Fenrir is a self-hosted MDR/SOC platform, Apache-2.0, deployed via Docker Compose. Logs stay on your own infrastructure. There’s no cloud tier, no vendor SOC pulling your data into a hosted backend.
Every alert carries a non-nullable ATT&CK TTP field. You cannot generate an alert in Fenrir without it mapping to a MITRE technique. Cases get a kill-chain view built from those mappings, so an analyst sees the attack’s progression across an incident, not a flat list of triggers.
Detection logic lives as Sigma rules in Git. Plain YAML, readable without a vendor console, forkable, diffable in a pull request. Rules compile through pySigma into ClickHouse SQL and run against normalized logs stored in a columnar database built for sub-second queries. Analysts aren’t limited to rule hits, either. A built-in ClickHouse SQL console lets them query raw normalized logs directly.
SOAR playbooks ship in the base install, running in a WASM sandbox. Not gated behind a paid tier, not an add-on module.
Fenrir also publishes its own detection performance. MTTD/MTTR benchmarks live in docs/transparency/, version-controlled, computed per detection and reproducible against the OTRF and EVTX-ATTACK-SAMPLES datasets. Run docker compose run --rm fenrir-bench all and the benchmark suite regenerates the same numbers the docs claim, on your own stack.
The network side is fenrir-netflow, an optional Compose profile running ByteFlow: a byte-level model that scores TCP/UDP flows by bits-per-byte. Zeek generates the flow records; ByteFlow scores the payload entropy. High-BPB payloads, the kind produced by C2 tunnels, exfiltration, and encrypted beacons, surface as anomalies. It runs CPU-only with no GPU requirement, scaling worker count via SCORER_WORKERS, or on an NVIDIA GPU with BF16 precision and torch.compile for higher throughput.
Under the hood: Redpanda for the message bus, ClickHouse for log storage, Postgres for metadata, Redis for cache, MinIO for cold storage, core services written in Rust on axum/tokio, frontend in React/TypeScript/Vite, Caddy handling TLS in front of it all.
Setup is a git clone, an .env copy with credentials set, docker compose up -d, and a rule-loading script. Requirements: Docker 24+, Compose v2, 16 GB RAM, 40 GB disk.