EasySIEM — a SIEM you run yourself for Windows and Linux

Why it's built this way

What you get

🧩

3,000+ SigmaHQ rules

Windows and Linux detection rules converted to real OpenSearch queries via pySigma — no hand-written detections to maintain.

🎯

MITRE ATT&CK mapped

SigmaHQ rules already carry ATT&CK technique/tactic tags — 88% of the compiled ruleset does — and they ride along onto every alert automatically, no extra setup. Suricata's own alerts get the same treatment if you enable metadata: yes in its eve-log config. Grafana's Alerts dashboard breaks detections down by both technique and tactic, each one deep-linking to our own ATT&CK reference page for it.

🛡️

Defender-friendly by design

Plain Go binaries calling documented OS APIs — no packing, no obfuscation, no process injection. Official signed tools (Sysmon, OpenSearch, Grafana) everywhere else.

⚙️

Real services, not scripts

ingest-api installs as a native Windows service (or systemd unit on Linux); the detect-engine runs as a Scheduled Task (or its own systemd unit). Nothing depends on a console window staying open.

📊

Dashboards that load

An Overview dashboard with KPI gauges, plus dedicated Events, Alerts, and Agent Health views — provisioned automatically, not built by hand.

🖥️

EasySIEM Console (experimental)

An optional, separate web dashboard — its own login, its own port (8444) — for a faster daily check-in than opening Grafana: live KPIs, a paginated alert feed with search/source filtering, a live firewall-block feed with real IPs alongside per-platform stats, an ATT&CK technique breakdown, and an Agent Keys page to provision a new agent's API key (and download the CA certificate it needs) without a terminal. Almost entirely read-only against the same OpenSearch cluster — still no agent commands. Checked by default in both server installers — see Using the Console below.

📦

Software inventory, per agent

Windows and Linux agents report their OS patch level and every installed program/package on their own hourly schedule — separate from (and much coarser than) the usual 30-second heartbeat, since re-walking a box's whole package list every heartbeat would be pure waste for data that's realistically static between reboots. Windows reads it straight from the registry, the same place Add/Remove Programs itself does; Linux shells out to dpkg-query. Browse and search it per agent from the Console's Agent Health page — no terminal, no separate asset-inventory tool.

🤖

AI Security Review

An on-demand Console page hands Claude a digest of your own data — recent alerts, ipsum-flagged firewall blocks, every agent's OS patch level and full installed-software list, server health — and asks it to call out real threats and misconfigurations, checking actual package versions and OS builds against its own knowledge of CVEs and vendor end-of-support dates rather than just noting they exist. Pick how far back to look (1 hour to 7 days). Bring your own Anthropic API key — paste it right on the page, with a link and step-by-step instructions for getting one right there too. Nothing runs on a schedule; every analysis is a deliberate click, and each one is a single API call you control.

⛔

Firewall Blocks dashboard

One dashboard normalizes blocked-traffic telemetry from every platform this project collects it from onto a shared action:"block" field: OPNsense's pf filterlog and OpenWRT's fw4/nftables logs out of the box, generic Linux's iptables/nftables LOG rules, and Windows Filtering Platform block events — the last two are opt-in, see the install checkboxes below.

🕵️

Lateral movement hunting

Click through from any alert or event row to a dedicated dashboard tracing that host, account, or IP across every other host it touched — logon history, process activity, network connections, other alerts, all in one place. detect-engine also cross-correlates automatically: a host tripping both a Sigma and a Suricata detection within 15 minutes of each other gets its own critical-level alert, no rule-writing required.

🚩

IP reputation checking

Every alert's source and destination IP is checked against ipsum, an aggregated blocklist built from dozens of honeypots and threat feeds — the local copy refreshes automatically once a day, nothing to maintain. A hit flags the alert and highlights its entire row in red on the Alerts, Lateral Movement, and Overview dashboards, so known-bad activity stands out without having to go IP-hunting yourself.

🔔

Alerting, provisioned

Three Grafana alert rules ship out of the box, split by severity (critical/high, medium, low/informational) — firing detections show up under Alerting > Active notifications with zero setup; wire in email/Slack/webhook delivery whenever you're ready.

