SEC (Simple Event Correlator)

Spec sheet

Purpose

SEC correlates event streams to detect and act on groups of events that occur within defined time windows.Read 7 Oct 2026 · simple-evcorr.github.io

Integrations

The documentation gives examples of invoking snmptrap and mail and shows an SSH failed-login rule that emails an alert.Read 7 Oct 2026 · simple-evcorr.github.io

Support

The maker directs usage questions to the SEC users mailing list and asks users not to contact the author with usage questions.Read 7 Oct 2026 · simple-evcorr.github.io

License

The project repository states that SEC is distributed under the GNU General Public License and identifies the license as GPL-2.0.Read 7 Oct 2026 · github.com

Founded

2001Read 28 Sep 2026 · simple-evcorr.github.io

Deployment limit

On Windows, some functionality native to Unix is disabled.Read 7 Oct 2026 · simple-evcorr.github.io

How it runs

SEC is a lightweight, platform-independent correlator that runs as a single process and can run as a daemon, in shell pipelines, or interactively in a terminal.Read 7 Oct 2026 · simple-evcorr.github.io

Inputs and matching

SEC reads lines from files, named pipes, or standard input and matches events using patterns such as regular expressions or Perl subroutines.Read 7 Oct 2026 · simple-evcorr.github.io

Outputs

SEC can execute external programs, write to files, send data to TCP or UDP servers, and call precompiled Perl subroutines.Read 7 Oct 2026 · simple-evcorr.github.io

Platform support

SEC has primarily been tested on Linux and Solaris, is known to work on Windows with some Unix-native functionality disabled, and is expected to work on modern Unix platforms.Read 7 Oct 2026 · simple-evcorr.github.io

Release

The site lists SEC 2.9.4 as a download dated February 12, 2026.Read 7 Oct 2026 · simple-evcorr.github.io

Requirements

SEC is written in Perl, recommends Perl 5.8 or newer, and otherwise depends only on modules included in standard Perl installations, with Sys::Syslog and JSON::PP optional.Read 7 Oct 2026 · simple-evcorr.github.io

Rules

Event correlation is configured with rule files, and the man page documents rule types including threshold, event group, suppression, calendar, and pair rules.Read 7 Oct 2026 · simple-evcorr.github.io

Security capabilities

The man page documents an option to drop root privileges by switching to a specified user and group when SEC starts with effective user ID 0.Read 7 Oct 2026 · simple-evcorr.github.io

Use cases

The site identifies event log monitoring, network and security management, and fraud detection as use cases.Read 7 Oct 2026 · simple-evcorr.github.io

Plans and prices

Every SEC (Simple Event Correlator) plan and price →

Where Specifiction places it

• Alert Management Software#24 of 367.5