based Detect module.
Investigation and cases
Analyst workflows across logs and intel: search, timelines, pivots, and case management.
Compliance and platform policy
Retention enforcement, access audit, and compliance reporting across all modules.
Architecture
Events flow left to right through the data plane. Briefr sits on the intel plane and feeds Enrich and Detect. Analyze is dashed because I plan to ship it after rule-based detection is working.
Solid connectors are designed interfaces. Dashed Analyze is a later phase for me. Ingestion pipeline example: Apache NiFi — final stack still under evaluation.
Roadmap
I'm not publishing dates. This is the sequence that makes engineering sense to me — dependency order, not marketing promises.
Private beta — threat intel and investigation
Minimal OCSF pipeline into ClickHouse (NiFi-class ingestion)
Rules, playbooks, IOC-driven alerts; automation platform TBD
Wire intel APIs into the live event pipeline
Log timelines, pivots, and case records
Context-aware and ML-assisted detection after rules prove out
Retention, audit, and compliance across modules
Status
Self-hosted — I'm not building a hosted SaaS.
Detection rule format and automation orchestration are under active design.
Not accepting beta sign-ups on this page.
Contact
I'm Harsha Vardhan — a security engineer building practical, self-hosted tools for analysts and small teams. Project Jupiter is my long-term platform for that work.