🔑

Per-agent authentication

Every agent gets its own bearer API key over TLS. One compromised agent can't spoof another's identity — ingest-api stamps identity server-side.

🐧

Windows + Linux agents

One small Go codebase, cross-compiled for both platforms, shipping to the same ingestion pipeline with a shared event schema.

🔍

Live log search (optional)

Add Loki and ingest-api dual-writes every event there as a raw log line — live-tail and LogQL-search in Grafana's Explore view, right alongside the dashboards.

📡

Network detection (optional)

Add Suricata and it runs Snort/Emerging-Threats-syntax rules against live traffic itself — its alerts land in the same Grafana Alerts dashboard as Sigma's host-based detections.

📈

Server health (optional)

Add Prometheus + windows_exporter (or node_exporter on Linux) and a provisioned "Server Health" dashboard shows the SIEM box's own CPU, memory, disk, and network — is the SIEM itself healthy, not just what it's watching.

🔗

Request tracing (optional)

Add Tempo and ingest-api (instrumented with OpenTelemetry) emits a span per event batch — HTTP handling plus the OpenSearch/Loki calls it makes — browsable in Grafana's Explore > Traces.

🧱

OPNsense agent

A FreeBSD pkg(8) package ships pf firewall filter log and Suricata alerts to the same pipeline — verified end-to-end against a real OPNsense box.

📶

OpenWRT agent

An opkg package (arm64/mipsle/arm) or apk package (x86_64) ships OpenWRT's logread system log and Suricata alerts. The apk/x86_64 build's verified end-to-end against a real running OpenWRT 25.12.5 instance; the opkg builds are still unit-tested only, not yet verified against real router hardware.

Using the Console

A faster daily check-in than opening Grafana

The Console is the optional read-only dashboard on port 8444 — checked by default in both server installers. It's not a replacement for Grafana (every "Raw event"/ "Lateral movement" link on an alert still opens the real drill-down dashboard there), just a lighter first stop for the things you check most.

EasySIEM Console's Overview page: an Alerts (24h) gauge at 13,233 and Critical/High at 1,293, both in red, an Active Agents gauge at 4 in green, and an Events Ingested gauge at 26,208 in blue, above a paginated Most Recent Alerts feed with severity/source badges and Raw event/Lateral links per row, alongside an IP Reputation panel, a Firewall Blocks summary, and a Server Health summary in the right rail

Log in

Open https://<this box>:8444 — your browser will warn about the self-signed cert once, same as Grafana. Username is admin; the password is printed in GETTING-STARTED.txt on Windows (in the install directory) or at the end of the interactive installer on Linux — shared automatically with Grafana's own login if you installed both.

Overview

The default landing page: four KPI gauges (Alerts, Critical/High, Active Agents, Events Ingested), a paginated "Most Recent Alerts" feed with severity filtering and search, an IP-reputation panel for anything ipsum-flagged, and a Server Health summary.

Alerts

The full 24h alert feed, paginated 100 at a time and filterable by detection source (Sigma/Suricata/Correlated) or free-text search across rule title, host, and agent ID — all server-side, so search and paging actually reach every alert, not just whatever loaded first.

Firewall Blocks

Total/unique-IP/top-protocol stats and a per-platform breakdown (OPNsense, OpenWRT, Linux, Windows), plus a live "Recent Blocks" table underneath with the actual source/destination IPs, ports, protocol, and interface behind those numbers. Click a platform's own bar in the breakdown to filter the table to it.

Agent Health, Agent Keys, Server Health, ATT&CK Reference

A live roster of every agent reporting in — including its OS patch level and a searchable list of every installed program/package, reported on its own hourly schedule so it's real without hammering the endpoint (Windows: the registry, the same place Add/Remove Programs itself reads; Linux: dpkg-query); a page to provision a new agent's API key (and download this server's CA certificate) without a terminal; this box's own CPU/memory/disk/network, if Prometheus is installed; and a breakdown of ATT&CK techniques seen in the last 24h, each linking to our own reference pages.

