Stop paying your SIEM to store noise.
SEGARK Pipeline normalizes every security source to OCSF, cuts ingestion volume before it costs you, and routes the rest to any SIEM, lake, or sink you choose. Detection runs in the pipeline, so threats surface before the storage bill does.
- Open-core · AGPLv3. The free tier is actually free
- OCSF-native normalization
- 17 destinations, zero lock-in
- Detection in the pipeline, not after the bill
git clone https://github.com/SEGARK-oficial/CentralOps.gitcd CentralOps/composedocker compose up --buildConsole at http://localhost:3000 · no license, no account, no sales call
- Latest release
- v2.11.1
- Engine license
- AGPLv3
- Destinations
- 17
- MCP tools
- 52
A simulated run, drawn to scale. Your reduction depends on your sources and your rules.
Most of what you ingest is noise, and you pay SIEM rates to store it
Your SIEM bill grows every quarter, but most of what you are paying to ingest is noise: verbose logs, duplicate events, and low-value telemetry that never triggers a detection. Meanwhile, every new data source means another brittle, vendor-specific connector, and the more you standardize on one platform, the harder it gets to ever leave. You're paying premium per-GB rates to store data you'll never query, locked into tooling you've outgrown.
- 01
Runaway ingestion costs
You pay top-dollar SIEM rates on full-fidelity firehoses, including the 60–80% of volume that has no detection or investigation value.
- 02
Vendor lock-in
Collection, normalization, and routing are all welded to one SIEM, so switching tools or adding a data lake means re-plumbing everything.
- 03
Slow, brittle onboarding
Each new source (EDR, firewall, cloud, identity) is a custom integration with its own schema, delaying coverage and leaving blind spots.
One control point between your sources and your SIEM
Six stages, in this order, on every event. Nothing here is an add-on module. The document beside the steps is one real-shaped sign-in going through them.
Plugin collectors talk to Wazuh, Defender, CrowdStrike, Sophos, Entra ID, Okta, CloudTrail and more. Anything else pushes JSON into a stream you create in the console, or speaks syslog to the native receiver, which classifies FortiGate, PAN-OS, Cisco ASA, pfSense, Linux auth and Windows by content. Cursors, watermarks, rate limits and a per-integration collection filter are the collector's problem, not yours.
Every event is mapped to OCSF 1.8 at the front of the pipeline, with the vendor's raw payload carried alongside. From here on, one rule matches every vendor, and swapping a destination stops being a migration.
GeoIP and ASN from a local database, your own lookup tables keyed by exact value or CIDR, and VirusTotal, OpenCTI or TAXII feeds. Each source has a circuit breaker and a quota, so a dead provider costs you a counter, not a cycle.
In-flight rules run before anything is reduced, with a sliding window: a minimum count over a number of seconds, per key. A match is written into the event and can never be silenced by a reduction rule. Preview a rule against real captured samples before it goes live. The engine ships in the open core; authoring rules is a commercial feature.
Drop the raw block, drop nulls, keep only the fields you query, sample the repetitive, suppress the duplicate. Every byte avoided is metered by cause and by route, so the saving is a number you can show, not a guess.
Route by rule to any of 17 destinations: SIEM, lake, object storage, Kafka, OTLP. Each copy leaves in the shape that sink wants. A delivery that fails lands in a dead-letter queue you can read and replay, and every event keeps a journal of where it went.
{"id": "0f3a9e2c-7b11-4c1e-9c0e-2d5e6a7b8c9d","createdDateTime": "2026-09-06T02:41:07Z","userPrincipalName": "m.oliveira@example.com","userDisplayName": "Marina Oliveira","appDisplayName": "Azure Portal","ipAddress": "203.0.113.42","clientAppUsed": "Browser","conditionalAccessStatus": "notApplied","isInteractive": true,"riskLevelAggregated": "none","status": { "errorCode": 50126, "failureReason": "Invalid username or password." },"deviceDetail": { "browser": "Chrome 128", "operatingSystem": "Linux", "deviceId": null, "isCompliant": null },"location": { "city": null, "state": null, "countryOrRegion": null },"resourceDisplayName": "Windows Azure Service Management API","correlationId": "b4d0c2f1-1a2b-4e3f-8c9d-0e1f2a3b4c5d"}The vendor's JSON, exactly as its API returned it. Nothing has a shape yet, and every byte of it is what you pay to store today.
