Open-source SIEM · Apache 2.0
Signalith documentation¶
Signalith collects logs from Windows, Linux, network devices and OpenTelemetry, stores them in OpenSearch, and adds the security layer on top: a pipe-based query language, scheduled detections with a triage queue, Sigma rule import, risk-based alerting, threat intel, dashboards and investigation cases. It is one Go program with the web UI built in, running as a Windows service, a systemd unit or a container.
Where to go next¶
-
Getting started
Run it with Docker in two commands, or install it on Linux or Windows next to OpenSearch.
-
Data intake
Fluent Bit agents for Windows and Linux, syslog and CEF from network devices, and OpenTelemetry logs over OTLP.
-
Search
A query language that reads like SPL, plain-English questions that become queries, and a visual builder.
-
Detect and triage
Scheduled detections mapped to MITRE ATT&CK, Sigma import, a findings queue, risk scores and threat intel matching.
-
Dashboards
The security posture dashboard and dashboards of your own, kept as YAML files you can review in Git.
-
Try it with sample data
A week of made-up activity for a fictional company, with attacks hidden in it. One click loads it, one click removes it.
-
Administration
Settings, users and roles, Active Directory sign-in, several servers sharing one OpenSearch, and data retention.
-
Security
HTTPS by default, encrypted secrets, a secured OpenSearch, and a built-in check of how your server is set up.
-
Roadmap
What is done, what is being built now, and what comes after.
How it fits together¶
Fluent Bit agents ──HTTPS──▶ signalith (Go) ──REST──▶ OpenSearch
(Windows, Linux) ingest, parse, events by data model and day
syslog devices ─UDP/TCP/TLS▶ query compiler,
OTLP collectors ──HTTPS────▶ web UI and API ◀── analyst browser
Signalith is a personal open-source project by Samuel Sanchez Jr., licensed under Apache 2.0. Questions, bug reports and ideas are welcome on GitHub; see Contributing to help out, and the security policy to report a weakness privately.