Why we are building HalimiSOC

Security operations have a tooling problem, but not the one most vendors talk about. The tools are not too weak. They are too heavy.

A typical security operations stack assumes a dedicated team, a data pipeline budget, and weeks of onboarding. That assumption filters out the majority of organizations that actually need monitoring: small engineering teams, research labs, and early-stage companies running real production workloads with two or three people.

What we keep observing

When we talk to small teams about security monitoring, the same pattern appears. They know they should have visibility into their systems. They have tried the open-source options and bounced off the operational cost. They have looked at commercial platforms and bounced off the price.

So they end up with nothing, or with a handful of disconnected alerts that nobody reads.

The research question

HalimiSOC starts from a question rather than a feature list: what is the smallest set of capabilities that gives a small team honest visibility into their infrastructure, without requiring a security specialist to operate it?

Answering that means being deliberate about what to leave out. We are documenting the process, including the dead ends, in the public repository as the work progresses.