Signalith
A free, open-source SIEM for Windows and Linux: easy to set up, easy to query, ready for AI.
Signalith collects your logs, runs thousands of tested detections over them, and gives
you one queue of findings to triage, investigate and respond to. It is built for small
security teams and anyone who wants a real SIEM without a big budget or weeks of setup.
- Collect Windows, Linux and macOS logs with one install line per computer, plus
syslog, OpenTelemetry, cloud audit logs (AWS, Azure, Microsoft 365, Google) and more.
- Detect with 2,641 SigmaHQ rules and 1,332 rules from Splunk's open-source
security_content, each tested in CI against sample events, tagged with 181 ATT&CK
techniques. High and critical rules turn on in one click. Signalith also ships 60
built-in detections (brute force, password spray, encoded PowerShell, credential
dumping and more); 55 are on by default.
- Triage with risk-based alerting, a findings queue, cases, an attack storyline and
an optional Investigate with AI step that also works with a local model.
- Search with a pipe-style language familiar to SPL users, a click-to-build query
builder, or a question in plain English.
- Run it your way: Docker,
.deb/.rpm packages with signed apt and dnf
repositories, a Windows installer, or a Helm chart. HTTPS by default, no default
passwords, and two-step sign-in with passkeys.
| Try it | |
|---|
| In your browser, nothing to install | demo.signalith.io, a read-only demo with the sample data |
| On your own computer, with Docker | Quick start, two commands after git clone |
| With made-up data that has attacks hidden in it | Sample data, one click |
| On a Linux or Windows server | Packages (.deb, .rpm, .msi), Linux, Windows, Kubernetes |
Learn more: website ·
documentation ·
how it compares with Wazuh, Security Onion,
Elastic Security and others, including where it is weaker ·
roadmap
Signalith is a personal project by Samuel Sanchez Jr., written with Claude Code, and
it is early software: it has not had an independent security audit yet, and the
Windows installer is not code signed yet. Issues and feedback are welcome.
Release GPG key fingerprint: 58F0 AF4F 674A 5391 431C 1D5F 580C B767 9DAF 957A
(how to check a download).
What's inside
Signalith stores events in OpenSearch (2.17 or newer, 3.x
included) and collects them with the Signalith Agent, which
installs and runs Fluent Bit and osquery on
Windows, Linux and macOS, and with syslog, OpenTelemetry and cloud connectors. On top it
adds a pipe-based query language, plain-English questions that become queries, a visual
query builder, CIM-style data models, scheduled detections with a findings queue, Sigma
rule import, an ATT&CK coverage map, risk-based alerting with asset and identity context,
threat intel feeds, dashboards, investigation cases, response actions and playbooks.
The server is a single Go binary with the web UI embedded. It runs as a Windows service,
a systemd unit or a container.
Status: working toward 1.0. Until then the work goes into correctness, upkeep and proof
rather than new features; the roadmap has the 1.0
checklist.
Quick start
It needs Docker Compose 2.20 or newer (Docker Desktop has it). Get the code and start it:
git clone https://github.com/jrsamsanchez/Signalith.git
cd Signalith
docker compose -f deploy/docker/docker-compose.yml up -d
docker compose -f deploy/docker/docker-compose.yml exec signalith signalith initial-password
The last command shows the admin password. Open https://localhost:9000 and sign in as
signalithadmin; you then choose your own password. The browser warns about the
certificate until you trust it (how).
Then open Add data to install the agent on your computers, or load the sample data.
Docker quick start covers ports, updates, running a
release and upgrading an older quick start.
Documentation
Building
Requires the Go version in go.mod or newer:
go build -o signalith ./cmd/signalith
CONTRIBUTING.md has the tests, code style and how to send changes;
GOVERNANCE.md says who maintains the project.
License
Apache 2.0. See NOTICE for third-party data.
Trademarks
Signalith is an independent open-source project. It is not affiliated with,
endorsed by or sponsored by Splunk or Cisco, and contains no Splunk software code.
Its optional Splunk Security Content pack ships detection rules from Splunk's open
source security_content project under the Apache License 2.0 (see NOTICE).
Splunk, Splunk Enterprise Security and SPL are trademarks or registered trademarks
of Splunk LLC, a Cisco company, in the United States and other countries; they are
named here only to describe the rules Signalith can run and its search syntax. OpenSearch, Fluent Bit,
Sigma and MITRE ATT&CK are trademarks of their respective owners.
