GitHub

Free and open source · Apache 2.0

Find the signal
in a monolith of logs.

Signalith is an open-source SIEM for Windows and Linux, inspired by Splunk Enterprise Security. Search every event, ask questions in plain English, detect threats with ATT&CK-mapped rules and triage findings together, on your own servers.

Get started View on GitHub
  • Windows and Linux
  • One Go binary, web UI built in
  • HTTPS by default
The Signalith Findings page: a queue of findings with severity, status and owner, and an inspector panel for the selected finding.
A triage queue for findings, ranked by urgency, with triage guidance, evidence and ATT&CK techniques next to each one.
21ATT&CK-mapped detections built in
Sigmarules import with one click
2platforms: Windows service or systemd
$0license cost, Apache 2.0

What it does

Everything a security team expects from a SIEM.

Signalith follows the shape of Splunk Enterprise Security, the way analysts already work, and puts it on free, open parts you can run anywhere.

Search that reads like SPL

A pipe-based query language with stats, timechart, where and friends, CIM-style data models, autocomplete, and a visual builder that writes the query as you click.

Ask in plain English

Type top 10 users with failed logins today and get the query, with how each phrase was read. Works offline; an AI model is optional, and only your question is ever sent.

Detections and a findings queue

Scheduled detections mapped to MITRE ATT&CK, Sigma import, an ATT&CK coverage matrix, and a triage queue with owners, statuses, dispositions and bulk actions.

Risk-based alerting

Weak signals add risk to users and hosts instead of flooding the queue. One finding fires when an object crosses a threshold, weighted by your asset and identity lists.

Threat intel

Pick free feeds from a catalog, paste any list or STIX file, or connect a TAXII 2.1 server such as MISP or OpenCTI. Every event is matched, and | threatmatch works in search.

Investigation cases

Group the findings of one incident with notes, searches and pinned evidence on a single timeline. Close the case and its findings close with it.

Dashboards

A security posture dashboard out of the box, plus your own: ask a question, pick a chart, done. Dashboards are YAML files, so they can live in Git.

Easy data collection

The Add data page writes a ready Fluent Bit setup for Windows or Linux, with the address, token and certificate filled in. Syslog and CEF from network devices too.

Sample data in one click

No logs to hand? Load a week of activity for a fictional company with attacks hidden in it, watch detections fire, then remove it all with one click.

Easy queries

Ask a question. Get a query you can read.

Writing queries is the hardest part of most SIEMs. In Signalith you can start in plain English, see exactly how your words became a query, and keep editing from there.

  • Explain turns any query into plain-English steps.
  • Click any value to filter, exclude, count or chart it.
  • Turn any search into a detection or dashboard panel.
  • Bring your own model, or keep it all on site with Ollama.
top 10 users with failed logins today
datamodel=Authentication action=failure earliest=@d
| top limit=10 user
  1. top 10the top 10
  2. usersone row per user
  3. failedonly failures
  4. loginslogon data (Authentication)
  5. todaytime range: since midnight

Real output of signalith ask, the built-in offline translator.

How it works

Built on open parts you already trust.

Signalith is a single Go program with the web UI built in. It adds the security layer on top of proven open-source pieces, so there is nothing proprietary to license.

Fluent Bit agentsWindows event logs, Sysmon, Linux auth and audit
Syslog devicesFirewalls, switches and appliances: UDP, TCP or TLS, CEF
Signalith Parsing and data models · query language · detections and risk · threat intel · cases · web UI and API
OpenSearchStores and searches every event, finding and case
AnalystsAny browser, with roles and AD or LDAP sign-in
  • OpenSearchstorage and search
  • Fluent Bitlog collection
  • Sigmadetection rules
  • MITRE ATT&CKtechnique mapping

Secure by default

Locked down before you change a setting.

A security tool should not be the weak spot. Signalith ships safe and tells you, in plain words, anything left to tighten.

  • HTTPS everywhere with a certificate it makes and renews itself; agents check it.
  • Secrets encrypted at rest with a master key, DPAPI on Windows.
  • No default passwords. The Docker setup makes its own, and OpenSearch runs with security on.
  • Roles and directory sign-in: viewer, analyst and admin, from your AD or LDAP groups.
  • Hardened service: its own account on Windows, systemd sandboxing on Linux.
The Signalith Security page listing what to fix first and whether data is encrypted in transit.

Get started

Running in a few minutes.

Try it on your own computer with Docker, or install it as a service on Linux or Windows next to OpenSearch.

  1. Install Docker Desktop (Windows or Mac) or Docker Engine (Linux), then get the code:

    git clone https://github.com/jrsamsanchez/signalith
cd signalith

  2. Start OpenSearch and Signalith. The first start makes the passwords and certificates, so it takes a minute or two.

    docker compose -f deploy/docker/docker-compose.yml up -d

  3. Show the admin password:

    docker compose -f deploy/docker/docker-compose.yml exec signalith signalith initial-password

  4. Open https://localhost:8080 and sign in as admin. Then go to Add data and choose Load sample data to see it in action.

Full instructions, upgrades and every setting are in the documentation.

Your logs, your servers, your SIEM.

Signalith is free to use, change and share under the Apache License 2.0. Star it, try it, and open an issue with what you would like next.

Star on GitHub Open an issue