AI Security Review

Paste your own Anthropic API key (a link and step-by-step instructions for getting one are right on the page), pick how far back to look — 1 hour up to 7 days — and click Run Analysis. Claude reviews a digest of your recent alerts, ipsum-flagged firewall blocks, every agent's patch level and full installed-software list, and server health, then reports back real threats and misconfigurations, each with a severity, a recommendation, and what in your own data backs it up. Nothing runs automatically; every analysis is a deliberate click and a single API call you control.

Change your password

"Change password" in the top bar asks for your current password, then can optionally update Grafana's admin password to match at the same time (its own checkbox on that form), so the two logins don't quietly drift apart just because you changed one of them here.

Forgot the password entirely?

On Windows: stop the EasySiemConsole service, run bin\console.exe -hash-password <new password>, paste the printed hash into console_password_hash in server\console\config.json, then start the service back up. On Linux: sudo systemctl stop easysiem-console, the same -hash-password flag against /etc/easysiem-server/console-config.json, then sudo systemctl start easysiem-console. Neither step needs the old password — it's a direct overwrite, not a reset flow that emails you a link.

Get running

Installation

Two ways to get the server running — pick one.

Download EasySiemSetup.exe

Grab it from the Download section below.

Run it as Administrator

It needs admin rights to register the ingest-api Windows service and the detect-engine's Scheduled Task.

Pick your optional components

OpenSearch — downloads ~450 MB from opensearch.org, skipped if already installed
Grafana — installs with the provisioned dashboards and alert rules already wired up, and a self-signed cert enabling HTTPS out of the box (your browser will warn once); you'll be asked for an admin username and/or password instead of the default admin/admin — the same login is shared with the Console below if you install both
Loki — optional, for live log search/LogQL in Grafana's Explore view alongside the dashboards
Prometheus — installs Prometheus + windows_exporter together, already scraping and wired to the provisioned Server Health dashboard (CPU/memory/disk/network for this box)
Tempo — request tracing for ingest-api (instrumented with OpenTelemetry); tempo_url is wired into config.json automatically, browsable in Grafana's Explore > Traces
EasySIEM Console (experimental) — an optional, separate read-only web dashboard on port 8444; shares the same admin login as Grafana above (leave both blank to have a strong password generated for both, printed to GETTING-STARTED.txt), checked by default — see Using the Console below for a tour
Sysmon — only if this same box is also a monitored endpoint
Suricata — network IDS, runs Snort/ET-syntax rules against live traffic; only if this box is also a monitored endpoint. Needs one manual click-through for Npcap (its free edition has no silent installer) — a setup window will appear
windows-agent — installs and fully configures the agent on this same box for self-monitoring, wired to the starter API key (and Suricata's eve.json too, if that's also checked) — no manual agent.json editing
Open Windows Firewall — TCP 8443 for ingest-api.exe only; needed for agents on other machines to reach this server (not needed for the windows-agent checkbox above, which talks to itself over localhost)
Enable Windows Firewall block auditing — turns on the "Filtering Platform Packet Drop"/"Filtering Platform Connection" audit subcategories so this machine's blocked traffic shows up on the "SIEM: Firewall Blocks" dashboard; only useful alongside the windows-agent checkbox above, checked by default, needs a reboot to take effect, and can be noisy on an internet-facing box since every blocked packet ships with no per-rule filter

Grab your API key

The installer generates a TLS cert and a starter API key automatically, and writes both — plus next steps — to GETTING-STARTED.txt in the install directory. For more keys later, the installer also drops genkey.exe at C:\Program Files\EasySIEM\bin\genkey.exe — see the callout below.

Open Grafana

https://localhost:3000 on the server itself — it opens straight to the Overview dashboard.

Need a key for another agent later? One line, on the server. Run PowerShell as Administrator first — it writes into Program Files and restarts a Windows service, both of which need elevation; without it you'll get an access-denied error. (The & and quotes are separately required whenever a PowerShell path has a space, like Program Files here — without them it misreads C:\Program as the command and everything after as arguments.)

