Linux-native SIEM · From €20/month

Monitor your network.
Protect your business.

Galanthus SIEM captures, analyzes, and protects all your network traffic in real time. Deploy it on a Linux machine at your access point — every connected device is instantly monitored.

Linux only · €20/month · Deploy at your network access point
40+
Protocols
15+
Threat types
<1s
Detection
€20
Per month
The problem

SMBs are the #1 target of cyberattacks

60% of small businesses that suffer a cyberattack close within 6 months. Traditional SIEMs cost tens of thousands of dollars and require dedicated security teams.

Galanthus SIEM changes the rules: enterprise-grade security at €20/month — less than a team lunch. Deploy it on a Linux machine at your access point and every connected device is protected.

Traditional SIEMs: $15K-$80K/year

Splunk, QRadar, Sentinel — unaffordable for a 10-50 employee company.

Extreme complexity

Months of setup, complex integrations, dedicated SOC team required.

No real alternative

Most SMBs end up with no network monitoring — just antivirus and hope.

Features

Everything you need to secure your network

Complete monitoring, intelligent detection, and automated response in a single product.

Real-Time Monitoring

Captures and analyzes every packet. Interactive network graph showing live connections, protocols, and data flows.

Packet CaptureVisual GraphWebSocket

Smart Firewall

Automatically blocks malicious IPs and domains via real iptables rules. Zero manual intervention required.

iptables/etc/hostsAuto-block

Custom Rules Engine

SQL-like rules with multiple conditions and logical operators. 7 action types: alert, block, allow, and more.

SQL-likeAND / OR7 Actions

Behavior Analysis (UEBA)

Detects anomalies: off-hours activity, DNS tunneling, DGA, port hopping, crypto mining, data exfiltration.

15 DetectionsUEBAReal-time

Geolocation & Threat Intel

Geographic origin of every connection via GeoLite2. Automatic malicious IP detection with threat feeds.

GeoIPASNThreat Intel

Device Inventory

Discovers and classifies all devices: routers, servers, IoT, cameras. Detects unauthorized Shadow IT devices.

MAC VendorAuto-detectShadow IT

Real-Time Threat Map

Live world map showing geographic origin of every connection and attack. Color-coded markers by threat level.

GeoIP MapLive UpdatesCountry View

Deep Packet Inspection

L2-L7 analysis: HTTP headers, TLS SNI, JA3 fingerprints, DNS, SMTP, FTP and 40+ protocols.

DPI L2-L7JA3TLS/SNI

Blocked Traffic Analysis

Attempts per hour, protocols, source countries, ASN, and which rules triggered each block.

ForensicAnalyticsTimeline
Interface

A clean console that shows everything

Real-time dashboard with network graph, alerts, metrics, and full control from your browser.

https://demo.galanthustech.com — Galanthus SIEM
Packets/sec
1,247
Devices
34
Threats
7
Blocked
312
Recent Alerts
DDoS Detected
185.220.101.x — Rate limit exceeded
12s ago · Auto-blocked
DNS Tunneling
Anomalous DNS from 192.168.1.45
3min ago · UEBA
New Device
Raspberry Pi detected on network
8min ago · Shadow IT
Suspicious JA3
Unrecognized TLS fingerprint
15min ago · Investigate
New Country
Connection from Russia (first time)
31min ago · Threat map
Setup

Running in under 5 minutes

No agents, no complex configs. One command on any Linux machine at your network access point.

1

Deploy

Install Galanthus on a Linux machine connected to your AP or network switch.

2

Capture

The C-native interceptor captures every packet in promiscuous mode.

3

Analyze

Rules engine and UEBA process all traffic in real time.

4

Protect

Auto firewall blocks, instant alerts, full dashboard from any browser.

$ sudo ./start.sh # That's it
Detections

15+ threat types detected automatically

Advanced behavior analysis that catches attacks invisible to a conventional firewall.

DDoS / Rate Limit

Denial-of-service and connection floods.

DNS Tunneling

Data exfiltration via DNS queries.

DGA Detection

Algorithmically generated malware domains.

Port Hopping

IPs switching ports to evade detection.

Slow Loris

Slow connections exhausting resources.

Geographic Anomaly

Connections from unusual countries.

Lateral Pivoting

Attackers moving between devices.

Crypto Mining

Unauthorized mining on your network.

Data Exfiltration

Anomalous upload ratios indicating leaks.

Shadow IT

Unauthorized devices on your network.

Off-Hours Activity

Traffic during non-business hours.

TLS Fingerprint (JA3)

Client fingerprints indicating attack tools.

Comparison

Galanthus vs. Traditional SIEMs

Same essential protection at a fraction of the cost and complexity.

FeatureTraditional SIEMGalanthus
Annual cost$15,000-$80,000€20/month (~€240/yr)
Deployment timeWeeks / months< 5 minutes
Staff requiredDedicated SOC teamGeneral IT staff
PlatformCloud / multi-platformLinux (ideal for AP)
Real-time monitoring
Threat detection
Integrated firewallPartial
UEBA (add-on) Included
Network graph
Real-time threat map
Device inventoryAdd-on Included
DPI L2-L7
External dependenciesCloud, agents, licensesZero
Requirements

Lightweight by design

C-native interceptor and Node.js dashboard. Minimal footprint, maximum performance. Linux only.

Minimum Hardware

CPU: 2 cores (x86_64 / ARM)
RAM: 1 GB available
Disk: 2 GB (logs rotate)
Network: Ethernet interface

Software (Linux only)

Ubuntu 20+, Debian 11+, CentOS 8+
libpcap, SQLite3, GCC
Node.js 18+ (dashboard)
Compatible with Raspberry Pi

Architecture

Interceptor: pure C, 16 threads
Database: SQLite3 (WAL mode)
Dashboard: Node.js + WebSocket
Zero cloud dependencies
Live demo

See how it works — live

Explore a real Galanthus SIEM instance monitoring an active network. Log in with password: admin

demo.galanthustech.com
Live instance running

Full dashboard with real network data, active detections, firewall logs, threat map, and interactive network graph. Password: admin

Launch Live Demo
Network graph
Firewall logs
Threat map
Devices

Secure your business today

Start protecting your entire network for just €20/month. Deploy on a single Linux machine at your access point.