LogOcean

01Overview

LogOcean is a self-hosted, agentless SIEM that ingests network, endpoint, cloud, identity, and OT/ICS logs from 29 vendors, auto-detects each format, normalizes every record to one common schema, and retains everything in PostgreSQL for three years or more. It takes logs through three front doors — a web upload page, an HTTP ingest API with API-key auth, and a syslog receiver (UDP/TCP/TLS) fronted by a bounded async queue — so a burst of live traffic never blocks the receiver. There are no agents to deploy: you point collectors, forwarders, and other tools at it.

Ingested events are matched inline against a Sigma-compatible detection engine (90 detection rules) while a background scheduler runs 10 correlation/threshold rules over the event store, raising alerts you triage at /alerts and group into cases. On top of the detection core sit the pieces a SOC actually needs: threat-intel IOC enrichment, webhook/email notifications, agentless response playbooks with time-boxed auto-revert, UEBA entity-risk scoring, kill-chain reconstruction that stitches related alerts into multi-tactic attack stories, and a detection-engineering workbench that maps coverage and flags noisy or dead rules.

What sets LogOcean apart is that its detection posture is measured, not asserted: a /coverage scoreboard computes MITRE ATT&CK (Enterprise + ICS) and MITRE ATLAS coverage directly from the rules, exports ATT&CK Navigator layers, and is enforced by a CI rule-linter. A community SigmaHQ importer translates the open rule corpus into the engine, and an optional Claude-powered SOC copilot explains alerts, summarizes cases, and drafts Sigma rules from plain English. Passive OT/ICS monitoring ingests Zeek + ICSNPP telemetry (Modbus/DNP3/S7comm/CIP) with an ATT&CK-for-ICS rule pack and IEC 62443 / NERC CIP mapping — without ever touching a device.

It is built for security engineers and small-to-mid SOC teams who want a real, auditable SIEM they fully control — no per-GB licensing, no cloud lock-in, no JavaScript build step. The whole stack is Python + FastAPI + PostgreSQL 16, server-rendered, and tested unit + integration against a real database in CI across Python 3.11–3.13.

02Key Capabilities

03Architecture

Three ingest inputs share one source-agnostic core pipeline: detect format, parse with a vendor parser, normalize to a common NormalizedEvent schema, and store in month-partitioned PostgreSQL. Live sources buffer in a bounded async queue drained by batching writer workers. Every event is evaluated inline against per-event detection + threat-intel rules and updates UEBA baselines as it is stored, while a background scheduler runs correlation SQL over the event store; both raise rows in the alerts table that fan out to notifications and agentless response.

04Project Structure

05Security Controls

06Technology Stack

Language

Python 3.11–3.13

Web framework

FastAPI + Uvicorn, Jinja2 server-rendered UI (no JS build step, no chart library)

Database

PostgreSQL 16 via psycopg 3 (+ psycopg_pool), RANGE-partitioned with GIN full-text/jsonb indexes

Key dependencies

pyyaml (rules), python-dateutil (time parsing), python-multipart (uploads); anthropic optional for the AI copilot

Testing

pytest — 303 test functions across a DB-free unit tier and a real-Postgres integration tier

CI

GitHub Actions (.github/workflows/tests.yml): unit matrix on Python 3.11/3.12/3.13 + integration job against a Postgres 16 service container

Deployment

docker compose (Postgres + app) or local uvicorn; schema auto-created on startup

Auth/crypto

Stdlib-only pbkdf2 password hashing; AWS SigV4, OAuth2 client-credentials, and RS256 signed-JWT auth for collectors without SDKs

07Quick Start

$ docker compose up --build   # starts Postgres + the app, then open http://localhost:8000 and upload a file from samples/
$ export DB_DSN=postgresql://logocean:logocean@localhost:5432/logocean && uvicorn app.main:app --reload   # local run; schema auto-creates on startup
$ curl -X POST 'http://localhost:8000/api/v1/ingest?format=auto&filename=fw.log' -H 'X-API-Key: lo_...' --data-binary @fw.log   # HTTP ingest API
$ SYSLOG_ENABLED=true   # listen on UDP+TCP 5514, then point a collector/device at the syslog receiver
$ git clone https://github.com/SigmaHQ/sigma && python scripts/import_sigma.py --src sigma/rules --write   # import community rules, then restart to load
$ PYTHONPATH=. python -m pytest tests/ -m 'not integration' -q   # run the DB-free unit tier

08Compliance & Frameworks

09Integrations & Outputs