Projects sharing features with Nightingale

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

SigNoz is a full-stack observability platform designed to collect, store, and visualize metrics, logs, and distributed traces in a unified environment. It leverages OpenTelemetry-based data collection to ingest telemetry from diverse sources using vendor-neutral protocols, ensuring interoperability across complex microservices architectures. The platform utilizes a high-performance columnar storage engine to enable rapid aggregation and filtering, providing a centralized backend for monitoring application health and performance. What distinguishes the platform is its focus on automated instru

This project is a curated collection of deployment files and configurations for hosting a wide variety of open-source services on a home server. It primarily utilizes Docker and Docker Compose to automate the orchestration, lifecycle management, and deployment of containerized applications. The repository provides a comprehensive suite for self-hosted infrastructure, covering network management tools, media streaming, and home automation. It includes specialized configurations for securing internal services via reverse proxies, WireGuard VPN tunnels, and automated SSL/TLS certificate manageme

Alertmanager is a monitoring notification gateway and routing service that deduplicates, groups, and directs alerts to the correct receivers. It functions as a central manager for Prometheus alerts, using a hierarchical routing tree and label-based matchers to dispatch notifications to external services. The system employs a peer-to-peer mesh network to coordinate multiple instances in a high availability cluster, ensuring continuous alert processing. It features a dedicated inhibition engine and grouping mechanisms to reduce notification noise by suppressing redundant alerts when related iss

Keep is an open-source AIOps alert management platform that aggregates, deduplicates, and orchestrates the lifecycle of alerts from multiple monitoring tools. It functions as a multi-provider integration hub to centralize the flow of data between observability, ticketing, and communication tools. The platform distinguishes itself through incident workflow automation and AI-powered enrichment. It uses a declarative workflow engine to execute multi-step operational sequences and integrates large language models to summarize event data and correlate technical logs for faster incident resolution.

Netdata is a real-time infrastructure monitoring tool and multi-node observability platform. It functions as a high-resolution monitoring agent, log and metric aggregator, and time-series database designed to provide full-stack visibility into server health. The system is distinguished by its per-second metric sampling and zero-configuration auto-discovery, which allows for immediate infrastructure tracking upon installation. It utilizes edge-based machine learning and unsupervised models to detect system anomalies and abnormal metric patterns locally on each node. For distributed environment

This project is a containerized monitoring stack that integrates Prometheus and Grafana to collect and visualize system metrics and time-series data. It provides a complete infrastructure for gathering hardware and operating system performance data from host machines. The stack features an automated provisioning system that loads visualization dashboards and data sources from configuration files during startup. It includes a dedicated alerting pipeline that evaluates rule-based conditions and routes notifications to external platforms like Slack via webhooks. The system covers broad observab

OpenObserve is a unified observability data platform designed to ingest, store, and analyze logs, metrics, and traces. It functions as a cloud-native monitoring tool that centralizes telemetry from diverse sources, including standard collectors and cloud service providers, into a single, scalable system. By utilizing a columnar storage engine backed by object storage, the platform enables efficient long-term data retention and high-performance analytical querying. The platform distinguishes itself through deep integration with artificial intelligence, allowing users to query data using natura

CrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl

The AWS Cloud Development Kit is an infrastructure-as-code framework that enables developers to define and provision cloud resources using familiar programming languages. By utilizing construct-based synthesis, it translates high-level, object-oriented code into declarative templates, allowing for the automated management of complex cloud environments through a centralized, code-driven control plane. The framework distinguishes itself through its ability to model infrastructure as a dependency-aware resource graph, ensuring that components are provisioned and updated in the correct order. It

wgcloud is a comprehensive suite of monitoring and management tools designed for Linux servers, network devices, containers, and middleware. It functions as a centralized dashboard for tracking real-time hardware metrics, auditing the health of Docker and Kubernetes environments, and maintaining an IT asset management system for physical and cloud infrastructure. The platform is distinguished by its integrated remote administration capabilities, featuring a web-based SSH client for executing bulk commands and managing servers directly from a browser. It further differentiates itself with AI-d

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

This project provides an observability data pipeline designed to collect, transform, and route logs, metrics, and traces from diverse sources into standardized formats for analysis. It operates as a plugin-based component architecture using modular receivers, processors, and exporters to move telemetry data through sequential processing chains. The system utilizes an interface-driven component model that allows for interchangeable connectors and community-contributed extensions. It distinguishes itself through a domain-specific language for telemetry filtering, metadata-based resource attribu

Goalert is an on-call incident management platform designed to automate the end-to-end lifecycle of system alerts. It ingests telemetry and monitoring data from external sources, routes notifications to the appropriate personnel based on defined schedules, and manages escalation policies to ensure incidents are addressed by the right responders. The platform distinguishes itself through a state-machine-driven approach to incident lifecycles and a modular notification engine that dispatches alerts across SMS, voice, email, and team messaging platforms. It supports high availability and operati

Oncall is an incident response management platform designed to coordinate alert routing, on-call scheduling, and incident resolution workflows. It functions as an alert routing and escalation engine that directs notifications to responders using rule-based deduplication and conditional escalation policies. The system includes a multi-channel notification gateway for delivering urgent alerts via SMS, push notifications, and chat platforms, featuring the ability to bypass device silence settings. It also serves as an on-call scheduling system that manages team rotations and availability through

