Skip to content

Substation

Forensics & Incident Response

A cloud native data pipeline and transformation toolkit for security teams.

Track releases GitHub Website
Go Latest v2.8.0 · 6mo ago Security brief →

Features

  • Extensible data processing with built‑in functions and custom Go plugins
  • Conditional routing of logs to AWS services (S3, Kinesis, SQS, Lambda) or any HTTP endpoint
  • Schema normalization supporting ECS, OCSF, or custom formats
  • Scalable enrichment via external APIs or self‑hosted microservices
  • Serverless deployment on AWS with Terraform for zero‑maintenance operation

Recent releases

View all 1 releases →
v2.8.0 Breaking risk
Breaking changes
  • Removed aws-sdk-go v1 dependency
Notable features
  • Added custom gjson modifier to dedupe arrays
  • Added FormatFromParquet Transform
Full changelog

2.8.0 (2026-01-20)

Features

  • message: add custom gjson modifier to dedupe arrays (#313) (e37da27)
  • transform: Add FormatFromParquet Transform (#302) (64928e1)

Bug Fixes

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
403
Forks
35
Languages
Go HCL Jsonnet
View on GitHub Homepage Documentation

Install & Platforms

Install via
go
Platforms
linux macos windows arm64

Similar tools

VAST
pipeline
vector
netdata
convoy

Alternative to

Cribl Datadog

Beta — feedback welcome: [email protected]