SEGARK
SEGARK · Open security platform

Real security, open to everyone.

SEGARK builds the data layer and the endpoint layer of your SOC on open code. Segark Pipeline normalizes and routes telemetry from any source; OpenEDR detects and responds on Linux and Windows servers. You run it where you choose, and you can audit everything it runs.

Explore the platformTalk to us
Engine license
AGPLv3
Schema
OCSF 1.8
Endpoints
Linux · Windows
Runs on
Your infra
Diagram: servers protected by OpenEDR and third-party sources such as a firewall, an identity provider and another EDR send events into Segark Pipeline, which normalizes them to OCSF, enriches, detects, reduces and routes them to a SIEM, a data lake, a case manager and object storage.
One host raises a detection. Its evidence travels with every other source, in one schema, to the tools you already use.
Platform

Two layers of the SOC. One principle: you stay in control.

Each product stands on its own and solves a problem you already pay too much for. Together they give a security team the telemetry, the context and the response it needs, without handing its data to anyone.

Security data pipeline

Segark Pipeline

Collect from any vendor, normalize to OCSF once, cut volume before the SIEM bills you, and route to any destination.

  • Collectors for Wazuh, CrowdStrike, Sophos, Defender, Okta, Entra ID, FortiGate and syslog
  • Declarative mapping to OCSF 1.8 with dry run, versions and rollback
  • Enrichment and in-pipeline detection on the full-fidelity event
  • Routing to SIEMs, lakes and archives, with no lock-in
Explore Segark Pipeline
Endpoint detection & response

OpenEDR

A Rust sensor on every server, a console that shows what happened, and response actions that are signed, approved and recorded.

  • eBPF telemetry on Linux, agent and MSI installer on Windows
  • On-access scanning, static ML model and file reputation
  • Live Discover: SQL across up to 500 hosts at once
  • Isolation and Live Response with four-eyes approval
Explore OpenEDR
Better together

From a process on a server to a case in your SOC.

The two products speak the same schema. A detection on an endpoint arrives in your SIEM with the same structure as every other source, and with the context to act on it.

  1. 01OpenEDR

    The sensor sees it

    OpenEDR records the process, the file and the connection on the host, and raises a detection when behaviour matches a rule.

  2. 02Segark Pipeline

    The pipeline gives it context

    Segark Pipeline maps the event to OCSF, adds geolocation, threat intelligence and your own asset tables, and correlates it with firewall and identity logs.

  3. 03SIEM · SOC

    Your team acts on it

    The event reaches your SIEM or case manager already enriched. The response (isolate, collect, kill) goes back to the host through OpenEDR, signed and audited.

Open core

Open core, with no fine print.

The part that protects you is open. The commercial plans pay for scale, support and the obligations some companies prefer not to take on. That line is written down, and it does not move after you adopt us.

Open, for good

The full engine: collection, normalization, enrichment, reduction and routing

SSO, RBAC and MFA in every edition. Security basics are never an upsell

Self-hosting on your own infrastructure, with no telemetry sent to us

Public documentation, agent contract and data formats

Commercial, when you need it

Multi-tenant hierarchy for MSSPs, with hard isolation between customers

Authoring in-flight detection rules and curated rule packs

Commercial license without copyleft obligations

SLAs, named support and assisted deployment

Free means you can run it in production, not a 14-day trial.

Mission

Democratize security.

Small and mid-sized companies, public bodies and MSSPs face the same attackers as the largest banks, with a fraction of the budget. We build the tools those teams can afford to run, study and trust, and we publish the code so no one has to take our word for it.

Read our mission and values
Who we build for

For the teams that defend, whatever their size.

In-house SOCs

Cut SIEM ingestion cost, keep the full-fidelity event, and get endpoint response without another proprietary agent.

MSSPs and MDR providers

Run every customer from one platform, with tenant isolation enforced in the data lake and not only in the interface.

Small and mid-sized companies

Start with the free edition on your own servers. Grow into support and scale when it makes sense, not before.

Public sector and regulated industries

Self-hosted, auditable, air-gap friendly. Your data stays in your jurisdiction, under your keys.

See it running on your own data.

Start with the open edition, or talk to our team about a guided deployment for your SOC or for your customers.

Talk to us Start free with Segark Pipeline