Syslog ingest
UDP/TCP 5514 MikroTik pipeline — firewall, hotspot, auth, VPN.
Unternehmens-SIEM für MikroTik — Syslog, 5651 Hotspot, Korrelation, Hunt AI, RouterOS-Blockierung.
Built for ISPs, hotels, campuses and MSPs running RouterOS.
UDP/TCP 5514 MikroTik pipeline — firewall, hotspot, auth, VPN.
~500 logs/sec on modest hardware with BRIN indexes.
16+ MikroTik rules: admin brute, hotspot fail, port scan, TOR.
Multi-event rules with cooldown and MITRE-lite tags.
TOR, FireHOL, Spamhaus, AnyDesk — auto-updated.
User/MAC identity on traffic — signed archives.
Evidence SQL + SOC playbooks — operational answers.
Ack, close, FP, notes, case, API block.
RouterOS address-list via API with auto expiry.
MSPs: isolated rules, devices, alerts per customer.
SOC posture, geo charts, device health, AI briefing.
Signed export packages for audit.
From syslog packet to signed 5651 archive, from alert to MikroTik block.
Single-purpose MikroTik collector.
Structured src/dst, ports, action, category, threat score.
Internet access log archives for Turkish compliance.
Session → traffic row identity mapping.
Threshold, port access, IP list, pattern wizard.
Feed updater + manual IOC.
MSP-ready customer isolation.
Search + AI assistant combined.
Unified alert triage workflow.
Entity timeline for IP/user/MAC.
RouterOS address-list blocking.
Lightweight incidents from alerts.
Python collector + PostgreSQL + PHP panel — no Elasticsearch cluster.
Evidence-first SOC chat — SQL-backed facts and playbook library.
Turkish Internet Law compliant access logs with hash chain.
1 devices · 1 users
7 days retention
5 devices · 3 users
30 days retention
25 devices · 10 users
90 days retention
∞ devices · ∞ users
730 days retention
Deploy in hours: syslog profile, panel login, preset rules included.