& "C:\Program Files\EasySIEM\bin\genkey.exe" -agent-id windows-02 -os windows -restart

Generates the key, wires it into config.json's api_keys directly, and restarts EasySiemIngestApi so it's live — no manual JSON editing. Swap -os windows for -os linux when the new agent is a Linux box instead; genkey just records it for the Agent Health dashboard. -agent-id can be whatever you want — any string, no format restrictions.

Deploying agents from other machines? Check the "Open Windows Firewall" box in step 3 above — unchecked by default, since opening an inbound port is a real choice, not something to enable silently. Skip it if every agent runs on the server box itself (the "monitor this box too" checkbox); only remote agents need it. It scopes the rule to exactly ingest-api.exe on exactly TCP 8443, nothing broader.

Already installed without checking that box? Windows Firewall ships with inbound rules for ingest-api.exe from earlier builds already, but they're scoped to specific binary paths, not wherever your install actually landed, so add one yourself:

New-NetFirewallRule -DisplayName "EasySIEM ingest-api" -Direction Inbound `
    -Program "C:\Program Files\EasySIEM\bin\ingest-api.exe" -Protocol TCP `
    -LocalPort 8443 -Action Allow -Profile Any

Run that in an elevated PowerShell prompt on the server (adjust the path if you installed somewhere other than the default). Confirm it worked from another machine on the network: curl -k https://<server-hostname>:8443/v1/health should return ok almost instantly; if it hangs for several seconds and then fails, that's the firewall.

Uninstalling? Just re-run EasySiemSetup.exe — it detects the existing install and asks: Yes to repair/reinstall (your config, API key(s), and TLS certificate are kept), No to uninstall, or Cancel to leave everything alone. Choosing No hands off to the real uninstaller, which stops and removes the EasySiemIngestApi service, every Scheduled Task this installer registered (detect-engine, and Loki/Prometheus/Tempo/ Suricata/windows-agent if you installed them), the firewall rule if you opened one, and OpenSearch/Grafana/Sysmon (service and driver included, for Sysmon) if you installed those. (The ordinary Windows way works too — Settings > Apps, or the "Uninstall EasySIEM" shortcut in the Start Menu group — it's the exact same uninstaller either way.)

Prerequisites

winget install -e --id GoLang.Go
winget install -e --id Python.Python.3.12

Install OpenSearch and Grafana

.\scripts\install-opensearch.ps1
.\scripts\apply-index-templates.ps1
# from an elevated prompt:
.\scripts\install-grafana.ps1

Build and run ingest-api

go build -o bin\ingest-api.exe .\server\ingest
go build -o bin\gencert.exe .\tools\gencert
.\bin\gencert.exe -out-cert server\ingest\certs\server.crt -out-key server\ingest\certs\server.key -hosts localhost,127.0.0.1
# copy config.json.example to config.json, add an API key, then:
.\bin\ingest-api.exe -config server\ingest\config.json

Convert Sigma rules and run detections

git clone --depth 1 https://github.com/SigmaHQ/sigma.git rules\sigma
cd server\detect
python -m venv venv
.\venv\Scripts\pip install sigma-cli pysigma-backend-opensearch pysigma-pipeline-sysmon requests
.\venv\Scripts\python convert_rules.py
.\venv\Scripts\python run_detections.py

Build and deploy an agent

go build -o bin\windows-agent.exe .\agents\windows
# or, for a Linux endpoint:
$env:GOOS="linux"; go build -o bin\linux-agent .\agents\linux

Full walkthrough — including Sysmon setup and agent config — is in docs/SETUP.md in the source download. Prefer a wizard over hand-editing agent.json? See Windows Agent / Linux Agent below for the dedicated installers instead.

A note on Windows Defender: a brand-new, unsigned .exe — ours included — will sometimes trigger a first-run SmartScreen prompt or a brief scan delay. That's normal, and not something this project tries to evade: every component is a plain binary calling documented APIs. See docs/DEFENDER.md in the source download for exclusion commands and code-signing notes if you want to remove the prompt entirely.