The result: a single, vendor-neutral control point between your security data and wherever it needs to go. You cut ingestion cost, keep full control of your data, and onboard new sources without re-plumbing your stack.
The console you get on day one
Drawn from the Community core's real screens: the same build you can run tonight.
Watch the whole path at once
Every source, route and destination in one graph. Ribbon thickness is throughput, colour is health. Click any node to drill into what it is doing right now.
Real screens from the Community core. Nothing here is behind a licence.
Collect from what you run. Deliver to what you pay for.
Sources, enrichers and destinations are plugins. Adding one is a config change, not a fork.
- WazuhSIEMpullwazuh
- Microsoft DefenderEDR / XDRpullmicrosoft_defender
- CrowdStrike FalconEDR / XDRpullcrowdstrike
- Sophos CentralEDR / XDRpullsophos
- Microsoft Entra IDIdentitypullentra_id
- OktaIdentitypullokta
- AWS CloudTrailCloud auditpullaws_cloudtrail
- AWS CloudWatch LogsCloud auditpullaws_cloudwatch
- Fortinet FortiGateNetworkpushfortinet_fortigate
- Windows Event Log (WEC)Endpointpushwindows_event_log
- NinjaOneRMMpullninjaone
- Veeam Backup & ReplicationBackuppullveeam
- Custom JSON (any source)Genericpushcustom_json
- Syslog receiver (RFC 3164/5424, CEF, LEEF)Networkpushsyslog
A pipeline your agents can run, not just your engineers
The public MCP server exposes the engine as typed tools. An AI agent can triage drift, dry-run a mapping and follow an event's lineage from a chat, with the one state-changing step gated behind an explicit acknowledgement.
- 01
Reads are free, and most tools read
Samples, drift, lineage, route health, quarantine, the dead-letter queue. A dry run is an HTTP POST that persists nothing, so an agent can iterate on a mapping as long as it wants.
- 02
One write, one explicit acknowledgement
Committing a mapping promotes a live version that collectors pick up in about thirty seconds. The call requires an ack in its arguments, and the previous version stays for rollback.
- 03
Scoped like a person, not like a script
The server authenticates with a personal token and sees exactly what that token sees. A global token is fail-closed on tenant data: an empty answer, never a cross-tenant one.
- 52 tools · Apache-2.0 · stdio in a container, no port exposed
What your team actually gets
Cut your SIEM bill, not your visibility
Reduce, filter and route security data before it hits your SIEM, so you stop paying ingestion rates for noise while keeping every event you need for detection and compliance. The bytes you avoid are metered per route and per cause.
Own your data, skip the lock-in
Vendor-neutral routing to 17 destinations, from Splunk and Elastic to Sentinel, Google SecOps, ClickHouse, S3, Kafka and LogScale. You move sources and sinks freely instead of being trapped by one vendor's format or contract.
Built for MSSPs, isolated by default
Multi-tenant hierarchy with reseller and partner management gives every customer hard-walled isolation from one console, so you onboard new tenants fast without spinning up separate stacks.
Normalize, enrich and detect in the pipeline
Every event is normalized to OCSF, enriched with geo, ASN, your own tables and threat intel, and run through in-flight detection as it flows, so downstream tools receive clean, consistent, analysis-ready data and the signal arrives already flagged.
Open-core honesty, security-grade engineering
The differences that matter when you put a pipeline in front of every security source.
