# Substation

Substation is a Security Data Pipelines product. It runs in the cloud. Pricing is free.

A cloud-native, event-driven data pipeline toolkit for security teams that processes and routes data across AWS services with custom formatting and API enrichment capabilities.

Checked October 2026.

## What is Substation?

Substation is a cloud-native data pipeline toolkit designed for security teams to process and route event-driven data across AWS cloud services.

The tool provides extensible data processing capabilities that allow security teams to transform and manipulate data streams according to their specific requirements. It supports conditional routing functionality, enabling data to be directed to different AWS services based on predefined criteria and rules.

Substation includes custom schema formatting features that allow teams to structure data according to their organizational needs and compliance requirements. The toolkit supports unlimited data enrichment through integration with external APIs, enabling teams to augment their data with additional context and intelligence.

The platform is designed for serverless deployment within AWS infrastructure, allowing teams to scale their data processing operations without managing underlying server resources. This architecture supports event-driven workflows that can automatically respond to incoming data streams and trigger appropriate processing actions.

Tags: Cloud Native, Serverless, AWS

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Security Data Pipelines](https://cybersectools.com/categories/security-data-pipelines)
- Deployment: Cloud
- Company size fit: SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 390
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## Substation FAQ

### What is Substation?

Substation is a product in the Security Data Pipelines category. It covers Cloud Native, Serverless and AWS.

### What is the pricing for Substation?

Substation is free. Download and setup instructions are at https://github.com/brexhq/substation/.

### What are alternatives to Substation?

Alternatives to Substation listed on CybersecTools:

1. [Axoflow Platform](https://cybersectools.com/tools/axoflow-platform) - Security data pipeline platform for collecting, curating, and routing logs (Commercial)
2. [Comcast Security Data Fabric](https://cybersectools.com/tools/comcast-security-data-fabric) - Security data fabric architecture for unified security data management (Commercial)
3. [Monad Embedded](https://cybersectools.com/tools/monad) - Embed 350+ security data connectors in your product with two npm packages (Commercial)
4. [Scanner](https://cybersectools.com/tools/scanner) - Security data lake platform for threat detection via S3-native log indexing. (Commercial)
5. [Cribl Edge™](https://cybersectools.com/tools/cribl-edgetm) - Vendor-neutral agent for unified telemetry collection and fleet mgmt at scale. (Commercial)

Compare all Substation alternatives at [https://cybersectools.com/alternatives/substation](https://cybersectools.com/alternatives/substation)

### What deployment and organization size does Substation fit?

Substation is available as a cloud service. It is listed for small businesses, mid-market companies and enterprises. It is free.

## Compare Substation with similar solutions

- [Substation vs Axoflow Platform](https://cybersectools.com/compare/axoflow-platform-vs-substation)
- [Substation vs Comcast Security Data Fabric](https://cybersectools.com/compare/comcast-security-data-fabric-vs-substation)
- [Substation vs Monad Embedded](https://cybersectools.com/compare/monad-vs-substation)

All alternatives to Substation: [/alternatives/substation](https://cybersectools.com/alternatives/substation)

---

Source: https://cybersectools.com/tools/substation

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Substation: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md