For endpoints

Windows Agent

A standalone installer for Windows boxes you want monitored — separate from the server installer above, and separate from its "monitor this box too" checkbox (that one's for the server machine itself; this one's for deploying to other Windows endpoints). Asks for the server hostname and API key right in the wizard.

Download and run as Administrator

Grab it from the Download section below.

Enter your server's hostname and API key

Need a key? Two ways to get one — both run on the server, not this machine:

Already have a server running? It printed a starter key when installed, saved to GETTING-STARTED.txt (Windows) or ~/easysiem-getting-started.txt (Linux) — grab it from there if that key isn't already used by another agent.

Or generate a fresh one (works any time, for any number of agents). If the server's on Windows, run PowerShell as Administrator first — it writes into Program Files and restarts a Windows service, both of which need elevation. (The & and quotes are separately required whenever a PowerShell path has a space, like Program Files here.)

Windows server:

& "C:\Program Files\EasySIEM\bin\genkey.exe" -agent-id windows-02 -os windows -restart

Linux server:

sudo easysiem-genkey -agent-id windows-02 -os windows -restart

Prints the new key, wires it into the server's config, and restarts the ingest service so it's live — one line, nothing else to do. -agent-id can be whatever you want (any string, no format restrictions) — the wizard's own default is this machine's computer name, so match that if you'd rather not think of one.

Browse to the server's certificate (recommended)

Copy server.crt from the server's C:\Program Files\EasySIEM\server\ingest\certs\ to this machine first, then browse to it in the wizard. Leave it blank instead to skip TLS verification — fine for a quick lab test, not for anything beyond one.

Optionally install Sysmon too

A checkbox on the same page — recommended, since windows-agent needs it for process/network telemetry beyond the Security/System/PowerShell logs alone.

Optionally enable Windows Firewall block auditing

Another checkbox on the same page — turns on the audit subcategories this box's blocked traffic needs to show up on the "SIEM: Firewall Blocks" dashboard. Off by default, needs a reboot to take effect, and can be noisy on an internet-facing box.

That's it — finishing the wizard writes agent.json, copies the certificate, and registers windows-agent.exe as a Scheduled Task (EasySiemWindowsAgent, runs at startup as SYSTEM — also what lets it read the Security event log). Re-run the installer to reconnect this box to a different server or change its key.

Agent won't connect? Check the server's Windows Firewall first — see the firewall note under Install above. It's the most common reason a freshly-installed agent just sits there retrying.

For Linux hosts

Linux Server

Prefer to run the backend on Linux instead of Windows? One guided script installs ingest-api, the detect-engine, and the EasySIEM Console (all running as a dedicated unprivileged account rather than root), then walks you through each optional piece one at a time — OpenSearch, Grafana, Loki, Prometheus, Tempo — and finally asks whether to install the agent on this same box too, so it monitors itself. The Console shares its login with Grafana automatically if you install both.

Download and run the installer

curl -fsSL -O https://easysiem.com/install.sh
chmod +x install.sh
sudo ./install.sh

Asks before installing anything optional — say no to any piece you don't want, or already have running your own way. Safe to re-run any time; every step, including this script itself, checks what's already done first. Ends with a summary (API key, Console/Grafana URLs and login, next steps) printed and saved to ~/easysiem-getting-started.txt.

Connect another agent

The installer already connects this box's own agent if you said yes to that step. For a different machine: give it the API key from the summary above, a copy of /var/lib/easysiem-server/certs/server.crt, and server_url: https://<this-host>:8443. See Linux Agent below, or build the Windows agent from source. Need a fresh key later? sudo easysiem-genkey -agent-id linux-02 -os linux -restart — one line, already installed by the server package. Swap -os linux for -os windows when the new agent is a Windows box instead — -os just records it for the Agent Health dashboard. -agent-id can be whatever you want — any string, no format restrictions. Prefer a UI over SSH? If you installed the Console (optional, on port 8444 — see Using the Console), its Agent Keys page does the same thing — enter an agent ID, click Generate, copy the key — plus a ⬇ Download server.crt button so you don't need /var/lib/easysiem-server/certs/server.crt's path above at all.

