CNSL: Self-Hosted SIEM to Fix Fail2ban Blind Spots
Rahad Bhuiya introduces CNSL, a lightweight self-hosted SIEM for Linux and Kubernetes that correlates cross-port threats to stop multi-stage breaches.
Stock photo for illustration only, not from the actual event
- Traditional tools like Fail2ban operate in isolation, missing multi-stage attacks.
- CNSL is a self-hosted SIEM correlating web, SSH, and database logs simultaneously.
- Runs lightweight on a $5/month VPS or via Kubernetes Helm chart.
- Powered by Cyber Kill-Chain tracking and predictive threat scoring.
For most Linux server administrators, the security stack typically relies on standalone tools that monitor individual log files independently. While this sounds like a layered defense on paper, it suffers from a glaring and dangerous architectural flaw: these tools operate in complete isolation.
Modern attackers no longer hammer SSH ports with 100 rapid-fire passwords, which would trigger Fail2ban within seconds. Instead, they scan web endpoints for exposed .env files, probe database ports for default passwords, and attempt just two SSH logins using leaked administrator credentials.
Stock photo for illustration only, not from the actual event
To the web server, it registers as a minor 404 error. To the database, it appears as a routine connection failure. To Fail2ban, two failed SSH logins fall well below the threshold of five. Every tool sees a harmless blip while your server undergoes a coordinated, multi-stage breach.
From a cybersecurity perspective, multi-vector attacks exploit the inherent blind spots of non-communicating defensive tools. Building a lightweight SIEM that aggregates telemetry across disparate services to compute a dynamic threat score embodies the zero-trust principle, providing enterprise-grade visibility without massive infrastructure overhead.
To eliminate this architectural blind spot, developer Rahad Bhuiya built CNSL (Correlated Network Security Layer)—a self-hosted, lightweight SIEM for Linux and Kubernetes that correlates attacks spanning web, SSH, database, and cloud logs simultaneously to stop breaches before completion.
The foundational principle behind CNSL is that no security event should ever be evaluated in a vacuum. When an IP address interacts with your infrastructure, CNSL tracks its activity across every listening service simultaneously, computing a dynamic threat score across all vectors instead of waiting for a single service threshold.
"When CNSL observes an actor combining reconnaissance with authentication probing across disparate services, the threat trajectory escalates immediately."
Rahad Bhuiya
Traditional intrusion prevention systems are purely reactive, waiting until a threshold is crossed. CNSL integrates Cyber Kill-Chain tracking modeled after the MITRE ATT&CK framework along with opt-in Predictive Blocking, analyzing attack velocity and breadth to proactively sever connections before exploitation finishes.
Stock photo for illustration only, not from the actual event
CNSL can be installed directly via Python using pip install cnsl[full], booting into a safe dry-run mode to populate live dashboards and log campaigns without modifying firewall rules until --execute is passed. For Kubernetes environments, an official Helm chart runs as a DaemonSet to monitor container socket events and host telemetry.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment