Ogum Security

Open-Source Cloud-Native Application Protection Platform

Built for Everyone.

What is Ogum? • Features • Architecture • Getting Started • Roadmap • Contributing • Community

The Problem

Enterprise cloud security platforms — Wiz, Orca Security, Prisma Cloud — cost hundreds of thousands of dollars per year, lock your data into third-party infrastructure, and remain out of reach for most engineering teams.

Open-source alternatives (Prowler, Trivy, Falco) are excellent sensors. But they produce thousands of isolated alerts without the cross-context that turns raw findings into business decisions.

Security teams are drowning in noise. Ogum Security changes that.

What is Ogum Security?

Ogum Security is an open-source CNAPP (Cloud-Native Application Protection Platform) that combines the best open-source security engines under a unified contextual risk graph — delivering the disruptive value of Wiz and Orca Security, self-hosted, with no licensing cost.

It is built on top of Prowler v5 and extends it with:

Graph-based risk correlation — connects isolated findings into visual Attack Paths
Side-Scanning (No Production Impact) — reads VM disk snapshots, Lambda artifacts, and container filesystems without touching production workloads or installing agents
Near Real-Time detection — from cloud event to alert in under 2 seconds
AI-powered remediation — context-aware RAG generates corrective IaC code and opens Pull Requests automatically

The philosophy: Prowler, Trivy, Checkov, and Falco are the sensors. Ogum Security is the brain that connects them.

Features

Unified Asset Inventory

Before scanning for anything, Ogum Security discovers and maps every resource across your cloud environments into a unified, searchable inventory — persisted as a graph in ArangoDB. This is the foundation everything else is built on.

Every EC2 instance, IAM Role, S3 bucket, Lambda function, Kubernetes pod, and network endpoint is catalogued with its relationships to other resources. The graph is structurally complete before a single security check runs.

Multi-Cloud Coverage

Scan across AWS, Azure, GCP, Kubernetes, OCI, Alibaba Cloud, GitHub, Microsoft 365, Cloudflare, and MongoDB Atlas — all from a single platform.

1,700+ Ready-to-Use Security Checks

Inherited from Prowler v5 and extended, with native mapping to:

Framework	Coverage
CIS Benchmarks	AWS, Azure, GCP, Kubernetes, GitHub
NIST 800-53	Full control mapping
PCI DSS v4.0	Requirements 1–12
SOC 2 Type II	CC series
HIPAA	Technical safeguards
ISO/IEC 27001	Annex A controls
GDPR / LGPD	Article-level mapping
DORA	ICT risk requirements

Attack Path Visualization

The core differentiator. Ogum Security crosses findings from multiple layers (network, compute, identity, data) and builds a graph of real exploitable paths.

Instead of listing 500 alerts, it shows:

Internet Gateway → EC2 (CVE-Critical) → IAM Admin Role → S3 Bucket [PII]

That's a Toxic Combination — an actual attack chain. Everything else is noise.

Side-Scanning (No Production Impact)

Inspired by Orca Security's approach. Scans production workloads without installing agents or touching running processes:

Virtual Machines (AWS EC2, Azure VM): creates an ephemeral disk snapshot, mounts it read-only in an isolated analyzer container, scans with Trivy + YARA + secret detectors, then destroys the snapshot immediately — zero CPU impact on production, zero agent installation
AWS Lambda: extracts the deployment artifact via API, scans dependencies and source code in an isolated RAM disk — the function is never invoked
Kubernetes containers (runtime): an ephemeral privileged DaemonSet reads /proc/<PID>/root from the host node — the target container never knows it was scanned. Note: this requires a DaemonSet with elevated permissions, not a fully agentless approach

Near Real-Time Detection

CloudTrail / K8s Audit Logs → Vector.dev → Redpanda → Apache Flink CEP → Alert (< 2s)

Complex event correlation in memory. Detects multi-step attack patterns that individual log entries would miss.

High-confidence events require both a deviation from the per-principal behavioral baseline (typical actions, IPs, regions, user-agent) and a match against a known TTP — reducing noise instead of alerting on either condition alone.

AI-Powered Remediation (Ogum.AI)

A RAG engine that:

Retrieves the relevant remediation guide and your infrastructure style from a vector database
Injects the actual attack path context from the graph
Generates corrective IaC code (Terraform, CloudFormation) tailored to your codebase
Opens a Pull Request on your GitHub/GitLab — never touching production directly

Compliance Drift Monitoring

Continuous posture tracking per framework. If a developer opens a port at 3am, Ogum detects the compliance drift within seconds — before the next scheduled audit.

