CNSL

Correlated Network Security Layer

CI PyPI Python 3.10+ MIT License

A self-hosted SIEM for Linux.
Detects attacks that span SSH, web, database, and cloud logs simultaneously -- then blocks them automatically.

What it does

Most tools watch one log and count failures. CNSL watches everything at once.

When an attacker scans your web server, probes your database, then tries SSH with stolen credentials -- CNSL sees all three as one coordinated attack and responds before the breach completes.

Web scan      from 45.33.32.1  --+
SSH brute     from 45.33.32.1  --+--->  HIGH alert + auto-block
DB auth fail  from 45.33.32.1  --+

It also tracks how far each attacker has progressed through the kill chain, learns new attack patterns automatically, and shares threat intelligence across multiple servers in real time.

Quick start

pip install cnsl[full]
sudo python -m cnsl --dashboard --no-tcpdump
# Open http://127.0.0.1:8765
# Default login: admin / cnsl-change-me

Or from source:

git clone https://github.com/rahadbhuiya/cnsl.git
cd cnsl
python3 -m venv venv && source venv/bin/activate
pip install -e ".[full]"
sudo venv/bin/python -m cnsl --dashboard --no-tcpdump

Start in dry-run mode (default) -- no real blocks until you add --execute.

Dashboard

Enable with --dashboard. Runs at http://127.0.0.1:8765.

Tabs: Overview, Incidents, Blocks, Live Feed, Kill Chain, Graph, Cases, UEBA, ML, Honeypot, FIM, Rules, Rate Limit, Settings.

For remote access use an SSH tunnel:

ssh -L 8765:127.0.0.1:8765 user@yourserver

Configuration

Copy and edit the example config:

cp config/config.example.json /etc/cnsl/config.json

All options are documented in docs/configuration.md.
Key sections: thresholds, actions, dashboard, notifications, redis, cloud_identity, zero_trust, siem, federation.

Documentation

Document What it covers
docs/installation.md Full install, systemd, Docker
docs/configuration.md Every config option explained
docs/features.md Complete feature list
docs/architecture.md Module structure and design
docs/kill-chain.md Kill chain tracker
docs/federation.md Multi-node setup
docs/cloud-identity.md AWS + Azure AD integration
docs/zero-trust.md Trust score engine
docs/siem-connectors.md Splunk, Sentinel, Webhook push
docs/pattern-learning.md Automated rule discovery
docs/api.md Full REST API reference
docs/ot-iot.md OT/ICS protocol support (Modbus, DNP3, SCADA)
docs/changelog.md Version history
docs/ All documentation (26 guides)

Requirements

  • Linux (Ubuntu 20.04+ / Debian 11+ / RHEL 8+)
  • Python 3.10+
  • Root or CAP_NET_ADMIN for iptables blocking

Optional: Redis (distributed blocklist + federation), MaxMind GeoIP database.

License

MIT. See LICENSE.

Project links

Data verified by PyPI on Aug 20, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for rahadbhuiya from gravatar.com rahadbhuiya

Credits

Author: Rahad Bhuiya

GitHub Statistics

Data verified by PyPI on Aug 20, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Provides Extra

notify db postgres yaml auth 2fa geoip ml reports redis kafka full dev

Tags

security siem ssh brute-force iptables ipset intrusion-detection threat-detection linux honeypot ml anomaly-detection

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cnsl-3.4.16.tar.gz (323.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

cnsl-3.4.16-py3-none-any.whl (284.8 kB view details)

Uploaded Python 3

File details

Details for the file cnsl-3.4.16.tar.gz.

File metadata

  • Download URL: cnsl-3.4.16.tar.gz
  • Upload date:
  • Size: 323.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cnsl-3.4.16.tar.gz
Algorithm Hash digest
SHA256 3c3b1747699ce5ce19ad9df6c8ae76d01b8db2cbdc155b3831da18de3f07b08a
MD5 e34a64753f2f3c72411362b72674e474
BLAKE2b-256 af7ed204b61e9b1e3b0dcdb0331d5640e39ecabacb09def7d37c80b794363a60

See more details on using hashes here.

Provenance

The following attestation bundles were made for cnsl-3.4.16.tar.gz:

Publisher: ci.yml on rahadbhuiya/cnsl

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file cnsl-3.4.16-py3-none-any.whl.

File metadata

  • Download URL: cnsl-3.4.16-py3-none-any.whl
  • Upload date:
  • Size: 284.8 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cnsl-3.4.16-py3-none-any.whl
Algorithm Hash digest
SHA256 5edf53d464c968e1ffc6af8767b946836d558cce29e0883f712d1172f3213cb6
MD5 530d45cab0da5cbbb2b89e7aeadec2cf
BLAKE2b-256 92b563246f887cbfda92ebb76c69a237add2d2f3991c1ac582071af11def9874

See more details on using hashes here.

Provenance

The following attestation bundles were made for cnsl-3.4.16-py3-none-any.whl:

Publisher: ci.yml on rahadbhuiya/cnsl

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page