benolenick/security-shallots

Security Shallots is a small, lightweight security monitoring tool built for home labs and small offices with roughly one to ten computers. Its goal is to give a home user or small team the useful, everyday parts of a professional network security setup, the kind normally run by a security team with a large data center, without needing heavy tools like Elasticsearch or a dedicated staff. It is explicitly not trying to replace a full enterprise security stack, and the README is upfront about that. The core approach is to quietly collect signals from your network, router, and computers, learn what normal activity looks like for your specific small setup, and then flag anything that drifts from that baseline: an unusual first-time connection, someone touching a decoy trap, or a cluster of related alerts. It keeps a short buffer of raw network capture as evidence when possible, and packages what it finds into compact summary cards for a person, or a more powerful AI model, to review. Importantly, the tool itself does not make final security decisions, its job is only to raise things that might otherwise slip past unnoticed. It runs comfortably on modest hardware, including a Raspberry Pi, and works best when connected to a place on the network that can actually see meaningful traffic, such as a router's log feed or a switch's mirrored port. It can optionally pull in data from other established open source security tools like Suricata and CrowdSec if they are already installed, and it supports adding lightweight monitoring agents on other machines that report back to a central Shallots server. An optional AI layer, which can run locally or through a cloud service, turns raw technical alerts into plain-English incident explanations with suggested next steps, though the tool works fine with this feature turned off. This is aimed at technically inclined home lab enthusiasts and small office operators who want meaningful security visibility without operating a full security operations center.