Substation
A serverless toolkit for routing, normalizing, and enriching security event and audit logs in AWS.
What is Substation?
Substation is an open-source toolkit for building data pipelines that route, normalize, and enrich security event and audit logs. It solves the problem of processing heterogeneous log data at scale by transforming it into standardized schemas, enriching it with external intelligence, and routing it to various destinations, all within a serverless AWS environment.
Security engineers, DevOps teams, and platform engineers who need to process and normalize security logs from multiple sources, especially those operating in AWS environments and seeking to reduce costs compared to commercial log management solutions.
Developers choose Substation for its high performance, low cost, and extensibility. It offers a serverless, maintainable alternative to tools like Logstash and Fluentd, with native AWS integration, over 100 transformation functions, and the ability to run anywhere Go is supported.
Overview
Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
Use Cases
Best For
- Transforming Zeek or Suricata logs into Elastic Common Schema (ECS) format
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
