Motivation
Enterprise ITSM tools require cloud licensing servers, external telemetry, and heavy JavaScript chains. Critical infrastructure and classified/air-gapped networks need a lightweight, self-hosted system that operates reliably with zero internet dependency.
Compliance auditors evaluate operational artifacts—not policy declarations. RAIN functions as an automated evidence engine, turning live events, change flows, and asset changes into verifiable audit trails.
Networks produce telemetry asynchronously across disconnected segments. RAIN ingests raw Syslog feeds, buffers network signals, and automatically promotes critical signals into structured tickets.
Built with Python, FastAPI, Jinja2, and vanilla CSS/JS. Simple maintenance without a garland of dependencies, complex compilation steps, or security supply chain risks.
Core Capabilities
Flexible asset management focused on direct inventory control rather than rigid CMDB methodologies.
- Custom dynamic schema & attributes
- CSV, JSON, and Excel import/export
- Direct association with tickets & events
- Multi-tenant asset isolation
Centralized lifecycle management for operational requests, security events, and system changes.
- Incident, vulnerability, change requests
- Rule-based automated event promotion
- Multi-tenant approval flows
- Client portal with optional public portal
Native integration with security tools to bridge event detection directly to operational response.
- BYO dicovery, IaC, SIEM, XDR, APM, and many other products
- Regex and pattern matching event rules
- Automated severity classification
- Python River based ML rules for anomaly detection
Integrated operational scheduling for maintenance windows and routine procedures.
- Recurring maintenance event tracking
- Syslog event correlation with maintenance
- Tenant-scoped calendar visibility
- "Events happening today" client portal widget
Built-in knowledge management and document archive for SOPs and compliance documentation.
- Local or S3-compatible storage backend
- Automatic daily document refresh from external feeds
- Ticket attachments and evidentiary links
Built for strict control framework requirements and regulatory environments.
- Immutable system action logging
- Customizeable group approvals for action
- Role-Based Access Control (RBAC) with local, SAML, and LDAP auth
- In-line evidence generation capabilities
Resources
System design, technical stack decisions, deployment shapes, and production considerations.
In-depth analysis of FedRAMP High, ISO 27001, PCI-DSS v4.0, and international framework compliance.
Task-oriented workflows for managing tenants, asset fields, event rules, and notifications.
Main codebase, Docker Compose configurations, Helm charts, and quickstart instructions - including one command "try me now" image.
Preview
Global Framework Alignment
Designed to generate operational evidence artifacts across major global security baselines: