Seceon Open Threat Management vs Vigil
Seceon Open Threat Management
seceon.comVigil
vigil-siem.comSide by side
| Figure | Seceon Open Threat Management | Vigil |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · SIEM Software | 6.8 (#20) | 8.2 (#10) |
| Integrations | Seceon lists integrations with firewalls, cloud services, endpoint tools, and ticketing platforms, including Fortinet, Palo Alto, AWS, Azure, CrowdStrike, ServiceNow, and Jira. | The integration catalogue spans SIEM/log search, EDR/XDR, AWS/Azure/GCP, identity, threat intelligence, sandboxes, ticketing, chat, paging, network security, and data pipelines. |
| Support | Seceon advertises 24/7 partner support with expert access for onboarding, configuration, and escalations. | Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report. |
Plans
Seceon Open Threat Management
- Seceon Open Threat ManagementPriced on request
In their own words
Seceon Open Threat Management
Seceon Open Threat Management has no write-up on Specifiction yet; its figures are above.
Vigil
Vigil is a self-hosted SIEM that collects endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs on Linux, macOS, and Windows, or as a self-hosted service, without requiring a cloud account. Its single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil includes 41 Sigma rules covering 10 MITRE ATT&CK tactics. Its HQL query language searches event history with aggregations, timelines, endpoint filters, time ranges, and field values. The CLI pauses destructive actions until a person approves them. Vigil Connect extracts selected fields and the untouched raw alert from alerts; it supports Wazuh and Elastic, with Splunk and Microsoft Sentinel listed as coming soon. The Claude Code integration uses npx @vigil/skill and needs no MCP server or running process. The Apache 2.0 open-source plan is free and includes unlimited events. Enterprise support includes a dedicated Slack channel, custom integrations and SLAs, and a SOC 2 report.