It is a modular, low-cost alternative focused on real-time anomaly detection using Zeek/Suricata and AI/ML (Fine-Tuning + RAG). It reduces licensing and operational complexity while remaining scalable and suitable for research and educational environments.

OPNsense for gateway enforcement, Zeek for protocol metadata, Suricata for IDS/IPS alerts, Elasticsearch/OpenSearch for indexing and visualization, and an MCP-controlled analysis layer with Electron desktop UI for investigation and response.

Logs are enriched and features extracted for anomaly detection models built with scikit-learn, PyTorch, and PyOD. Fine-tuned models capture attack patterns, while RAG provides contextual anomaly detection and explanation. MCP enables operator control for rapid rule deployment without waiting for long retraining cycles.

The OPNsense API applies dynamic firewall actions (allow, block, quarantine) in real time, orchestrated from the NALA App based on model/MCP decisions.

Dashboards for anomaly correlation and triage, behavioral profiling to detect deviations such as botnets, exfiltration, and APTs, with real-time Elasticsearch queries managed under MCP control.

Runs on Debian-based Linux, suitable for mini-PCs, RPi 4/5, VMs, or cloud. Network traffic can be mirrored to a sensor for collection.

Future plans include continued evaluation of Fine-Tuning vs RAG vs MCP strategies, integration of additional threat intelligence feeds, scaling performance to enterprise environments, and improved operator tooling through MCP. Open-source contributions and community feedback are encouraged.