HertzBeat is an agentless monitoring platform designed to collect performance metrics from network devices, databases, and servers without requiring client software. It functions as an infrastructure monitoring dashboard, an alert management system, and a centralized log aggregator using the OpenTelemetry Protocol. The system utilizes a cloud-edge collection hierarchy to scale data gathering across clusters and isolated networks. It distinguishes itself with a flexible extensibility model, allowing users to define new monitoring workflows through configuration-based metric templates and custo

Zabbix is an enterprise-grade open-source platform for monitoring IT infrastructure, networks, and applications. It provides real-time metrics, alerts, and dashboards, enabling organizations to track performance and availability across their entire technology stack. The platform collects metrics from virtually any source, including agents, agentless protocols, APIs, containers, databases, and cloud platforms, without requiring custom scripting. It automatically discovers IT resources by scanning network ranges and cloud environments, then applies pre-built templates for immediate monitoring.

AndroidPerformanceMonitor is a diagnostic library and debugging tool designed to detect UI freezes and monitor main thread responsiveness in Android applications. It functions as a UI block detector that identifies performance degradation by capturing thread stack dumps and performance logs. The tool utilizes a watchdog mechanism to monitor the main thread for hangs based on configurable time thresholds. When a block is detected, it captures a full call stack dump and triggers system-level alert notifications to notify developers immediately. The library includes capabilities for performance

Dispatch is an incident response orchestration platform that automates the coordination of detection, participant assembly, and task tracking across existing communication and project management tools. It provides a web-configurable state machine to manage incident lifecycle transitions, with template-driven incident models that define types, priorities, and severity levels. The platform enforces role-based access control to map user roles to specific actions and data access, while maintaining a database-backed audit trail of all incident events and system changes for compliance and post-incid

The Datadog Agent is an infrastructure monitoring agent and host telemetry collector. It functions as a background process that gathers system metrics and application health data to send to a centralized monitoring platform. The project operates as a plugin-based metric collector, using a modular system of independent check scripts to gather data from various third-party services and applications. It serves as a remote telemetry transmitter, providing a pipeline to stream infrastructure and system information to a remote analysis and alerting backend. Its capabilities cover application perfo

HyperDX is an OpenTelemetry observability platform that provides centralized log management, distributed tracing, and a self-hosted monitoring stack. It functions as a unified system for collecting, indexing, and visualizing logs, metrics, and traces from cloud and container environments. The platform distinguishes itself with specialized tooling for large language model monitoring and session replay, allowing user interactions in the browser to be linked to backend telemetry. It employs schema-less JSON parsing to index structured logs dynamically and uses source maps to resolve minified sta

Unpoller is a network controller metrics exporter and time-series data pipeline. It functions as a network event forwarder and monitoring dashboard, pulling device performance data and security anomalies from controller APIs to enable long-term storage and trend analysis. The system captures network hardware metrics and site performance data, shipping these measurements to external time-series databases. It also forwards alarms and network events to centralized log aggregation platforms and provides a visualization interface for rendering these metrics into custom analysis dashboards. The pr

dockprom is a monitoring stack based on Prometheus and Grafana designed to track the performance of Docker containers and their underlying hosts. It functions as a complete solution for gathering real-time metrics and displaying them through a self-hosted dashboard. The project includes a suite of tools for collecting container and host metrics, as well as a discovery tool specifically for automatically identifying and adding tagged EC2 instances to the monitoring configuration. The system covers several observability areas, including time-series data storage and the creation of performance

GreptimeDB is a distributed, open-source time-series database built for unified observability. It stores and queries metrics, logs, and traces together in a single columnar engine, supporting both SQL and PromQL for analysis. The database is designed as a Kubernetes-native operator with a decoupled compute and storage architecture, enabling horizontal scaling and multi-region deployment. What distinguishes GreptimeDB is its role as a multi-protocol ingestion gateway, accepting data through OpenTelemetry, Prometheus Remote Write, InfluxDB, Loki, Elasticsearch, Kafka, and MQTT protocols without

LibreNMS is an SNMP network monitoring system and IT infrastructure management suite. It serves as an automated network discovery tool and infrastructure dashboard, enabling the identification and monitoring of network hardware and operating systems. The system differentiates itself through a rule-based alerting engine and a comprehensive IT incident workflow integration. It supports complex alert routing, including escalation sequences and direct ticket generation for project management and service desk platforms. Its observability capabilities cover multi-vendor hardware oversight, applica

Grafana is an observability data platform designed to aggregate metrics, logs, and traces from diverse sources into a unified environment. It functions as a centralized interface for visualizing complex telemetry data, transforming raw streams into interactive dashboards that support real-time system health tracking and performance monitoring. The platform distinguishes itself through a plugin-based modular architecture that integrates disparate databases, cloud services, and monitoring tools via a standardized data abstraction layer. This framework allows for the dynamic loading of external

Dunst is a lightweight notification daemon for Linux desktop environments that receives and displays system alerts via the DBus protocol. It functions as a configurable alert service and notification manager, rendering pop-up messages for X11 and Wayland. The project distinguishes itself through a pattern-based rule engine that allows for dynamic alert filtering and conditional modifications of visual styles or behavioral settings based on the sending application or category. It also supports notification workflow automation by triggering external scripts and system commands when specific not