Prefer full manual control, one piece at a time? The installer just calls the same idempotent scripts it ships at /usr/share/easysiem-server/install-*.sh — run install-opensearch.sh or install-grafana.sh directly instead (Loki/Prometheus/Tempo have their own callouts below). Full docs for each, including what they fix that a plain apt install wouldn't: /usr/share/doc/easysiem-server/README.md, once the server package is installed.

Runs as a dedicated unprivileged easysiem-server account, not root — unlike the agent, neither service needs any special system access. sudo apt remove easysiem-server keeps your config and data; apt purge removes those and the dedicated account too. Full docs, including how to add more agent keys: /usr/share/doc/easysiem-server/README.md.

Uninstalling everything at once? One script removes the server, and optionally OpenSearch/Grafana/Loki/Prometheus/Tempo too — instead of working through apt purge one piece at a time:

curl -fsSL -O https://easysiem.com/uninstall.sh
chmod +x uninstall.sh
sudo ./uninstall.sh

Only asks about a piece if it's actually installed; removing the third-party backends defaults to no and says so — those hold real data.

Want live log search too? sudo /usr/share/easysiem-server/install-loki.sh — installs Loki from its official apt repo, binds it to 127.0.0.1 only (it has no built-in auth), wires the Grafana datasource in, and points ingest-config.json at it. Safe to re-run any time.

Want the Server Health dashboard too? sudo /usr/share/easysiem-server/install-prometheus.sh — installs Prometheus + node_exporter from Debian/Ubuntu's own repos, binds both to 127.0.0.1 only (neither does by default), and wires the Grafana datasource in. Safe to re-run any time.

Want request tracing too? sudo /usr/share/easysiem-server/install-tempo.sh — installs Tempo from the same Grafana apt repo as Loki, works around a real bug in its stock Debian config that otherwise crash-loops the service, binds it to 127.0.0.1 only, and wires up both the Grafana datasource and ingest-config.json's tempo_url — traces show up in Explore > Traces. Safe to re-run any time.

For endpoints

Linux Agent

A .deb package for Debian/Ubuntu boxes you want monitored. Ships journald and auditd events to an EasySIEM server that's already running — see Install above if you haven't set that up yet.

Download and run the installer — it asks three questions

curl -fsSL -O https://easysiem.com/agent-install.sh
chmod +x agent-install.sh
sudo ./agent-install.sh

Asks for the server hostname or IP and the API key (from the server's easysiem-getting-started.txt, or generated fresh with easysiem-genkey on the server) — then fetches the server's TLS certificate automatically and shows its SHA256 fingerprint for you to confirm against the one the server printed at its own install time (also saved to server.crt.fingerprint right next to server.crt there, if you don't have that output anymore). Confirming it is what makes the automatic fetch trustworthy — without that one check, whoever's on the network path during the fetch could hand you a certificate of their own instead. Say no (or if the fetch fails — server unreachable, or an older server without this endpoint) and it falls back to asking for a local path instead, same as before. Writes the config and starts easysiem-agent itself — nothing left to do by hand. Safe to re-run any time; it asks before overwriting an existing config.

Confirm it's running

sudo systemctl status easysiem-agent
journalctl -u easysiem-agent -f

Need an API key? Run this on the server (not this agent box) — one line:

sudo easysiem-genkey -agent-id linux-02 -os linux -restart

Generates the key, wires it into config.json's api_keys directly, and restarts easysiem-ingest so it's live — no manual JSON editing. -agent-id can be whatever you want — any string, no format restrictions; linux-02 above is just an example, not a required name. Swap -os linux for -os windows if the agent you're installing is actually on Windows instead — genkey just records it for the Agent Health dashboard, it doesn't affect the key itself.

Prefer a UI over SSH? If you installed the Console (optional, on port 8444 on the server — see Using the Console), its Agent Keys page does the exact same thing without a terminal: enter an agent ID, click Generate, and copy the key it shows you — it's only ever displayed once, so paste it into agent.json (or this installer's prompt) right away. Same page has the ⬇ Download server.crt button mentioned below, too.

