Falak is a SOAR/SIEM platform for multi-tenant environments. Endpoint agents, relay nodes, and a control plane that detect, correlate, and respond — without the black box.
Falak runs across three runtime layers, each with its own trust boundary. What leaves one layer is signed before it enters the next.
Rust agents for Linux, Windows, and macOS. Deterministic enrollment, signed policy bundles, a disk-backed spool that survives reboots, and hardened collectors that never trust what they cannot verify.
Go services that aggregate telemetry from fleets and forward upstream. Relays hold the trust boundary between customer networks and the control plane — every signed action is verified before it reaches an endpoint.
Twelve purpose-built Go services, a Python AI reasoning service, and a Next.js analyst console. Ingest, normalize, detect, correlate, orchestrate response, and present incidents — each boundary observable, each hop auditable.
One pipeline, four stages, every hop observable. No magic, no hidden state.
Agent telemetry lands at the ingest service through gRPC, is validated, and is published to JetStream. Backpressure and duplicate windows are enforced per stream, not per caller.
Raw events are normalized to a common schema and indexed into OpenSearch with tenant qualification at the index-write boundary.
Rule packs evaluate the normalized stream. Correlation joins detections into incident-shaped groups and opens cases in the incident service.
Playbooks run as Temporal workflows. Signed actions flow from the dispatcher through relays to endpoints. Nothing runs without a signature.
A SIEM that hides its weaknesses is useless. Here is what holds today, and what we are hardening next. No asterisks.
Every layer is a technology an on-call engineer already knows how to debug at 3am.
Docker Compose for local integration. Kustomize overlays for staging and prod. Secrets come from your platform’s secret manager. No vendored control plane.
$ make bootstrap
$ make dev-up
# infra: postgres · redis · nats · opensearch · temporal · otel
$ docker compose --profile apps up -d
# 15 apps built from the monorepo. one command.
# open http://localhost:3000 → analyst console