Skip to content
SPECIFICTION
Get listed

Vigil

vigil-siem.com

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit vigil-siem.com
Spec score 8.2 #10 of 29 in SIEM Software

What it is

Vigil is a self-hosted SIEM that collects endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs on Linux, macOS, and Windows, or as a self-hosted service, without requiring a cloud account. Its single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil includes 41 Sigma rules covering 10 MITRE ATT&CK tactics. Its HQL query language searches event history with aggregations, timelines, endpoint filters, time ranges, and field values. The CLI pauses destructive actions until a person approves them. Vigil Connect extracts selected fields and the untouched raw alert from alerts; it supports Wazuh and Elastic, with Splunk and Microsoft Sentinel listed as coming soon. The Claude Code integration uses npx @vigil/skill and needs no MCP server or running process. The Apache 2.0 open-source plan is free and includes unlimited events. Enterprise support includes a dedicated Slack channel, custom integrations and SLAs, and a SOC 2 report.

Spec sheet

Platforms
The agent is a dependency-free single binary for Windows, Linux, and macOS, and Vigil includes a web dashboard.Read 2 Oct 2026 · vigil-siem.com
Deployment
Vigil is self-hosted, open source, deployable in five minutes, and requires no cloud account.Read 2 Oct 2026 · vigil-siem.com
Integrations
The integration catalogue spans SIEM/log search, EDR/XDR, AWS/Azure/GCP, identity, threat intelligence, sandboxes, ticketing, chat, paging, network security, and data pipelines.Read 15 Oct 2026 · github.com
Support
Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report.Read 2 Oct 2026 · vigil-siem.com
License
The repository and pricing page identify the software as Apache License 2.0.Read 15 Oct 2026 · github.com
Agent collection
The single binary collects Windows Event Logs or Linux journald and ships batches every five seconds.Read 2 Oct 2026 · vigil-siem.com
AI-agent interface
Every command can return JSON, and named playbooks cover triage, investigation, hunting, and forensic sweeps.Read 15 Oct 2026 · vigil-siem.com
Backend technology
The public repository describes a Python FastAPI backend, a TypeScript agent layer, React frontend, PostgreSQL, Redis, and ClickHouse-related services.Read 15 Oct 2026 · github.com
Built-in rules
The homepage says Vigil ships 41 Sigma rules covering 10 MITRE ATT&CK tactics.Read 15 Oct 2026 · vigil-siem.com
Claude Code
The Claude Code integration is deployed with npx @vigil/skill and requires no MCP server or running process.Read 2 Oct 2026 · vigil-siem.com
Deployment model
The product is presented as self-hosted, open source, and usable without a cloud account.Read 15 Oct 2026 · vigil-siem.com
Desktop support
The desktop build produces a macOS DMG or Linux AppImage, but Docker must be installed and running.Read 15 Oct 2026 · github.com
Detection latency
The homepage advertises detection latency below 50 milliseconds.Read 15 Oct 2026 · vigil-siem.com
Detection library
Vigil ships with 41 Sigma rules across 10 MITRE ATT&CK tactics.Read 2 Oct 2026 · vigil-siem.com
Endpoint collection
The agent collects Windows Event Logs or Linux journald and sends batches every five seconds.Read 15 Oct 2026 · vigil-siem.com
Event hunting
HQL can query full event history with aggregations, timelines, endpoint filters, time ranges, and field values.Read 2 Oct 2026 · vigil-siem.com
Event ingestion
Events can be pushed from any source over HTTP, while the agent runs as a single static binary on Windows and Linux.Read 15 Oct 2026 · vigil-siem.com
Human approval
Destructive actions are blocked until a human explicitly approves them through the CLI or web interface.Read 15 Oct 2026 · vigil-siem.com
Independent feature report
The Devpost project reports an AI voice agent using ElevenLabs, an AI chatbot, and Mailgun email notifications.Read 15 Oct 2026 · devpost.com
Independent implementation details
The Devpost project used Next.js, Python FastAPI, SQLite, a middleware proxy, and Localtunnel for log delivery.Read 15 Oct 2026 · devpost.com
Independent limitation report
The Devpost team listed additional themes and customizable dashboards as future quality-of-life work.Read 15 Oct 2026 · devpost.com
Independent project description
A Devpost project named Vigil SIEM describes a local dashboard that parses logs from deployed websites.Read 15 Oct 2026 · devpost.com
LLM providers
The documented stack supports Anthropic, OpenAI, Google Vertex, and local Ollama models.Read 15 Oct 2026 · github.com
Maker founding year
LinkedIn lists DeepTempo as founded in 2023.Read 15 Oct 2026 · linkedin.com
Maker size
LinkedIn lists DeepTempo at 11–50 employees.Read 15 Oct 2026 · linkedin.com
Maker sponsorship
LinkedIn identifies DeepTempo as the sponsor of Vigil and describes DeepTempo as a privately held computer and network security company.Read 15 Oct 2026 · linkedin.com
MCP extensibility
Vigil exposes its SOC operations through an MCP server at /mcp and connects external tools through MCP integrations.Read 15 Oct 2026 · github.com
News: harness article
Vigil SOC published a blog article about its security harness on August 27, 2026.Read 15 Oct 2026 · vigilsoc.org
News: software factory
Vigil SOC published a September 14, 2026 article describing an agent-based software factory used to develop Vigil.Read 15 Oct 2026 · vigilsoc.org
Product purpose
Vigil ingests endpoint events, evaluates Sigma detections, and returns structured JSON for AI agents and humans.Read 15 Oct 2026 · vigil-siem.com
Public API
The repository documents a local API at port 6987 and interactive API documentation at /docs.Read 15 Oct 2026 · github.com
Rating on G2 (different product listing)
4.6 out of 5 from 4 reviews; the page identifies the product as VigilNow Salesforce integration monitoring rather than Vigil SIEM.Read 15 Oct 2026 · g2.com
Raw alert handling
Vigil Connect extracts only id, severity, source_siem, and the untouched raw alert JSON.Read 2 Oct 2026 · vigil-siem.com
Security onboarding
Vigil supports secure agent onboarding through short-lived enrollment tokens.Read 2 Oct 2026 · vigil-siem.com
Security policy
Vigil is pre-1.0; only the latest 0.x minor is supported and older 0.x minors receive no backported fixes.Read 15 Oct 2026 · github.com
Self-hosting methods
The repository documents Docker Compose, manual installation, Kubernetes Helm deployment, and a desktop package.Read 15 Oct 2026 · github.com
SIEM integrations
Vigil Connect supports Wazuh and Elastic now, while Splunk and Microsoft Sentinel integrations are listed as coming soon.Read 2 Oct 2026 · vigil-siem.com
Sigma detections
Every ingested event is evaluated against Sigma YAML rules before the HTTP response returns.Read 15 Oct 2026 · vigil-siem.com
Support bundle
The support script creates a redacted archive locally and uploads nothing automatically.Read 15 Oct 2026 · github.com
System requirements
The documented prerequisites are Docker, Node.js 20 or newer, and Git; system Python is not required because uv provisions the pinned interpreter.Read 15 Oct 2026 · github.com
Threat hunting
HQL supports historical event searches with filters, aggregations, timelines, endpoints, time ranges, and field values.Read 15 Oct 2026 · vigil-siem.com

