Open Source Cyber Security Data Analytics Platform used for rapid detection and response to threats at massive scale.

Forest Hill, MD –24 April 2017– The Apache Software Foundation (ASF), the all-volunteer developers, stewards, and incubators of more than 350 Open Source projects and initiatives, announced today that Apache® Metron™ has graduated from the Apache Incubator to become a Top-Level Project (TLP), signifying that the project's community and products have been well-governed under the ASF's meritocratic process and principles.
Apache Metron provides a scalable, advanced security analytics framework to offer a centralized tool for security monitoring and analysis. Metron’s extensible platform integrates a number of elements from the Apache Hadoop ecosystem to effectively enable rapid detection and rapid response using both traditional rules and machine learning for advanced security threats.
"It is abundantly clear that cybersecurity challenges are becoming a bigger part of our reality," said Casey Stella, Vice President of Apache Metron. "Solving them effectively and at scale requires an Open Source, community-oriented approach built upon proven scalable technologies. This is what Metron is about at its core."
Metron is a unified platform for aggregating and enriching a wide variety of security related data.   Built atop Apache Storm, Apache HBase and Apache Kafka, Metron can ingest, transform and normalize any source of telemetry at scale, including full network packet capture. Data ingested into Metron can be enriched with valuable context such as geographic location or asset identifiers as it streams by. New enrichments can be specified with no-downtime through user defined functions and a robust scripting language. Security threats can be specified and triaged using either rules or machine learning models so that only the greatest threats are prioritized for threat response and investigation.
Highlights include:
  • Mechanism to capture, store, and normalize any type of security;
  • Telemetry at extremely high rates;
  • Real time processing and application of enrichments;
  • Efficient information storage;
  • Interface that provides a centralized view of data and alerts passed through the system; and 
  • Use of statistical summary data structures (e.g. sketches) to perform security analytics even on the largest of data sets
Apache Metron leverages Big Data and machine learning to enable users to rapidly detect and respond to cyber security threats, whether in application-specific environments such as an email service provider, or across the Internet of Things (IoT). Australia’s largest telecommunications, media, and Internet Service Provider, Telstra, uses Apache Metron to power enterprise-grade security operations centers (SOCs) in key service hubs.
"Going through the Apache incubation process really illuminated how valuable and important it was to build vibrant and inclusive communities around code. Having infrastructure support from the ASF and active mentors to shepherd us through the hurdles made all the difference in the world," added Stella. "The core ideals of openness, community, and transparency are prerequisites for solving cybersecurity challenges. Metron was a great fit in Apache because the ASF shares those core ideals. It really does take a village to solve the really hard problems."
Metron initiated at Cisco in 2014 as OpenSOC. The project was submitted to the Apache Incubator in December 2015, and released its first release of Apache Metron in April 2016.
Catch Apache Metron in action at the DataWorks Summit, 13-15 June 2017 in San Jose.
Availability and Oversight
Apache Metron software is released under the Apache License v2.0 and is overseen by a self-selected team of active contributors to the project. A Project Management Committee (PMC) guides the Project's day-to-day operations, including community development and product releases. For downloads, documentation, and ways to become involved with Apache Metron, visit and 
About the Apache Incubator
The Apache Incubator is the entry path for projects and codebases wishing to become part of the efforts at The Apache Software Foundation. All code donations from external organizations and existing external projects wishing to join the ASF enter through the Incubator to: 1) ensure all donations are in accordance with the ASF legal standards; and 2) develop new communities that adhere to our guiding principles. Incubation is required of all newly accepted projects until a further review indicates that the infrastructure, communications, and decision making process have stabilized in a manner consistent with other successful ASF projects. While incubation status is not necessarily a reflection of the completeness or stability of the code, it does indicate that the project has yet to be fully endorsed by the ASF. For more information, visit
About The Apache Software Foundation (ASF)
Established in 1999, the all-volunteer Foundation oversees more than 350 leading Open Source projects, including Apache HTTP Server --the world's most popular Web server software. Through the ASF's meritocratic process known as "The Apache Way," more than 620 individual Members and 6,000 Committers successfully collaborate to develop freely available enterprise-grade software, benefiting millions of users worldwide: thousands of software solutions are distributed under the Apache License; and the community actively participates in ASF mailing lists, mentoring initiatives, and ApacheCon, the Foundation's official user conference, trainings, and expo. The ASF is a US 501(c)(3) charitable organization, funded by individual donations and corporate sponsors including Alibaba Cloud Computing, ARM, Bloomberg, Budget Direct, Capital One, Cash Store, Cerner, Cloudera, Comcast, Confluent, Facebook, Google, Hortonworks, HP, Huawei, IBM, InMotion Hosting, iSigma, LeaseWeb, Microsoft, ODPi, PhoenixNAP, Pivotal, Private Internet Access, Produban, Red Hat, Serenata Flowers, Target, WANdisco, and Yahoo. For more information, visit and
© The Apache Software Foundation. "Apache", "Hadoop", "Apache Hadoop", "Metron", "Apache Metron", and "ApacheCon" are registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries. All other brands and trademarks are the property of their respective owners.
# # #