Skip to content
HANU
Deploy Hanu
Menu

By role

githubregistry9.6RULE-T2-015compound riskhanu
HANUOne window, every signal, the whole chain.

A quiet read at one system. Nobody minds a read.Next door the same credentials are just a login. Nobody minds a login.Only something holding both at once can call it an attack.And it is happening everywhere you are not looking.

Your tools each told the truth. The attack still worked.

Hanu runs in your own cloud, holds every signal in one window, and scores the chains that no single tool is positioned to see.

Deploy HanuHow correlation works

Community edition: the full detection and correlation engine, free to run in production, on your infrastructure, under the Elastic License 2.0. See what is paid.

correlationwindow 24h
  • githubCI_WORKFLOW_TAMPERsecurity-audit.yml pushed
  • registrySUSPICIOUS_PACKAGE_RELEASEno provenance, 41m old
  • githubSECRET_LEAKED3 deploy keys readable
  • awsLLM_JACKING_ACTIVITYInvokeModel 14× baseline
no single signal is critical
9.4RULE-T2-014CI workflow tamper → secret leak
9.6RULE-T2-015Compromised release → LLMjacking
Four signals across GitHub, a package registry and AWS, over one day. No single detector raises an incident. Tier-2 correlation joins them and scores the result, with the rule and the signals that produced it attached.

The part no single tool is positioned to see

The incident in full
four tools, four true statementslitellm 1.107.0 · october 2026
dependabota new patch release of litellmupgrade
ci pipelinea workflow file changed in the repogreen
cloud trailGetCallerIdentity, then Bedrock callsnormal
identity providera CLI token used from a new ASNlow risk

Every one of those is true, and not one of them is an incident.

9.6a release with no provenance, then a first-ever model enumeration by the principal that shipped itRULE-T2-015 · critical
Hanu does not replace the four tools. It is the row that reads all four at once.
incidentLiteLLM 1.107.0
Three GitHub CLI OAuth tokens stolen, a lookalike repository, a release with no provenance, a 16-module credential stealer, and a first-ever Bedrock model enumeration. Quarantined in about two hours. Full write-up.
ruleRULE-T2-015
A compromised release, followed within 12 hours by a credential validating against a model API for the first time and then enumerating or invoking models, scores CRITICAL. Both stages are required — either alone stays a finding.

Numbers you can count yourself

Full capability map
0security domains
0+detection engines
0behavioural detections
0MITRE ATT&CK techniques mapped
0typed signals on the bus
0correlation rules across two tiers
how these are countedEvery figure above is reproducible from the source
  • 32 security domainsfind src/domains -maxdepth 1 -type d ! -path src/domains | wc -lThe old site said 30+; 32 is the real count.
  • 600+ detection enginesfind src -name '*.engine.ts' | wc -l → 622Rounded down from 622 engine files, which include a few stubs.
  • 609 behavioural detectionsgrep -rhoE 'id: *"RULE-[A-Za-z0-9-]+"' src/correlation/rules/behavioral | sort -u | wc -lThe old site said 610. Corrected to 609.
  • 96 MITRE ATT&CK techniques mappedgrep -rhoE '"T[0-9]{4}(\.[0-9]{3})?"' src/correlation/rules/behavioral | sort -u | wc -lThe old site said 48 — that was an undercount. 122 across all correlation rules, behavioural and both tiers.
  • 166 typed signals on the busSignalType union in src/shared/signals/types.ts
  • 75 correlation rules across two tierstier1Rules (34) + tier2Rules (41) registration arrays, counted at runtime because both spread rule packs

From one signal to one decision

deterministic · no LLM in the path
  1. AtomicSignal

    Ingest

    166 signal types

    Typed and attributed on arrival. Nothing is scored yet.

  2. Finding

    Detect

    609 detections · 96 ATT&CK

    Behaviour against 90 days of that principal's own history.

  3. CorrelationInput

    Join

    one window

    Different vendors, accounts and weeks, held side by side.

  4. CompoundRisk

    Score

    41 tier-2 rules

    One score, with every contributing signal still attached.

  5. Feedback

    Close

    4 CI systems

    A check run or a pull request, where the code already lives.

0 domains, one graph

600+ engines · 609 detections
cloudinfrastructurenetworkedge-securityendpointruntimechangeidentityhumannhigovernancesupply-chainaspmapi-securitywebappmalwareai-workloadai-model-securityagenticmcp-securityshadow-aiautomationdataemailtrainingcrypto-postureeasmattacksocremediationactive-testingcompliance

One identity graph, one asset inventory, one correlation window — which is why a certificate from last month can be weighed against a model call from this afternoon.

