{"id":20464497,"url":"https://github.com/bytedance/elkeid-hub","last_synced_at":"2025-04-13T08:37:37.124Z","repository":{"id":41163219,"uuid":"447173426","full_name":"bytedance/Elkeid-HUB","owner":"bytedance","description":"Elkeid HUB is a rule/event processing engine maintained by the Elkeid Team that supports streaming/offline (not yet supported by the community edition) data processing. The original intention is to solve complex data/event processing and external system linkage requirements through standardized rules.","archived":false,"fork":false,"pushed_at":"2023-05-08T02:05:32.000Z","size":154483,"stargazers_count":94,"open_issues_count":5,"forks_count":25,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-03-27T00:13:15.524Z","etag":null,"topics":["event-engine","rule-engine","ruleengine","soar","stream-processing"],"latest_commit_sha":null,"homepage":"https://elkeid.bytedance.com","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bytedance.png","metadata":{"files":{"readme":"README-zh_CN.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-01-12T10:29:09.000Z","updated_at":"2025-02-27T01:25:39.000Z","dependencies_parsed_at":"2024-06-20T05:43:34.476Z","dependency_job_id":"5bf4281b-455f-4e3e-b037-dc6ab13ebf1b","html_url":"https://github.com/bytedance/Elkeid-HUB","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bytedance%2FElkeid-HUB","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bytedance%2FElkeid-HUB/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bytedance%2FElkeid-HUB/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bytedance%2FElkeid-HUB/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bytedance","download_url":"https://codeload.github.com/bytedance/Elkeid-HUB/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248685148,"owners_count":21145215,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["event-engine","rule-engine","ruleengine","soar","stream-processing"],"created_at":"2024-11-15T13:15:23.517Z","updated_at":"2025-04-13T08:37:37.063Z","avatar_url":"https://github.com/bytedance.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"[English](README.md) | 简体中文\n# Elkeid HUB\nElkeid HUB 是一款由 Elkeid Team 维护的规则/事件处理引擎，支持流式/离线(社区版尚未支持)数据处理。 初衷是通过标准化的抽象语法/规则来解决复杂的数据/事件处理与外部系统联动需求。\n\n## Core Components\n* `INPUT` 数据输入层，社区版仅支持Kafka\n* `RULEENGINE/RULESET` 对数据进行检测/外部数据联动/数据处理的核心组件\n* `OUTPUT` 数据输出层，社区版仅支持Kafka/ES\n* `SMITH_DSL` 用来描述数据流转关系\n\n\n## Application Scenarios\n\n* Simple HIDS\n\u003cimg src=\"example_hids.png\"/\u003e\n\n* IDS Like Scenarios\n\u003cimg src=\"example_ids.png\"/\u003e\n\n* Multiple input and output scenarios\n\u003cimg src=\"example_complex.png\"/\u003e\n\n\n## Advantages\n* 高性能\n* 依赖极少\n* 支持复杂数据处理\n* 插件支持\n* 支持有状态逻辑\n* 支持外部系统/数据联动\n\n## Elkeid Internal Best Practices\n* 使用 Elkeid HUB 处理 Elkeid HIDS/RASP/Sandbox/K8s auditing 等原始数据，TPS 1.2亿条+/秒，HUB 调度实例 6000+\n\n## Elkeid-HUB Function List\n\n| Ability List     | Elkeid Community Edition | Elkeid Enterprise Edition |\n| ---------------- | ------------------------ | ------------------------- |\n| 流式数据处理     | :white_check_mark:       | :white_check_mark:        |\n| 数据输入输出能力 | :white_check_mark:       | :white_check_mark:        |\n| 完整前端支持     | :white_check_mark:       | :white_check_mark:        |\n| 监控能力         | :white_check_mark:       | :white_check_mark:        |\n| 插件支持         | :white_check_mark:       | :white_check_mark:        |\n| Debug支持        | :white_check_mark:       | :white_check_mark:        |\n| 离线数据处理     | :ng_man: | :white_check_mark:        |\n| 持久化能力       | :ng_man: | :white_check_mark:        |\n| Workspace        | :ng_man: | :white_check_mark:        |\n| 集群模式         | :ng_man: | :white_check_mark:        |\n| 在线升级策略     | :ng_man: | :white_check_mark:        |\n\n\n\n## Front-end Display (Community Edition)\n\n**Overview**\n\u003cimg src=\"docs/png/1.png\" style=\"float:left;\"/\u003e\n\n\n\n**Edit Rule**\n\u003cimg src=\"docs/png/2.png\" style=\"float:left;\"/\u003e\n\n\n\n**Edit HUB Project**\n\u003cimg src=\"docs/png/3.png\" style=\"float:left;\"/\u003e\n\n\n\n**Edit HUB Python Plugin**\n\u003cimg src=\"docs/png/4.png\" style=\"float:left;\"/\u003e\n\n\n\n**Submission Rules**\n\u003cimg src=\"docs/png/5.png\" style=\"float:left;\"/\u003e\n\n\n## Getting Started\n- [Deploy By Elkeidup](https://github.com/bytedance/Elkeid/blob/main/elkeidup/README-zh_CN.md#elkeid-hub-单独部署)\n- [Elkeid HUB Quick Start](docs/quick_start/quick_start_zh-CN.md)\n\n\n## Elkeid HUB Handbook\n[Handbook](docs/handbook/handbook-zh_CN.md)\n\n## Demo Config\n[Demo](config/demo)\n\n## Elkeid HIDS Rule and Project (Just Example)\n[Elkeid Project](config/elkeid_hids)\n\n(Need to use with [Elkeid](https://github.com/bytedance/Elkeid))\n\n## LICENSE (Not Business Friendly)\n[LICENSE](LICENSE)\n\n## Contact us \u0026\u0026 Cooperation\n\u003cimg src=\"./Lark.png\" width=\"40%\" style=\"float:left;\"/\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbytedance%2Felkeid-hub","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbytedance%2Felkeid-hub","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbytedance%2Felkeid-hub/lists"}