Panther vs Vigil
Panther
panther.comVigil
vigil-siem.comSide by side
| Figure | Panther | Vigil |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · SIEM Software | 8.0 (#12) | 8.2 (#10) |
| Deployment | Panther offers a managed cloud deployment and a deployment in the customer’s AWS environment using the customer’s Snowflake or Databricks account. | Vigil is self-hosted, open source, deployable in five minutes, and requires no cloud account. |
| Integrations | Panther lists integrations for log sources, alert destinations, enrichment, data lakes, cloud resources, and MCP servers. | The integration catalogue spans SIEM/log search, EDR/XDR, AWS/Azure/GCP, identity, threat intelligence, sandboxes, ticketing, chat, paging, network security, and data pipelines. |
| Support | Panther offers technical support 20 hours a day, five days a week, and 24/7 on-call emergency support for customers. | Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report. |
Plans
In their own words
Panther
Panther is an AI SOC platform for security teams that ingests and normalizes security logs, detects threats, and supports alert investigation and response. Panther AI can query a data lake, review detection logic and alert history, gather context from connected tools, resolve noisy alerts, and escalate high-confidence threats. Its AI Detection Builder turns plain-language threat descriptions into Python detections. Teams can write, test, and version custom rules through CI/CD and GitHub code review, using PantherFlow and SQL. Snowflake or Databricks can serve as the security data lake while data remains in the customer’s warehouse. Integrations include AWS CloudTrail, Okta, GitHub, Slack, CrowdStrike, Databricks, and PagerDuty; MCP connections include Slack, PagerDuty, Notion, GitHub, and Atlassian. Deployment is available as managed SaaS or Cloud Connected. Panther provides a REST API and states that data is isolated in dedicated instances with 99.9% SLA-backed uptime.
Vigil
Vigil is a self-hosted SIEM that collects endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs on Linux, macOS, and Windows, or as a self-hosted service, without requiring a cloud account. Its single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil includes 41 Sigma rules covering 10 MITRE ATT&CK tactics. Its HQL query language searches event history with aggregations, timelines, endpoint filters, time ranges, and field values. The CLI pauses destructive actions until a person approves them. Vigil Connect extracts selected fields and the untouched raw alert from alerts; it supports Wazuh and Elastic, with Splunk and Microsoft Sentinel listed as coming soon. The Claude Code integration uses npx @vigil/skill and needs no MCP server or running process. The Apache 2.0 open-source plan is free and includes unlimited events. Enterprise support includes a dedicated Slack channel, custom integrations and SLAs, and a SOC 2 report.