Decentralized SOC · FreeBSD · Linux

Detection at the edge.
Quorum across the mesh.

MarlinOS runs the detection pipeline inside rsyslog, on the host that produced the log. Edges score entities locally and agree by quorum, so the SOC gets a ranked verdict rather than a queue to triage from scratch.

Why decentralize → The pipeline
6
Pipeline stages
16
Behavioral detectors
2
Native arches
0
Central correlator

The hot path

A log line becomes a scored entity before it is written.

raw logverdict + mesh

C immesh Same rsyslog process. Gossip and quorum on the mmwake table.
  1. 01 TurboVM SIMD parse. Same bytecode on amd64 and aarch64.
  2. 02 mmenrich CTI and GeoIP lookup. Emits $!threat. No entity state.
  3. 03 mmwake Per-entity counters, adaptive thresholds, pheromone deposit.
  4. 04 mmsigma Compiled Sigma. Hash-sharded correlation across a peer ring.
  5. 05 waked Sixteen detectors, in Python, after the C path. Not the mesh.

The idea, and the surface

No box has to see everything.

Detection runs where the evidence is. Agreement happens between peers. An operator sees ranked entities and pushes decisions back down.

// concept

The decentralized SOC

Why the decision belongs on the collector, how weak signals from separate hosts become one detection by quorum, and what happens when the uplink dies.

Read the concept → // operator

The console

Triage ranked by agreement rather than arrival, the lineage behind every verdict, and decisions that become edge state instead of a saved filter.

See the loop →

Underneath

What it takes to run detection on hundreds of hosts.

// control plane

Fleet

Enroll, apply, drift, WireGuard. We needed a small headless way to keep a mesh of edges configured and observable, so we built one.

 // os

The OS

FreeBSD pkgbase, MARLINOS kernel, ZFS root, jails, PF. Dual-arch, native builds. No fork.

 // delivery

Platforms

One YAML document per host role: wake-edge, soc-console, hosting, nas, and the rest.

 // hard edge

Offline by design

NMEA 2000 over the native CAN stack, five jails, days without an uplink. The proof that the edge stands alone.