mozilla/MozDef

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

2161 stars · 323 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

MozDef is Mozilla's Enterprise Defense Platform, an open-source SIEM-style application for automating security incident handling and enabling real-time collaboration among incident handlers. It is built on Python and the ELK stack (Elasticsearch, Logstash, Kibana) and was designed to process hundreds of millions of events per day.

Use cases

• set up a self-hosted SIEM for security event monitoring
• automate security incident handling and response workflows
• aggregate and search security logs in Elasticsearch
• get real-time alerts and metrics on security events
• coordinate incident handler collaboration and information sharing
• deploy a security monitoring platform in AWS via CloudFormation

When to choose

• you want to study or fork an open-source SIEM architecture
• you need a reference design for ELK-based security event processing
• you are willing to maintain a fork yourself

When to avoid

• you need a maintained, supported SIEM - the project is officially deprecated
• you want production security tooling without forking and maintaining it
• you need current Elasticsearch version compatibility or security patches

Facets

application · maturity abandoned

security monitoring alerting logging search-engine analytics security monitoring big-data python cloud self-hosted siem elk-stack elasticsearch incident-response security-operations deprecated unmaintained devops docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mozilla/MozDef")