Sagan

Sagan is a real-time log analysis and correlation engine for security events. Written in C with a multi-threaded architecture, it inspects log data rather than network packets, and mirrors Suricata and Snort so existing rule management and IDS/IPS workflows carry straight over.

It writes alerts in Snort unified2 or Suricata JSON, ships events to databases and SIEMs over syslog, and feeds Elasticsearch consoles such as Kibana and EveBox. Parsing uses liblognorm, with GeoIP detection, on-event script execution, thresholding, xbits correlation, and blacklist and threat-intel lookups.

It can share state between instances through Redis, letting distributed sensors correlate events together. Rules and detection logic stay open under GPLv2, so analysts can tune or author their own signatures for local log sources.