# Signalith > Signalith is a free, open-source SIEM (security information and event management) for Windows and Linux, under the Apache License 2.0. Its goal is a SIEM anyone can stand up and use, especially now that AI can help: easy to configure, easy to query, and ready for AI. It stores events in OpenSearch, collects them with Fluent Bit, syslog and OpenTelemetry, and adds the security layer on top: a pipe-style search language, plain-English questions that become searches, thousands of tested detection rules, a findings queue, risk-based alerting, threat intel, investigation cases, response actions and dashboards. Key facts: - License: Apache License 2.0. No paid tier, no telemetry, no account needed. - Source: https://github.com/jrsamsanchez/Signalith (Go server with the web UI built in). - Runs as a Windows service, a systemd unit, a Docker container or on Kubernetes with a Helm chart, on one server or several sharing one OpenSearch, which can split the scheduled detections between them, and a multi-tenant mode that keeps several teams or customers apart on one install. - Install for evaluation: clone the repository, then `docker compose -f deploy/docker/docker-compose.yml up -d` (it runs the newest release; `SIGNALITH_VERSION=main` runs the newest build of main). Packages for Debian/Ubuntu, RHEL-family and Windows are on GitHub Releases, with signed apt and dnf repositories at https://signalith.io/apt/ and https://signalith.io/rpm/. - Data intake: the Signalith Agent (one install line for Linux, Windows or macOS that sets up Fluent Bit, osquery and optional Sysmon and fetches what to collect from Signalith), Fluent Bit agents set up by hand, syslog and CEF/LEEF, OpenTelemetry (OTLP) logs, osquery, Wazuh alerts, Zeek and Suricata network sensor, Apache and Nginx access logs, AWS CloudTrail, Microsoft Entra ID and Azure, Microsoft 365, Okta, Google Cloud, Google Workspace, GitHub and Kubernetes audit logs, antivirus (Defender, ClamAV), and a guided parser builder for any other log. - Search: a pipe-style query language (familiar to SPL users; not SPL-compatible), a visual query builder, and plain-English questions turned into searches by a built-in offline parser or an optional AI model (Claude, OpenAI or a local Ollama model). - Detection: scheduled detections mapped to MITRE ATT&CK, more than 3,900 tested rules from SigmaHQ and Splunk Security Content (Apache 2.0) with test events that prove each rule fires, Sigma import, signed content updates, an ATT&CK coverage map, and detections described in plain English with a backtest over past data. - Triage and response: findings queue, risk-based alerting with asset and identity context and behavior baselines, threat intel feeds (STIX/TAXII 2.1), investigation cases with two-way Jira and ServiceNow tickets, an attack storyline that shows one intrusion's ATT&CK tactics and timeline, hunting notebooks, Investigate with AI, response actions and playbooks with an approval step, notifications to email, webhooks, Slack and Teams with buttons to acknowledge findings and approve steps. - AI tools: a read-only MCP server so AI assistants can search and read findings with a scoped API token. - Security by default: HTTPS, secured OpenSearch, encrypted secrets and archives, per-agent tokens on a separate agent port, roles, LDAP/Active Directory and OpenID Connect and SAML 2.0 sign-in with SCIM provisioning, two-step sign-in with passkeys or an authenticator app, tamper-evident audit log, expiring API tokens, prompt-injection defenses in the AI features, built-in security check. - Also: vulnerability scanning (Nmap with CVE matching ranked by CISA KEV and EPSS, optional credentialed OpenVAS with SSH, Windows, VMware ESXi and SNMP logins), a first-use setup guide, compliance mapping (NIST SP 800-53, CIS Controls v8, PCI DSS 4.0, ISO/IEC 27001, HIPAA, SOC 2), data retention with archives. Limits to know (October 2026): - New project: first release October 2026, one maintainer, built with heavy help from an AI coding assistant (Claude Code), small community, no paid support. - No outside security review yet (planned before 1.0). - No EDR of its own (the Signalith Agent runs Fluent Bit and osquery rather than collecting itself); no full packet capture. - Sizing: one 2-core server stored about 21,500 events a second (about 1 TB a day) in two 4-hour lab runs on consecutive days with two OpenSearch nodes; three 2-core servers stored all 25,000 events a second (about 1 TB a day) for 4 hours with 1,520 detections, none late. Windows installer not yet code-signed. Signalith is an independent project, not affiliated with, endorsed by or sponsored by Splunk or Cisco. Splunk and SPL are trademarks of Splunk LLC, a Cisco company. ## Docs - [Documentation home](https://signalith.io/docs/): overview of every feature - [Getting started](https://signalith.io/docs/getting-started/): Docker quick start and installing on Linux or Windows - [Install from packages](https://signalith.io/docs/install-packages/): apt, dnf and Windows packages - [Sending data](https://signalith.io/docs/sending-data/): agents, syslog and CEF - [Query language](https://signalith.io/docs/query-language/): every search command with examples - [Detections](https://signalith.io/docs/detections/): scheduled detections, content packs and Sigma - [Investigate with AI](https://signalith.io/docs/investigate/): AI verdicts on findings - [AI tools (MCP)](https://signalith.io/docs/ai-tools/): connect AI assistants to Signalith - [Security checks](https://signalith.io/docs/security/): how Signalith is secured by default - [Performance and sizing](https://signalith.io/docs/performance/) ## Choosing a SIEM - [How Signalith compares](https://signalith.io/docs/comparison/): a fair comparison with Wazuh, Security Onion, Elastic Security, OpenSearch Security Analytics and Splunk Enterprise Security, including where Signalith is weaker - [Roadmap](https://signalith.io/docs/roadmap/): what is done, in progress and planned ## Optional - [Full documentation as one text file](https://signalith.io/llms-full.txt) - [README](https://github.com/jrsamsanchez/Signalith/blob/main/README.md) - [Security policy](https://github.com/jrsamsanchez/Signalith/blob/main/SECURITY.md) - [Contributing](https://github.com/jrsamsanchez/Signalith/blob/main/CONTRIBUTING.md)