LogSentinel SIEM vs Vigil
LogSentinel SIEM
logsentinel.comVigil
vigil-siem.comSide by side
| Figure | LogSentinel SIEM | Vigil |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 3 |
| Spec score · SIEM Software | 7.8 (#13) | 8.2 (#10) |
| Deployment | The maker describes cloud and on-premises deployment options, including a zero-setup cloud SIEM and an open-source collector and agent. | Vigil is self-hosted, open source, deployable in five minutes, and requires no cloud account. |
| Integrations | Data sources include AWS, Microsoft Azure, Google Cloud Platform, Microsoft 365, Okta, Salesforce, Oracle, Microsoft SQL Server, and syslog sources. | The integration catalogue spans SIEM/log search, EDR/XDR, AWS/Azure/GCP, identity, threat intelligence, sandboxes, ticketing, chat, paging, network security, and data pipelines. |
| Support | Email and phone support are included in the license, according to the features page. | Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report. |
Plans
LogSentinel SIEM
- Enterprise SAASPriced on request
- On-Premise InstallationPriced on request
In their own words
LogSentinel SIEM
LogSentinel SIEM is a security monitoring system for mid-market organizations, available through web, API, Linux, Windows, and self-hosted deployments. It gathers logs centrally, aggregates and normalizes them, and supports custom connectors plus agentless collection. Detection combines rule correlation, machine-learning analysis, threat intelligence, threat hunting, and phishing detection. Incident tools cover investigation, triage, notifications, and automated response, with custom rules and real-time alerts. Sources include AWS, Microsoft Azure, Google Cloud Platform, Microsoft 365, Okta, Salesforce, Oracle, Microsoft SQL Server, and syslog. The collector also accepts REST APIs, text files, Windows logs, and database tables. Security features include log integrity, digital evidence, and end-to-end encryption. Compliance reports address GDPR, HIPAA, SOX, PCI-DSS, and PSD2. Cloud and on-premises options are offered, alongside MSSP use cases. Pricing is on request; a free plan and trial are listed.
Vigil
Vigil is a self-hosted SIEM that collects endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs on Linux, macOS, and Windows, or as a self-hosted service, without requiring a cloud account. Its single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil includes 41 Sigma rules covering 10 MITRE ATT&CK tactics. Its HQL query language searches event history with aggregations, timelines, endpoint filters, time ranges, and field values. The CLI pauses destructive actions until a person approves them. Vigil Connect extracts selected fields and the untouched raw alert from alerts; it supports Wazuh and Elastic, with Splunk and Microsoft Sentinel listed as coming soon. The Claude Code integration uses npx @vigil/skill and needs no MCP server or running process. The Apache 2.0 open-source plan is free and includes unlimited events. Enterprise support includes a dedicated Slack channel, custom integrations and SLAs, and a SOC 2 report.