A free tier that's actually free
SEGARK Pipeline is built on CentralOps, its open-source engine: full AGPLv3, self-hosted, and recompilable, with complete ingestion, routing to all 17 destinations, in-stream enrichment, and an OCSF base. No feature is held hostage behind a license check.
Security basics are not upsells
SSO, OIDC and RBAC ship in the free core. Credentials and keys go through KMS or HashiCorp Vault, never plaintext config. Licensing is offline-verifiable, so air-gapped is a deployment option, not a support ticket.
Detection and enrichment happen in the pipeline
We do not just forward data and hope your SIEM catches it. Rules run in-stream on the full-fidelity event, with sliding windows, before reduction; context is attached on the way, with a breaker and a quota per provider.
OCSF-native, end to end
Normalization to the Open Cybersecurity Schema Framework is built into the core path, not a bolt-on adapter. You get consistent, portable events across every source and destination.
Every event has a receipt
A capture journal per event, delivery lineage per destination, drift and quarantine per route, and a dead-letter queue you can replay. When the pipeline drops something, it tells you where and why.
Built to be operated by agents too
A public, Apache-2.0 MCP server exposes 52 typed tools. An AI agent can triage drift, dry-run a mapping and follow lineage from a chat, with the one state-changing call gated behind an explicit acknowledgement.
Start free. Scale when you do.
The Community core is free forever. Pay when you need in-flight detection rules, a supported commercial posture, MSSP multi-tenancy, or Enterprise scale.
Security engineers and single-team SOCs who want a real, self-hosted pipeline without a sales call.
Get started free- Full ingestion from any source: Wazuh, Defender, CrowdStrike, Sophos, Entra ID, Okta, CloudTrail, FortiGate, Windows Event Log, a native syslog receiver and custom JSON push
- Vendor-neutral routing to 17 destinations: Splunk HEC, Elastic, Sentinel, Google SecOps, ClickHouse, S3, Kafka, LogScale, and more
- In-stream enrichment: GeoIP/ASN, your own tables, VirusTotal, OpenCTI, TAXII
- Volume reduction before the meter: drop raw, drop nulls, keep-only, sample, suppress, with bytes avoided metered by cause
- OCSF-native normalization, capture journal per event, replayable dead-letter queue
- SSO/OIDC, RBAC and KMS/Vault secrets, included free; 52-tool MCP server (Apache-2.0)
- OTel-native observability; self-host on Docker Compose or Kubernetes
A single organization that's running SEGARK Pipeline in production and wants a supported, commercial posture.
Start with Starter- Everything in Community
- In-flight detection rules: author them, preview against real captured samples, sliding windows per key, and the built-in IOC rule pack
- Commercial license (no AGPL copyleft obligations)
- Supported, single-tenant production posture with defined SLAs
- Priority bug fixes and security patches
- Onboarding assistance and version-upgrade guidance
- Email/ticket support
Managed security providers and resellers running many customers from one platform.
Talk to sales- Everything in Starter
- Multi-tenant hierarchy with hard cross-tenant isolation
- Reseller / partner management and per-org administration
- Per-tenant routing, detection, quotas, and reporting
- Scoped org-admin roles (delegated tenant management)
- Onboard new customer orgs fast, without new deployments
- MSSP-grade support and onboarding
Large security orgs and regulated environments needing federated search, compliance-grade audit, fleet scale, and air-gapped operation.
Talk to sales- Everything in MSSP
- Federated cross-source, async search across all tenants and sources
- Cross-tenant audit & compliance reporting
- HA / fleet operations at scale
- Offline-verifiable, air-gapped-friendly licensing
- Data residency / data-control controls
- Premium support with named contacts and priority response
Answers before you ask
Everything teams want to know before they run SEGARK Pipeline in production.
Stop paying to store noise.
Spin up the free Community core in minutes. No sales call, no credit card. Upgrade to Starter, MSSP, or Enterprise whenever you're ready.