HalimiSOC

The problem

Security operations tooling is built for organizations with dedicated security teams, data pipeline budgets, and weeks of onboarding time. That assumption excludes most of the organizations that actually need monitoring: small engineering teams, research labs, and early-stage companies running real production workloads with a handful of people.

These teams face the same threats as large enterprises. They just cannot afford the same tooling, in price or in operational overhead. The result is usually no visibility at all, or a pile of disconnected alerts that nobody reads.

The approach

HalimiSOC starts from a research question, not a feature list: what is the smallest set of capabilities that gives a small team honest visibility into their infrastructure, without requiring a security specialist to operate it?

Answering that means being deliberate about what to leave out. Every capability is evaluated against two criteria: does it reduce time-to-awareness for a small team, and can it be operated without specialized training?

Where we are

The project is in active development. We are documenting the process, including the dead ends, in the public repository as the work progresses. Technical decisions, architecture notes, and evaluation results are published there rather than kept internal.