Open-source detection stacks in 2026

A landscape review of OSS detection tooling — what teams actually run, what they wish ran better, what to watch.

OSCI Editorial

Collaboratively written by mentors and contributors.

Open-source detection has matured. This piece walks through the OSS detection stack OSCI mentors are recommending today, the gaps that still send teams to commercial tools, and what to watch over the next eighteen months.

We cover ingestion (Vector, Fluent Bit), correlation (Sigma, Falco), data plane (OpenSearch, ClickHouse), and orchestration (n8n, Tines OSS). Recommendations are tagged with team-size guidance — what works for a three-person blue team and what only pays off at 20+.

Methodology

Synthesized from 14 mentor-led conversations and a review of 31 OSS detection projects with >500 GitHub stars and an active release in the past six months.