kafSIEM
An entity-graph platform that “turns Kafka-observed operational traffic and selected OSINT context into an auditable entity graph for analyst workflows” — built for air-gapped defense and critical infrastructure. It is this spoke’s first defensive / fusion source: where llm-osint and kallisto-osinter gather OSINT offensively, kafSIEM fuses and analyzes it, with a human analyst in the loop. By Scalytics; Apache-2.0; ~43★, v1.7.0. T3: first-party repo, self-reported.
Three modes
- OSINT — external intelligence analysis (the spoke’s home turf, here as an input to a graph).
- Operations — Kafka-backed flow tracking of internal/operational telemetry.
- Fusion — combining operational data with external OSINT into one entity graph.
So OSINT is one of three lenses; the platform’s subject is the fused entity graph an analyst reasons over, not the gathering itself.
What’s distinctive
- Entity graph + immutable provenance. Entities, edges, and provenance on every edge are stored (SQLite), so every relationship is auditable back to its source — the opposite discipline from a black-box profiler, and a direct answer to the AI-OSINT accountability worry.
- Air-gapped / OT focus. Two operational profiles: unmanned systems (fleet readiness, sortie data, firmware) and critical infrastructure / SCADA (plant operations, device states, vulnerability correlation) — an operational-technology (OT) security angle new to the spoke.
- Stack. Go backend + TypeScript frontend, Kafka for telemetry, SQLite for entity/edge/provenance, Docker-first.
Why it matters here
It balances the spoke. The founding trio leaned offensive (autonomous gathering/profiling) plus a social-engineering resource base; kafSIEM is the defensive, analyst-driven counterpart — OSINT as a feed into an auditable, human-reviewed entity graph. That directly advances two synthesis open questions: “defense against automated OSINT” (provenance + analyst workflows) and “where the human stays in the loop” (the analyst is the consumer, not removed). Its OT/SCADA + critical-infrastructure scope is a facet pointing toward a possible broadening into general threat-intelligence / defensive security.
Cross-spoke note
The entity-graph / provenance machinery echoes the knowledge-graph theme in ../research-wiki
(knowledge-graph) and the formal modeling in ../knowledge-representation-wiki — but here the subject
is security intelligence, so it’s filed by subject and cross-linked by structure. Maker Scalytics
recorded in prose (entity node deferred at this spoke’s founding stage).