Specifiction
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your tool
Vendor dashboard
Tech riderRev. 2 Oct 2026

Vigil

Ch 047.4of 26 SIEM Software
  1. 1Runs onAPI, Linux, Mac, self-hosted, Web, Windows
  2. 2CostsFree plan
  3. 3Custom detection rulesYes
  4. 4Real-time alertingYes
  5. 5Deploymentself-hosted
  6. 6Query languageHQL
6 lines stated Written from the maker's own pages: vigil-siem.com
Visit site Alternatives
The Vigil homepage

Overview

Vigil is ranked #4 of 26 in SIEM software on Specifiction. It runs on API, Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

Vigil plans and pricing

All plans
Open Source Free Free Unlimited events (ClickHouse) · Sigma detection rules · Threat hunting (HQL) · Multi-endpoint support · Windows & Linux agents · Forensic collection · JSON output for AI agents vigil-siem.com · 2 Oct 2026
Cloud Not published Coming soon Managed ClickHouse + Postgres · Automatic updates · 99.9% uptime SLA · Web dashboard · Email + Slack alerts · API key management · SSO / SAML · Dedicated infra vigil-siem.com · 2 Oct 2026
Enterprise Not published Contact us Dedicated infrastructure · SSO / SAML · Custom SLA · On-premise deployment · Custom detection development · Dedicated Slack channel · Annual invoicing · SOC 2 report · Custom integrations vigil-siem.com · 2 Oct 2026

Compared on SIEM software

Free plan
Yesvigil-siem.com
Custom detection rules
Yesvigil-siem.com
Real-time alerting
Yesvigil-siem.com
Deployment
self-hostedvigil-siem.com
Query language
HQLvigil-siem.com

Facts

Product purpose
Vigil ingests endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents.vigil-siem.com · 2 Oct 2026
License
Vigil is released under the Apache 2.0 license.vigil-siem.com · 2 Oct 2026
Detection library
Vigil ships with 41 Sigma rules across 10 MITRE ATT&CK tactics.vigil-siem.com · 2 Oct 2026
Event hunting
HQL can query full event history with aggregations, timelines, endpoint filters, time ranges, and field values.vigil-siem.com · 2 Oct 2026
Human approval
Destructive actions require explicit human approval, with the CLI blocking and polling until a response.vigil-siem.com · 2 Oct 2026
Agent collection
The single binary collects Windows Event Logs or Linux journald and ships batches every five seconds.vigil-siem.com · 2 Oct 2026
Platforms
The agent is a dependency-free single binary for Windows, Linux, and macOS, and Vigil includes a web dashboard.vigil-siem.com · 2 Oct 2026
Security onboarding
Vigil supports secure agent onboarding through short-lived enrollment tokens.vigil-siem.com · 2 Oct 2026
SIEM integrations
Vigil Connect supports Wazuh and Elastic now, while Splunk and Microsoft Sentinel integrations are listed as coming soon.vigil-siem.com · 2 Oct 2026
Raw alert handling
Vigil Connect extracts only id, severity, source_siem, and the untouched raw alert JSON.vigil-siem.com · 2 Oct 2026
Claude Code
The Claude Code integration is deployed with npx @vigil/skill and requires no MCP server or running process.vigil-siem.com · 2 Oct 2026
Support
Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report.vigil-siem.com · 2 Oct 2026

Best Vigil alternatives

See all 20
All accessCh 01 Blumira Free trialAPILinux from $3/mo7.9 All accessCh 02 Wazuh Free planFree trialAPI from $571/mo7.7 All accessCh 03 Elastic Security Free planFree trialAPI from $0.09/mo7.4 All accessCh 05 CrowdStrike Falcon Surface Free trialLinuxMac 7.3 All accessCh 06 ManageEngine Log360 Free trialAPILinux from $20.42/mo7.2 All accessCh 07 UTMStack Free trialAPILinux from $238.80/mo7.2

Where it ranks on Specifiction

Is Vigil yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Vigil

Sources