CIEM — Identity Risk Analysis

Privilege gap scoring: what a role can do vs. what it actually does (last 90 days)
AssumeRole chaining detection: maps hidden privilege escalation paths across roles
Least-privilege policy generation: Ogum.AI rewrites overpermissive IAM policies from scratch based on actual usage

Cloud Detection and Response (Ogum.CDR)

When a threat is detected, Ogum doesn't just alert — it acts:

Tier 1 — Automatic containment (< 10 seconds, no human needed):

Disable compromised IAM access key
Block attacker IP in Security Group
Apply Kubernetes NetworkPolicy deny-all on compromised pod
Suspend Azure Entra ID user

Tier 2 — Guided containment (human approval via Slack/Teams): High-impact actions — isolate EC2, terminate deployment, revoke org access — sent as interactive approval requests before executing.

Forensics first: before any destructive action, CloudTrail (last 90 min), EBS snapshots, and K8s container logs are captured to an immutable S3 WORM bucket.

CDR is the only module that modifies cloud resources directly — and only when an active threat demands it. Misconfigurations go through GitOps. Active attackers don't wait for PRs.

Hybrid Coverage with eBPF Agent

For on-premise servers, edge environments, or unsupported clouds — a lightweight Go + C agent using eBPF provides:

Passive network lineage (no intrusive port scanning)
Runtime command audit (sys_enter_execve)
Host IAM equivalent (SSH key and sudoer monitoring)

Architecture

┌──────────────────────────────────────────────────────────────────┐
│                 Cloud APIs / K8s / On-Premise                    │
└───────────────────────────────┬──────────────────────────────────┘
                                │
                ┌───────────────▼───────────────┐
                │        Ogum.Inventory          │  ← built first
                │   Asset Discovery & Graph      │
                │   Population (all providers)   │
                └───────────────┬───────────────┘
                                │ populates vertices + edges
┌───────────────────────────────▼──────────────────────────────────┐
│                     Ogum.Graph (ArangoDB)                        │
│              Resources · Identities · NetworkEndpoints           │
│              DataAssets · Vulnerabilities · Attack Paths         │
└──────┬──────────────────────────────────────────────────┬────────┘
       ↑                    ↑                             ↑
┌──────┴──────┐  ┌──────────┴───────┐  ┌────────────────┴────────┐
│Ogum.Static  │  │  Ogum.Dynamic    │  │      Ogum.Pulse         │
│Prowler v5   │  │  Side-Scanning   │  │  Redpanda + Flink CEP   │
│+ Checkov    │  │  VM/Lambda/K8s   │  │  NRT < 2s latency       │
└─────────────┘  └──────────────────┘  └─────────────────────────┘
       │ (misconfiguration)                         │ (active threat)
┌──────▼──────────────┐               ┌─────────────▼──────────────┐
│      Ogum.AI        │               │        Ogum.CDR            │
│  RAG + GitOps PRs   │               │  Tier 1: auto < 10s        │
│  never direct cloud │               │  Tier 2: Slack approval     │
└──────┬──────────────┘               └─────────────┬──────────────┘
       └────────────────────┬────────────────────────┘
                            │
┌───────────────────────────▼──────────────────────────────────────┐
│               Ogum Security UI  ←  FastAPI Gateway               │
│         React 19 · Next.js 15 · React Flow Attack Path Canvas    │
└──────────────────────────────────────────────────────────────────┘

Core stack: Python 3.12+ · FastAPI · Prowler v5 (prowler-core) · ArangoDB · Redpanda · Apache Flink · React 19 · Next.js 15 · Go · eBPF · LangChain · Ollama

Getting Started

Early Development Notice: Ogum Security is actively being built. The stack below starts the infrastructure services. Application code is being developed incrementally — star and watch the repo to follow along.

Prerequisites

Docker & Docker Compose
8GB RAM minimum (16GB recommended for local Ollama)

Start the Infrastructure

git clone https://github.com/ogum-security/ogum-security.git
cd ogum-security

cp .env.example .env
# Edit .env with your cloud credentials and configuration

docker compose up -d

This starts:

ArangoDB — graph database (:8529)
Redis — task queue and cache (:6379)
Redpanda — Kafka-compatible message broker (:9092)
Qdrant — vector database for RAG (:6333)
Ollama — local LLM runtime (:11434)
Backend API — FastAPI (:8000, /docs for Swagger)
Frontend — Next.js console (:3000)

