CNSL

Correlated Network Security Layer

CI PyPI Python 3.10+ MIT License

A self-hosted SIEM for Linux.
Detects attacks that span SSH, web, database, and cloud logs simultaneously -- then blocks them automatically.

What it does

Most tools watch one log and count failures. CNSL watches everything at once.

When an attacker scans your web server, probes your database, then tries SSH with stolen credentials -- CNSL sees all three as one coordinated attack and responds before the breach completes.

Web scan      from 45.33.32.1  --+
SSH brute     from 45.33.32.1  --+--->  HIGH alert + auto-block
DB auth fail  from 45.33.32.1  --+

It also tracks how far each attacker has progressed through the kill chain, learns new attack patterns automatically, and shares threat intelligence across multiple servers in real time.

Beyond core detection: multi-node federation with a unified hub view, STIX 2.1 export and a built-in TAXII 2.1 server for sharing IOCs, Wazuh/OSSEC integration, PostgreSQL support with a migration tool, a Kubernetes Helm chart, attacker fingerprinting (spots the same actor rotating IPs), graph-based campaign correlation, and opt-in predictive blocking that reacts to an attack's trajectory before any single rule's threshold fires.

Quick start

pip install cnsl[full]
sudo python -m cnsl --dashboard --no-tcpdump
# Open http://127.0.0.1:8765
# Default login: admin / cnsl-change-me

Or from source:

git clone https://github.com/rahadbhuiya/cnsl.git
cd cnsl
python3 -m venv venv && source venv/bin/activate
pip install -e ".[full]"
sudo venv/bin/python -m cnsl --dashboard --no-tcpdump

Start in dry-run mode (default) -- no real blocks until you add --execute.

Or on Kubernetes (one DaemonSet pod per node, protecting every node in the cluster):

helm install cnsl ./helm/cnsl --namespace cnsl --create-namespace

See docs/kubernetes.md and helm/cnsl/README.md for the full walkthrough (federation, the multi-node hub view, enabling real blocking).

Dashboard

Enable with --dashboard. Runs at http://127.0.0.1:8765.

Tabs: Overview, Incidents, Blocks, Live Feed, Kill Chain, Graph, Correlation, Hub, Campaigns, Cases, UEBA, ML, Honeypot, FIM, Rules, Rate Limit, Settings.

For remote access use an SSH tunnel:

ssh -L 8765:127.0.0.1:8765 user@yourserver

Configuration

Copy and edit the example config:

cp config/config.example.json /etc/cnsl/config.json

All options are documented in docs/configuration.md.
Key sections: thresholds, actions, dashboard, notifications, redis, cloud_identity, zero_trust, siem, federation.

Documentation

Document What it covers
docs/installation.md Full install, systemd, Docker
docs/configuration.md Every config option explained
docs/features.md Complete feature list
docs/architecture.md Module structure and design
docs/api.md Full REST API reference
docs/kubernetes.md Helm chart deployment (DaemonSet, hub view, federation)
docs/kill-chain.md Kill chain tracker (predictive blocking: see docs/api.md)
docs/federation.md Multi-node setup and the hub view
docs/cloud-identity.md AWS + Azure AD integration
docs/zero-trust.md Trust score engine
docs/siem-connectors.md Splunk, Sentinel, Webhook push
docs/pattern-learning.md Automated rule discovery
docs/rules.md Detection rule tuning (correlation-rule tuning: see docs/api.md)
docs/ueba.md User/entity behavior analytics
docs/cases.md Case management
docs/threat-feed.md External threat feed ingestion
docs/2fa.md Two-factor auth for the dashboard
docs/agent.md Remote log-shipping agent
docs/kafka.md Kafka log ingestion
docs/zeek.md Zeek log integration
docs/ot-iot.md OT/ICS protocol support (Modbus, DNP3, SCADA)
docs/country-blocking.md Geo-based blocking
docs/rate-limiting.md API rate limiting
docs/tenants.md Multi-tenant setup
docs/huddle.md Incident huddle/collaboration
docs/notifications.md Email/Slack/Telegram alerts
docs/changelog.md Version history
docs/ Browse all 27 guides

Requirements

  • Linux (Ubuntu 20.04+ / Debian 11+ / RHEL 8+)
  • Python 3.10+
  • Root or CAP_NET_ADMIN for iptables blocking

Optional: Redis (distributed blocklist + federation), MaxMind GeoIP database.

License

MIT. See LICENSE.

Project links

Data verified by PyPI on Aug 25, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (3.4.18)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for rahadbhuiya from gravatar.com rahadbhuiya

Credits

Author: Rahad Bhuiya

GitHub Statistics

Data verified by PyPI on Aug 25, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Provides Extra

notify db postgres yaml auth 2fa geoip ml reports redis kafka full dev

Tags

security siem ssh brute-force iptables ipset intrusion-detection threat-detection linux honeypot ml anomaly-detection

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cnsl-3.4.17.tar.gz (326.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

cnsl-3.4.17-py3-none-any.whl (285.5 kB view details)

Uploaded Python 3

File details

Details for the file cnsl-3.4.17.tar.gz.

File metadata

  • Download URL: cnsl-3.4.17.tar.gz
  • Upload date:
  • Size: 326.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cnsl-3.4.17.tar.gz
Algorithm Hash digest
SHA256 bf7f60c7f4eb55af0a4c6d773c2544f0527bea4c2ee30726d86e6fe3c926bda0
MD5 ab98c196ce7e6944de1416a931026b9b
BLAKE2b-256 d82c5aebcd3d4b28515b4320bba3f08ffd80c9b94da81f228d0194b45a2e6e90

See more details on using hashes here.

Provenance

The following attestation bundles were made for cnsl-3.4.17.tar.gz:

Publisher: ci.yml on rahadbhuiya/cnsl

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file cnsl-3.4.17-py3-none-any.whl.

File metadata

  • Download URL: cnsl-3.4.17-py3-none-any.whl
  • Upload date:
  • Size: 285.5 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cnsl-3.4.17-py3-none-any.whl
Algorithm Hash digest
SHA256 887bd6e4ae09c02825ce38ff6435eb8f9c8958f95dc64fbafb035a254343f1fb
MD5 55ff1e796aa45daa53575d5558622473
BLAKE2b-256 02d4415a135e15646d3ce1b91b9d63605fd59d908a45c8f404acfa89cef79b5a

See more details on using hashes here.

Provenance

The following attestation bundles were made for cnsl-3.4.17-py3-none-any.whl:

Publisher: ci.yml on rahadbhuiya/cnsl

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

3.4.18

2 files

This release

3.4.17 This release

2 files

3.4.16

2 files

3.4.15

2 files

3.4.14

2 files

3.4.13

2 files

3.4.11

2 files

3.4.10

2 files

3.4.9

2 files

3.4.8

2 files

3.4.7

2 files

3.4.5

2 files

3.4.4

2 files

3.4.3

2 files

3.4.2

2 files

3.4.1

2 files

3.4.0

2 files

3.3.0

2 files

3.2.0

2 files

3.1.0

2 files

3.0.0

2 files

2.9.0

2 files

2.7.0

2 files

2.6.0

2 files

2.5.0

2 files

2.4.0

2 files

2.2.0

2 files

2.1.1

2 files

2.1.0

2 files

2.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page