SIEM-Plus: Next-Generation Security Information & Event Management Platform

Enterprise SIEMs frequently suffer from high ingestion licensing costs, sluggish batch queries, resource-intensive agents, and proprietary rule languages.

Distributed Component Topology & Event Pipeline

Architectural Comparison Matrix

| Capability | Legacy Enterprise SIEM | SIEM-Plus Architecture | Performance Gain | | :--- | :--- | :--- | :--- | | Agent Technology | Java / Python Daemon (250MB+ RAM) | Compiled Rust Binary (< 14MB RAM) | 18x lighter footprint | | Detection Mode | Scheduled Batch Cron (5-15 min lag) | Real-time In-Memory Stream Evaluation | Sub-15ms alert generation | | Rule Standard | Proprietary Search Syntax (SPL/KQL) | Native Open-Source Sigma Rules | Universal vendor portability | | Response Model | Manual SOC Analyst Triage | Built-in Event-Driven SOAR Playbooks | Instant automated containment |

Sigma Detection Rule Example

title: Suspicious PowerShell LSASS Memory Dumping Attempt
id: a812f14c-83b5-4b09-b789-2917e72b7a90
status: production
description: Detects PowerShell executing comsvcs.dll MiniDump or native memory scraping targeting LSASS
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - 'comsvcs.dll'
            - 'MiniDump'
            - 'lsass'
    condition: selection
falsepositives:
    - Highly anomalous. Legitimate admin dump procedures require signed crash utilities.
level: critical
tags:
    - attack.credential_access
    - attack.t1003.001

High-Performance Rust Telemetry Agent Snippet

use std::sync::Arc;
use tokio::sync::mpsc;
use serde::{Serialize, Deserialize};

#[derive(Serialize, Deserialize, Debug, Clone)]
pub struct ProcessTelemetryEvent {
    pub pid: u32,
    pub ppid: u32,
    pub image_path: String,
    pub command_line: String,
    pub user_sid: String,
    pub integrity_level: String,
    pub timestamp: u64,
}

pub struct EDRTelemetryCollector {
    stream_tx: mpsc::Sender<ProcessTelemetryEvent>,
}

impl EDRTelemetryCollector {
    pub fn new(stream_tx: mpsc::Sender<ProcessTelemetryEvent>) -> Self {
        Self { stream_tx }
    }

    pub async fn on_process_create(&self, pid: u32, ppid: u32, image: &str, cmd: &str) {
        let event = ProcessTelemetryEvent {
            pid,
            ppid,
            image_path: image.to_string(),
            command_line: cmd.to_string(),
            user_sid: "S-1-5-18".to_string(),
            integrity_level: "High".to_string(),
            timestamp: std::time::SystemTime::now()
                .duration_since(std::time::UNIX_EPOCH)
                .unwrap()
                .as_secs(),
        };

        // Non-blocking zero-allocation dispatch to gRPC pipeline buffer
        if let Err(e) = self.stream_tx.try_send(event) {
            eprintln!("[EDR] Telemetry buffer full, dropping low-priority metric: {:?}", e);
        }
    }
}

Summary & Open Source Ecosystem

• Repository: https://github.com/rdxkeerthi/SIEM-Plus
• Author: Keerthivasan M
• License: MIT