Connect Your First Cloud Account

# 1. Register an AWS account and start discovery
curl -X POST http://localhost:8000/api/v1/providers \
  -H "Content-Type: application/json" \
  -H "X-Tenant-ID: dev-tenant" \
  -d '{
    "provider": "aws",
    "display_name": "My AWS Account",
    "account_id": "123456789012",
    "regions": ["us-east-1", "us-west-2"],
    "validate_connection": false
  }'

# 2. View your inventory
open http://localhost:3000/inventory

# 3. Run a CSPM scan (Prowler v5 — 1,700+ checks)
curl -X POST http://localhost:8000/api/v1/scans \
  -H "Content-Type: application/json" \
  -H "X-Tenant-ID: dev-tenant" \
  -d '{"provider_id": "<provider_id>", "frameworks": ["CIS-AWS-2.0"]}'

# 4. Export findings as CSV
curl "http://localhost:8000/api/v1/findings/export?format=csv" \
  -H "X-Tenant-ID: dev-tenant" \
  -o findings.csv

Roadmap

We are building this in public. Here is where we are and where we are going:

Phase 1 — MVP ✅ Complete

Full asset inventory + CSPM with 1,700+ checks + compliance dashboard + IaC scanning

Phase 2 — Alpha (In Progress 🔨)

Attack paths, contextual risk, side-scanning, and CIEM. AI remediation next.

Phase 3 — Beta (Planned 📋)

Real-time detection, enterprise auth, SIEM connectors, and hybrid coverage

Contributing

Ogum Security is being built in the open and we want your help.

Whether you are a security engineer, cloud architect, backend developer, frontend developer, or technical writer — there is a place for you here.

Ways to Contribute

Star this repository — it helps others discover the project
Watch — stay updated as we push new code and milestones
Open an Issue — report bugs, request features, or ask questions
Submit a Pull Request — check open issues tagged good first issue
Share — tell your team, your network, your security community

Development Setup

# Backend (Python)
cd backend
pip install poetry
poetry install
poetry run uvicorn app.main:app --reload --port 8000

# Frontend (Node.js)
cd frontend
npm install
npm run dev

# Agent (Go)
cd agent
go build ./cmd/...

See docs/getting-started.md for the full development guide.

Security Checks and Compliance Rules

One of the fastest ways to contribute is adding new security checks or improving compliance mappings. Ogum Security leverages Prowler v5's check system — new checks are YAML + Python and do not require deep platform knowledge.

Community

This project is in early development. We are building in public and would love for you to follow along.

GitHub Issues — questions, bugs, feature requests: open an issue
GitHub Discussions — architecture ideas, use case sharing: start a discussion
Watch the repo — get notified on every release and milestone

If you are building cloud security tooling, doing pentests, running a SecOps team, or just passionate about open-source security — this is being built for you.

Why "Ogum"?

Ogum is the Yoruba deity of iron, technology, and the opening of paths — the one who clears the way forward. In the Afro-Brazilian tradition, Ogum is the warrior who protects and enables progress.

We chose the name because that is exactly what we want this tool to do: clear the path through the complexity of cloud security so every team — not just those who can afford enterprise licenses — can protect what they build.

License

Ogum Security is released under the MIT License.

You are free to use, modify, distribute, and build on top of it — commercially or otherwise — with no restrictions beyond attribution.

Built for Everyone. By the community. In the open.

⭐ Star this repository if you believe cloud security should be accessible to all teams.

Name		Name	Last commit message	Last commit date
Latest commit History 112 Commits
.github		.github
agent		agent
backend		backend
docker		docker
docs		docs
frontend		frontend
infra		infra
.env.example		.env.example
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
docker-compose.yml		docker-compose.yml

Folders and files

Latest commit

History

Repository files navigation

Ogum Security

Open-Source Cloud-Native Application Protection Platform

The Problem

What is Ogum Security?

Features

Unified Asset Inventory

Multi-Cloud Coverage

1,700+ Ready-to-Use Security Checks

Attack Path Visualization

Side-Scanning (No Production Impact)

Near Real-Time Detection

AI-Powered Remediation (Ogum.AI)

Compliance Drift Monitoring

CIEM — Identity Risk Analysis

Cloud Detection and Response (Ogum.CDR)

Hybrid Coverage with eBPF Agent

Architecture

Getting Started

Prerequisites

Start the Infrastructure

Connect Your First Cloud Account

Roadmap

Phase 1 — MVP ✅ Complete

Phase 2 — Alpha (In Progress 🔨)

Phase 3 — Beta (Planned 📋)

Contributing

Ways to Contribute

Development Setup

Security Checks and Compliance Rules

Community

Why "Ogum"?

License

About

Resources

License

Contributing

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Packages