Free and open source · Apache 2.0
Signalith is a free, open-source SIEM for Windows and Linux, built so anyone can set one up, query it and get help from AI. Search every event, ask questions in plain English, detect threats with ATT&CK-mapped rules and triage findings together, on one server of your own or several.
See it in action
A short tour with sample data: the setup guide, the Signalith Agent install line, the posture dashboard, the findings queue, an attack storyline, a search, an investigation case and a response action. Or click around yourself in the live demo, no sign-up needed.
What it does
Signalith follows the way security analysts already work and puts it on free, open parts you can run anywhere. Click a tile to watch a short demo.
A pipe-based query language with stats, timechart, where, regular expressions, lookups, transaction, tstats, iplocation and dozens more commands, CIM-style data models, autocomplete, plain-English questions, and a visual builder that writes the query as you click.
2,641 SigmaHQ and 1,332 Splunk Security Content rules, each with test events that prove it fires and mapped to ATT&CK, next to 60 built-in detections. Describe a new detection in plain English and backtest it on the past 7, 30 or 90 days before you turn it on.
A triage queue with owners, statuses and bulk actions. Weak signals add risk to users and hosts instead of flooding it, behavior baselines add risk for first-seen and rare activity, and exceptions and maintenance windows keep noisy rules quiet.
Everything Signalith knows about one intrusion as one story: the ATT&CK tactics it reached and in what order, a timeline of its findings and risk events, and the users, hosts, addresses and processes that tie it together. Open it from a finding, a case or the Risk page.
One click on a finding gathers the evidence, lets an AI model run a few searches of its own, and returns a verdict with a timeline. Use Claude, an OpenAI-compatible service or Ollama on your own hardware. Off until an admin turns it on.
Ask Claude Desktop, Claude Code, VS Code or Cursor about your data. A read-only MCP server runs searches and reads findings and cases with an API token that can never change anything.
Block an IP, disable a directory account or isolate a host from a finding. Chain steps into playbooks that wait for an analyst’s approval, and send alerts to Slack, Teams, email or a webhook, with buttons to acknowledge a finding or approve a step from chat.
Add a server from the Servers page with one line for Linux, Windows or Docker, or run them on Kubernetes with the Helm chart. Servers share users, settings and detections, take over each other’s jobs, can split the detections between them, upgrade one at a time and can be drained and removed. Put them behind a load balancer and the real sender of every connection is kept.
One line installs it on Linux, Windows or macOS. It sets up Fluent Bit and osquery from their publishers, and Sysmon on Windows if you choose, then asks Signalith what to collect, so nobody edits a configuration file. Choose what they collect on the Endpoints page.
Zeek and Suricata on a small Linux box plugged into a mirror port, installed with one line from Add data. Network detections catch DNS tunnelling, beaconing, cleartext passwords and scans. A Network dashboard shows it all, and one Settings page lists every sensor’s health.
Nmap scans matched to CVEs from the National Vulnerability Database, ranked by what attackers exploit today (CISA KEV and EPSS). Place a scanner inside each network zone, and add OpenVAS with encrypted SSH, Windows, VMware ESXi or SNMP logins for deeper scans.
File changes, hardware and software inventory, and configuration checks from osquery on Windows, Linux and macOS, managed from Signalith. Wazuh agent alerts come in too.
Microsoft Defender, ClamAV and antivirus consoles that send CEF or LEEF land in one Malware data model, with detections for disabled protection and new exclusions, and a malware dashboard.
Pick free feeds from a catalog, paste any list or STIX file, or connect a TAXII 2.1 server such as MISP or OpenCTI. Every event is matched, and | threatmatch works in search.
Group the findings of one incident with notes, searches and pinned evidence on a single timeline, and open a Jira or ServiceNow ticket that stays in step with it. Close the case and its findings close with it.
Save a hunt as notes and searches side by side, tagged to ATT&CK, and share it with the team. Seven starter hunts show the way.
Security posture, network, vulnerabilities and malware dashboards out of the box, plus your own: ask a question, pick a chart, done. Click any number or row to see the events behind it. Dashboards are YAML files, so they can live in Git.
