Hunters vs Vigil
Hunters
hunters.securityVigil
vigil-siem.comSide by side
| Figure | Hunters | Vigil |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 3 |
| Spec score · SIEM Software | 8.3 (#6) | 8.2 (#10) |
| Deployment | Hunters says its out-of-the-box SIEM can be deployed in days without professional services or ongoing SIEM management. | Vigil is self-hosted, open source, deployable in five minutes, and requires no cloud account. |
| Integrations | The integration catalog spans cloud infrastructure, email, endpoint and EDR, identity and access management, network security, threat intelligence, and workflow and response. | The integration catalogue spans SIEM/log search, EDR/XDR, AWS/Azure/GCP, identity, threat intelligence, sandboxes, ticketing, chat, paging, network security, and data pipelines. |
| Support | Team Axon offers rapid response to emerging threats, incident investigations, proactive threat hunting, and security posture reporting. | Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report. |
Plans
In their own words
Vigil
Vigil is a self-hosted SIEM that collects endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs on Linux, macOS, and Windows, or as a self-hosted service, without requiring a cloud account. Its single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil includes 41 Sigma rules covering 10 MITRE ATT&CK tactics. Its HQL query language searches event history with aggregations, timelines, endpoint filters, time ranges, and field values. The CLI pauses destructive actions until a person approves them. Vigil Connect extracts selected fields and the untouched raw alert from alerts; it supports Wazuh and Elastic, with Splunk and Microsoft Sentinel listed as coming soon. The Claude Code integration uses npx @vigil/skill and needs no MCP server or running process. The Apache 2.0 open-source plan is free and includes unlimited events. Enterprise support includes a dedicated Slack channel, custom integrations and SLAs, and a SOC 2 report.