CNSL

Most tools watch one log and count failures. CNSL watches everything at once.

When an attacker scans your web server, probes your database, then tries SSH with stolen credentials -- CNSL sees all three as one coordinated attack and responds before the breach completes.

Web scan      from 45.33.32.1  --+
SSH brute     from 45.33.32.1  --+--->  HIGH alert + auto-block
DB auth fail  from 45.33.32.1  --+

It also tracks how far each attacker has progressed through the kill chain, learns new attack patterns automatically, and shares threat intelligence across multiple servers in real time.

Beyond core detection: multi-node federation with a unified hub view, STIX 2.1 export and a built-in TAXII 2.1 server for sharing IOCs, Wazuh/OSSEC integration, PostgreSQL support with a migration tool, a Kubernetes Helm chart, attacker fingerprinting (spots the same actor rotating IPs), graph-based campaign correlation, and opt-in predictive blocking that reacts to an attack's trajectory before any single rule's threshold fires.

pip install cnsl[full]
sudo python -m cnsl --dashboard --no-tcpdump
# Open http://127.0.0.1:8765
# Default login: admin / cnsl-change-me

Or from source:

git clone https://github.com/rahadbhuiya/cnsl.git
cd cnsl
python3 -m venv venv && source venv/bin/activate
pip install -e ".[full]"
sudo venv/bin/python -m cnsl --dashboard --no-tcpdump

Start in dry-run mode (default) -- no real blocks until you add --execute.

Or on Kubernetes (one DaemonSet pod per node, protecting every node in the cluster):

helm install cnsl ./helm/cnsl --namespace cnsl --create-namespace

See docs/kubernetes.md and helm/cnsl/README.md for the full walkthrough (federation, the multi-node hub view, enabling real blocking).

Enable with --dashboard. Runs at http://127.0.0.1:8765.

Tabs: Overview, Incidents, Blocks, Live Feed, Kill Chain, Graph, Correlation, Hub, Campaigns, Cases, UEBA, ML, Honeypot, FIM, Rules, Rate Limit, Settings.

For remote access use an SSH tunnel:

ssh -L 8765:127.0.0.1:8765 user@yourserver

Fastest path -- the setup wizard (under 5 minutes):

sudo python -m cnsl --init

Asks a handful of questions (allowlist IP, dashboard on/off, notification channels), auto-detects which log files actually exist on this machine (nginx, apache, mysql, ufw, syslog, auth.log vs secure), and writes a working, validated config.json -- you don't need to read or understand the full reference config to get running.

Full reference, once you want to turn on optional features (Sigma rules, OIDC SSO, cloud identity, ATT&CK mapping, retention, case SLA, ...) -- all ~30 sections are documented individually in docs/configuration.md and default to off/sensible, so nothing there is required reading up front:

cp config/config.example.json /etc/cnsl/config.json

Key sections: thresholds, actions, dashboard, notifications, redis, cloud_identity, zero_trust, siem, federation.

• Linux (Ubuntu 20.04+ / Debian 11+ / RHEL 8+)
• Python 3.10+
• Root or CAP_NET_ADMIN for iptables blocking

Optional: Redis (distributed blocklist + federation), MaxMind GeoIP database.

MIT. See LICENSE.