What changes, by role

All roles

startup · 5–50 engineers · no security hire

One stack in your own cloud covers cloud, code, identity and CI/CD, with defaults that stay quiet until a chain actually forms. You get a security function before you can afford to hire one.

8 services · 2 vCPU · $0 in production · Elastic License 2.0

Startups and small teams in full
Security correlationSupply chain securityCI/CD securityLLM & AI workload securityAgent & MCP securityNon-human identityAttack path analysisExternal attack surfaceCompliance mapping

Runs in your account, not ours

8 services · 2 vCPU · 6 GB RAM · 10 GB disk
docker-compose.selfhost.ymlyour host, your datastores

git clone https://github.com/hanu-security/hanu

cp .env.example .env

docker compose -f docker-compose.selfhost.yml up -d

postgres · neo4j · redis · minio

8 services up on one host

telemetry sent off this host: 0 bytes

console → http://localhost:3000

Your datastores, your keys

Postgres, Neo4j, Redis and MinIO on your disks, under your KMS.

Read-only in, nothing out

No control plane, no telemetry, no licence server to call.

Auditable, because you have the source

Elastic License 2.0 — read every detection, count the rules yourself.

One node, not a cluster team

2 vCPU · 6 GB RAM · 10 GB disk runs the whole 8-service stack.

Self-hosting guideSecurity and trust

What is free, and what is not

Pricing

Community

free, in production

The whole engine: every domain, every cloud, the attack-path graph, the compliance evidence engines, unlimited self-hosted seats.

Deploy it

Growth

licence or managed

The detection feed between releases, plus the runtime, agentic and app-security suites.

Compare editions

Enterprise

regulated and multi-tenant

SOC operations, offensive validation, SSO/SAML, custom roles, cross-tenant analysis, support SLA.

Talk to us

No edition is metered on data, events or seats. Where a page on this site claims a number, the command that counts it is on the same page — the ledger is public.

What we published this month

All threat intel

GhostAction

Workflow injection across hundreds of repositories.

Questions worth answering directly

What does a self-hosted security correlation platform actually do?
It takes signals that already exist in your cloud, identity provider, code host, CI system, certificate authorities and AI workloads, keeps them in one place, and joins them across systems. A single signal becomes a Finding. A set of signals that is only dangerous together becomes a CompoundRisk with the score, the rule that fired and every contributing signal attached.
How is this different from a CSPM tool?
A CSPM scans your cloud against a benchmark and reports configuration. Hanu does that too — 368 AWS service checks, 77 each for Azure and GCP — but the reason it exists is the part a per-cloud scanner cannot see: an action in GitHub, a certificate issued last month and a Bedrock call this afternoon landing in the same risk. See the correlation page.
Can I run it entirely inside my own account?
Yes, and it is the default. The self-host stack is docker-compose.selfhost.yml — Postgres, Neo4j, Redis, MinIO and the application services. Telemetry stays in your datastores; cloud access is read-only IAM roles. Community edition costs $0 to run in production under the Elastic License 2.0.
Does Hanu use AI or an LLM to detect anything?
No. There are exactly two LLM call sites in the entire codebase, both inside an optional advisory feature that no engine imports. Detection, correlation and scoring are deterministic rules over typed signals, which is what makes a score reproducible and reviewable six months later.
How many detections ship with it?
609 behavioural detections mapped to 96 MITRE ATT&CK techniques, plus 75 correlation rules across two tiers. Every figure on this site carries the command that counts it — open the facts ledger and check.
What happens to a finding after it is raised?
It stays attached to its evidence. Fix it and Hanu pushes a check run or a pull request back into GitHub, GitLab, CircleCI or Jenkins, so the closure is visible to the engineer who wrote the code rather than buried in a security console.
Which clouds and tools does it cover?
AWS, Azure, GCP and Kubernetes in depth; Okta, Entra ID, Microsoft 365, Google Workspace and LDAP for identity; GitHub, GitLab, CircleCI, Jenkins, Semgrep, Snyk, Trivy and Tenable for code and supply chain; CrowdStrike and SentinelOne for runtime; Splunk, Datadog, Jira, ServiceNow, Cortex XSOAR, PagerDuty and Slack for operations. No Oracle Cloud yet.

Bring the evidence in-house

One compose file, your datastores, read-only credentials into your clouds. The correlation engine is not a paid feature — it is the product.

Deploy HanuSee edition differences