Developer Builds Open-Source SIEM to Fix Security Blind Spots Left by Fail2ban

A developer has created CNSL (Correlated Network Security Layer), a self-hosted, lightweight SIEM tool designed to address a core weakness in conventional Linux server security. Standard tools like Fail2ban, NGINX, and database loggers each monitor only their own logs in isolation, making it easy for attackers to slip through by spreading low-volume probes across multiple services. CNSL counters this by correlating activity from web, SSH, database, and cloud logs simultaneously, assigning a dynamic threat score to each actor based on behavior across all vectors. The system is modeled on the MITRE ATT&CK framework and includes a predictive blocking feature that can sever connections based on attack trajectory before any single threshold is breached. CNSL targets both Linux servers and Kubernetes environments, aiming to stop coordinated, multi-stage intrusions that traditional intrusion prevention systems typically miss.