Plans and prices

Open Source Free Forever Unlimited events · Sigma rules · HQL hunting · Multi-endpoint · Windows/Linux agents · Forensics · JSON output Read 15 Oct 2026 · vigil-siem.com
Cloud Priced on request Coming soon Managed ClickHouse/Postgres · Automatic updates · 99.9% uptime SLA · Web dashboard · Email/Slack alerts · API keys · SSO/SAML · Dedicated infrastructure Read 15 Oct 2026 · vigil-siem.com
Enterprise Priced on request Annual invoicing Dedicated infrastructure · SSO/SAML · Custom SLA · On-premise deployment · Custom detections · Dedicated Slack channel · SOC 2 report · Custom integrations Read 15 Oct 2026 · vigil-siem.com

Every Vigil plan and price →

Strong points and limits

Strong points

  • Free plan includes unlimited events.
  • 41 Sigma rules cover 10 ATT&CK tactics.
  • HQL searches full event history.
  • CLI requires approval for destructive actions.
  • No cloud account is required.

Limits

  • Splunk and Sentinel integrations are coming soon.
  • Cloud plan is listed as coming soon.
  • Enterprise pricing requires contacting the provider.

Who it suits

Vigil suits teams that want self-hosted endpoint detection and structured alert data for AI agents. Its free plan and HQL hunting tools may also fit users who need multi-endpoint event investigation.

Verdict

Vigil combines real-time Sigma detection with event hunting and safeguards for destructive actions. Its free self-hosted plan is clearly specified, though some integrations and the Cloud offering are not yet available.

Where Specifiction places it

Alternatives to VigilAll alternatives →