CNSL
Correlated Network Security Layer
A self-hosted SIEM for Linux.
Detects attacks that span SSH, web, database, and cloud logs simultaneously -- then blocks them automatically.
What it does
Most tools watch one log and count failures. CNSL watches everything at once.
When an attacker scans your web server, probes your database, then tries SSH with stolen credentials -- CNSL sees all three as one coordinated attack and responds before the breach completes.
Web scan from 45.33.32.1 --+
SSH brute from 45.33.32.1 --+---> HIGH alert + auto-block
DB auth fail from 45.33.32.1 --+
It also tracks how far each attacker has progressed through the kill chain, learns new attack patterns automatically, and shares threat intelligence across multiple servers in real time.
Quick start
pip install cnsl[full]
sudo python -m cnsl --dashboard --no-tcpdump
# Open http://127.0.0.1:8765
# Default login: admin / cnsl-change-me
Or from source:
git clone https://github.com/rahadbhuiya/cnsl.git
cd cnsl
python3 -m venv venv && source venv/bin/activate
pip install -e ".[full]"
sudo venv/bin/python -m cnsl --dashboard --no-tcpdump
Start in dry-run mode (default) -- no real blocks until you add
--execute.
Dashboard
Enable with --dashboard. Runs at http://127.0.0.1:8765.
Tabs: Overview, Incidents, Blocks, Live Feed, Kill Chain, Graph, Cases, UEBA, ML, Honeypot, FIM, Rules, Rate Limit, Settings.
For remote access use an SSH tunnel:
ssh -L 8765:127.0.0.1:8765 user@yourserver
Configuration
Copy and edit the example config:
cp config/config.example.json /etc/cnsl/config.json
All options are documented in docs/configuration.md.
Key sections: thresholds, actions, dashboard, notifications, redis, cloud_identity, zero_trust, siem, federation.
Documentation
| Document | What it covers |
|---|---|
docs/installation.md |
Full install, systemd, Docker |
docs/configuration.md |
Every config option explained |
docs/features.md |
Complete feature list |
docs/architecture.md |
Module structure and design |
docs/kill-chain.md |
Kill chain tracker |
docs/federation.md |
Multi-node setup |
docs/cloud-identity.md |
AWS + Azure AD integration |
docs/zero-trust.md |
Trust score engine |
docs/siem-connectors.md |
Splunk, Sentinel, Webhook push |
docs/pattern-learning.md |
Automated rule discovery |
docs/api.md |
Full REST API reference |
docs/ot-iot.md |
OT/ICS protocol support (Modbus, DNP3, SCADA) |
docs/changelog.md |
Version history |
docs/ |
All documentation (26 guides) |
Requirements
- Linux (Ubuntu 20.04+ / Debian 11+ / RHEL 8+)
- Python 3.10+
- Root or
CAP_NET_ADMINfor iptables blocking
Optional: Redis (distributed blocklist + federation), MaxMind GeoIP database.
License
MIT. See LICENSE.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file cnsl-3.4.14.tar.gz.
File metadata
- Download URL: cnsl-3.4.14.tar.gz
- Upload date:
- Size: 319.0 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
cda5616959ae281dbcbce53443c1e304fc5d917af4d46aeff35b3d323f81fabe
|
|
| MD5 |
67546c7843a87ab50f78ccb1dca7b34b
|
|
| BLAKE2b-256 |
399d1e69d9d6e778b4adb9cfc2c5ece204da3a4166f1d83ea7d87f3758f9b107
|
Provenance
The following attestation bundles were made for cnsl-3.4.14.tar.gz:
Publisher:
ci.yml on rahadbhuiya/cnsl
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
cnsl-3.4.14.tar.gz -
Subject digest:
cda5616959ae281dbcbce53443c1e304fc5d917af4d46aeff35b3d323f81fabe - Sigstore transparency entry: 2389399215
- Sigstore integration time:
-
Permalink:
rahadbhuiya/cnsl@fc2946a99f9e4c63e5495c72a9925b9f58f09105 -
Branch / Tag:
refs/tags/v3.4.14 - Owner: https://github.com/rahadbhuiya
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
ci.yml@fc2946a99f9e4c63e5495c72a9925b9f58f09105 -
Trigger Event:
push
-
Statement type:
File details
Details for the file cnsl-3.4.14-py3-none-any.whl.
File metadata
- Download URL: cnsl-3.4.14-py3-none-any.whl
- Upload date:
- Size: 282.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
7af3df62c71ea4a53c8fdf50994cc870c2ab07e605bf8fe7234f90181a0e5759
|
|
| MD5 |
d9d974f9891dd41b84f06d46839e5a39
|
|
| BLAKE2b-256 |
fe0a51f29777e532e7413b6a5a5e758bd8ece5b0ab21a9c797613eb91da7a96d
|
Provenance
The following attestation bundles were made for cnsl-3.4.14-py3-none-any.whl:
Publisher:
ci.yml on rahadbhuiya/cnsl
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
cnsl-3.4.14-py3-none-any.whl -
Subject digest:
7af3df62c71ea4a53c8fdf50994cc870c2ab07e605bf8fe7234f90181a0e5759 - Sigstore transparency entry: 2389399309
- Sigstore integration time:
-
Permalink:
rahadbhuiya/cnsl@fc2946a99f9e4c63e5495c72a9925b9f58f09105 -
Branch / Tag:
refs/tags/v3.4.14 - Owner: https://github.com/rahadbhuiya
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
ci.yml@fc2946a99f9e4c63e5495c72a9925b9f58f09105 -
Trigger Event:
push
-
Statement type:
