SchemaGuard

SchemaGuard is a web app (with optional CLI agent) that monitors your SIEM log pipelines for schema drift and field-level changes that quietly ruin correlation rules, dashboards, and compliance reports. It continuously samples incoming events, fingerprints field names/types/values, and compares them to a baseline per source (e.g., Okta, Windows, AWS CloudTrail, Palo Alto). When a vendor update, parser change, or new data source alters fields, SchemaGuard pinpoints what changed, which detections depend on it, and how much coverage you just lost. It generates actionable tickets with suggested parser fixes, mapping updates (ECS/OCSF), and regression tests you can run in CI before promoting changes. This is not a “better SIEM”; it’s a guardrail that reduces outages, false negatives, and analyst thrash caused by brittle log normalization.