The Signalith Agent for Windows, Linux and macOS, ready Fluent Bit setups, syslog and CEF, OpenTelemetry logs, web server logs, and audit logs from AWS, Microsoft 365, Entra ID, Okta, Google Cloud, Google Workspace, GitHub and Kubernetes. For any other log, a guided page builds the parser with you. Or load sample data in one click.
See how your detections and data cover NIST SP 800-53, CIS Controls v8, PCI DSS 4.0.1, ISO/IEC 27001, HIPAA, SOC 2, NIS2 and the GDPR, and hand an auditor an evidence report.
Local users, Active Directory or LDAP, or single sign-on with OpenID Connect or SAML 2.0 and SCIM provisioning. Two-step sign-in with a passkey or an authenticator app, or a passkey alone with no password.
Serve several teams or customers from one install, each with its own events, findings, detections, dashboards and users. Add tenants on one Settings page and switch between them with the tenant picker, while a tenant’s own users see only their data.
Easy queries
Writing queries is the hardest part of most SIEMs. In Signalith you can start in plain English, see exactly how your words became a query, and keep editing from there.
datamodel=Authentication action=failure earliest=@d
| top limit=10 userReal output of signalith ask, the built-in offline translator.
How it works
Signalith is a single Go program with the web UI built in. It adds the security layer on top of proven open-source pieces, so there is nothing proprietary to license.
Secure by default
A security tool should not be the weak spot. Signalith ships safe and tells you, in plain words, anything left to tighten.
Get started
Try it on your own computer with Docker, or install the package for Linux or Windows next to OpenSearch.
Install Docker Desktop (Windows or Mac) or Docker Engine (Linux), then get the code:
git clone https://github.com/jrsamsanchez/signalith
cd signalithStart OpenSearch and the newest release of Signalith. The first start makes the passwords and certificates, so it takes a minute or two.
docker compose -f deploy/docker/docker-compose.yml up -dShow the admin password:
docker compose -f deploy/docker/docker-compose.yml exec signalith signalith initial-passwordOpen https://localhost:9000 and sign in as signalithadmin. A short setup guide takes it from there, or go to Add data and choose Load sample data to see it in action.
Install OpenSearch (2.17 or newer, 3.x included), then add Signalith’s package repository so updates arrive with the rest of the system. On Debian or Ubuntu:
sudo install -d -m 0755 /etc/apt/keyrings
sudo curl -fsSL -o /etc/apt/keyrings/signalith.asc https://signalith.io/apt/signalith.asc
echo "deb [signed-by=/etc/apt/keyrings/signalith.asc] https://signalith.io/apt stable main" | sudo tee /etc/apt/sources.list.d/signalith.list
sudo apt update && sudo apt install signalithOr on Red Hat, Rocky, Alma or Fedora. Either way Signalith starts as a systemd service:
sudo curl -fsSL -o /etc/yum.repos.d/signalith.repo https://signalith.io/rpm/signalith.repo
sudo dnf install signalithShow the admin password, then open https://<server>:9000 and sign in as signalithadmin.
sudo signalith initial-passwordDownload signalith-0.3.2-x64.msi (or the newest from the latest release). There is nothing to install first.
Double-click it and follow the steps. It downloads and sets up OpenSearch 3.9 on this computer, then installs and starts the Signalith and SignalithOpenSearch services, each under its own account. The first install downloads about 1 GB.
In PowerShell as Administrator, show the admin password, then open https://localhost:9000 and sign in as signalithadmin.
signalith initial-passwordFull instructions, upgrades, checking a download and every setting are in the documentation. To add a second server later, see Adding servers, and for Kubernetes, the Helm chart.
Coming soon
Signalith is built in the open and things ship when they are ready and tested, so there are no dates here. The roadmap has the detail, and ideas are welcome as feature requests.
A code-signed .msi, so Windows trusts the installer and the service it puts in place.
OpenSearch shard limits checked before they bite, and syslog that keeps events through an OpenSearch restart.
A week of real Windows and Sysmon events through three servers, with the disk, memory and shards it took published.
An outside security review, and then 1.0.
Signalith is free to use, change and share under the Apache License 2.0. Star it, try it, and open an issue with what you would like next. If it is useful to you, sponsoring it helps keep it going.