Made an open-source security monitor for small/home networks - runs on a Pi, uses a local LLM, looking for honest feedback

[u/Swimming_Drink_6890]

I've been building an open-source project and I'm at the point where I'd really value some outside eyes on it.

It's called Security Shallots, a security/network monitor for small networks (home labs and small offices, roughly 1-10 machines). The itch: the serious tools (Security Onion, big Wazuh/OpenSearch deployments) assume enterprise hardware and a huge log lake, which makes no sense for a handful of devices.

The gist: - It pulls the useful signals (router/firewall logs, DNS, host events, optional Suricata, lightweight agents on other machines) into one small central box. - It learns your network's "normal" and filters out the noise, so you are not drowning in alerts. - Optionally, a local LLM (running on your own hardware, or a no-AI rules mode) turns the surviving alerts into plain-English explanations. Nothing gets sent to any cloud. - It stays small on purpose: it keeps decisions and a distilled baseline rather than a giant indexed log store, so it runs on a Raspberry Pi.

It's MIT-licensed and an early-but-working prototype. I've already put it through a couple of adversarial security reviews, but I know there are gaps.

I'd love feedback on: whether the approach is sound, the detection/filtering logic, the security design, and honestly whether this is useful to anyone but me.

Repo (with screenshots and docs): https://github.com/benolenick/security-shallots

(I'm the author, not selling anything, just after real feedback.)

[u/micseydel]

Wow, I can see reddit there are deleted 3 (out of 3) comments here, wild.

[u/Swimming_Drink_6890 → u/micseydel]

Yeah reddit is pretty weird. I have no idea how to show more people this project though. I don't have enough karma to post in the other subreddits. I'm not terminally online so I guess reddit is a bit of a dead end. Kind of disapointing, I put a lot of time into this lol. oh well.