UTMStack vs Vigil
UTMStack
utmstack.comVigil
vigil-siem.comSide by side
| Figure | UTMStack | Vigil |
|---|---|---|
| Price from | $238.80/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 6 | 3 |
| Spec score · SIEM Software | 8.5 (#5) | 8.2 (#10) |
| Deployment | UTMStack can be deployed with an x86-64 ISO, an Ubuntu Linux installer, a dedicated cloud SaaS tenant, virtualized environments, physical servers, or public-cloud virtual machines. | Vigil is self-hosted, open source, deployable in five minutes, and requires no cloud account. |
| Integrations | The integrations catalog lists 33 built-in connectors covering operating systems, clouds, firewalls, endpoint security, VMware, databases, Suricata, GitHub and UTMStack health logs. | The integration catalogue spans SIEM/log search, EDR/XDR, AWS/Azure/GCP, identity, threat intelligence, sandboxes, ticketing, chat, paging, network security, and data pipelines. |
| Support | UTMStack advertises 24/7 customer service and technical support, while paid cloud tiers include premium support through tickets and chat. | Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report. |
| System requirements | UTMStack v11 recommends Ubuntu 24.04 LTS or a Red Hat-compatible distribution; a small deployment example uses 4 CPU cores, 16 GB RAM and 150 GB SSD. | The documented prerequisites are Docker, Node.js 20 or newer, and Git; system Python is not required because uv provisions the pinned interpreter. |
Plans
UTMStack
- UTMStack v11 Free TrialFree
- UTMStack v11 Essential$238.80 a month
- UTMStack v11 Standard$444 a month
- UTMStack v11 Premium$630 a month
- UTMStack v11 Advanced$1,140 a month
- UTMStack v11 Ultimate$1,908 a month
In their own words
UTMStack
UTMStack is an open-source unified threat management platform that combines SIEM and XDR. It provides log management and correlation, threat detection and response, threat intelligence, alert investigation, file classification, SOC AI-powered analysis, and compliance capabilities. Its modules include vulnerability management, access-rights auditing, automated incident response, endpoint protection, dark-web monitoring, and file tracking. The platform correlates data during ingestion before indexing to support real-time detection and reduce alert noise. Deployment options include an ISO, Ubuntu installer, cloud SaaS tenant, virtualized environments, physical servers, and public-cloud virtual machines. Its v11 guide is designed for Ubuntu 24.04 LTS and also notes Red Hat support. The free trial is free; Essential costs $238.80 a month, billed monthly, and supports 25–50 devices on average with 150 GB HOT storage. Deployments above 500 data sources or devices require secondary worker nodes for horizontal scaling.
Vigil
Vigil is a self-hosted SIEM that collects endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs on Linux, macOS, and Windows, or as a self-hosted service, without requiring a cloud account. Its single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil includes 41 Sigma rules covering 10 MITRE ATT&CK tactics. Its HQL query language searches event history with aggregations, timelines, endpoint filters, time ranges, and field values. The CLI pauses destructive actions until a person approves them. Vigil Connect extracts selected fields and the untouched raw alert from alerts; it supports Wazuh and Elastic, with Splunk and Microsoft Sentinel listed as coming soon. The Claude Code integration uses npx @vigil/skill and needs no MCP server or running process. The Apache 2.0 open-source plan is free and includes unlimited events. Enterprise support includes a dedicated Slack channel, custom integrations and SLAs, and a SOC 2 report.