Automatic fetch declined or unavailable, and want server.crt on this box some other way? The Console's Agent Keys page has a ⬇ Download server.crt button — that saves it to whatever machine your browser is running on, which usually isn't this agent box itself. Copy it over with scp (built into every Linux/macOS terminal, and Windows 10/11's PowerShell too):

scp path\to\server.crt user@this-agent-box:/tmp/server.crt

Run that from wherever the file actually landed (e.g. your Downloads folder), swapping in this agent box's real SSH username/host. Then point the installer's manual-path prompt (or ca_cert_path in agent.json if configuring by hand) at /tmp/server.crt — or wherever you copied it to.

Prefer the raw .deb, or scripting an unattended install? sudo apt install ./easysiem-agent_1.0.0_amd64.deb still works directly — it uses debconf for the same three questions, though which frontend actually prompts you depends on your terminal (falls back to installed-but-unconfigured if none can). Configure by hand afterward: sudo cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json, edit it, then sudo systemctl enable --now easysiem-agent — or sudo dpkg-reconfigure easysiem-agent to retry debconf's prompts (remove /etc/easysiem/agent.json first; it won't overwrite an existing one on its own).

Agent won't connect? If the server is Windows, check its Windows Firewall first — see the firewall note under Install above. Journal it with journalctl -u easysiem-agent -f; a connection that hangs for several seconds and then times out (rather than failing instantly, or an immediate 401) points at the firewall specifically, not a bad hostname or key.

Runs as root by default — it needs read access to /var/log/audit/audit.log (usually root:adm 0640) and the full journald stream. The systemd unit has a commented-out User=/Group= for running it as a dedicated account instead (needs adm + systemd-journal group membership) — see SECURITY.md in the package's /usr/share/doc/easysiem-agent/.

Want network detection too? Install Suricata from its official Ubuntu PPA/Debian package (ppa:oisf/suricata-stable on Ubuntu), point it at your interface, run suricata-update for the free ET Open ruleset, then set "suricata_eve_path": "/var/log/suricata/eve.json" in agent.json — its alerts land in the same Grafana Alerts dashboard as Sigma's. Full steps in the README.

Uninstalling?

sudo apt remove easysiem-agent

Stops and disables the service automatically — its own preremove script handles that, no manual systemctl stop first. Keeps /etc/easysiem (your agent.json) and its resume state; sudo apt purge easysiem-agent instead removes those too, for a genuinely clean slate.

For endpoints

OPNsense Agent

A FreeBSD pkg(8) package for OPNsense firewalls. Ships the pf firewall filter log and, if the os-suricata plugin is installed, Suricata IDS/IPS alerts, to an EasySIEM server that's already running — see Install above if you haven't set that up yet.

Download and install

fetch https://easysiem.com/downloads/easysiem-opnsense-agent-1.0.0.txz
pkg add easysiem-opnsense-agent-1.0.0.txz

fetch is FreeBSD's built-in downloader (part of the base system, no install needed) — run both from the OPNsense console or an SSH session.

Configure

cp /usr/local/etc/easysiem/agent.json.example /usr/local/etc/easysiem/agent.json

Edit agent.json: server_url, an api_key (generate one with genkey on the server — see the callouts under Install above), agent_id (any string), and either ca_cert_path pointing at a copy of the server's server.crt or insecure_skip_verify: true for a quick lab test. Set filterlog_path if your OPNsense version keeps the pf log somewhere other than the default /var/log/filter/latest.log, and suricata_eve_path if the os-suricata plugin is installed.

Enable and start

sysrc easysiem_opnsense_enable=YES
service easysiem_opnsense start

Runs as root by default — reading the pf filter log (and Suricata's eve.json, if configured) needs it. See SECURITY.md in the package's docs.

Uninstalling?

pkg delete easysiem-opnsense-agent

That's it — the package's own scripts stop the service and clear rc.conf's easysiem_opnsense_enable flag automatically, no manual service ... stop step needed first. Leaves agent.json (your server_url/api_key), the resume state, and the log file in place — delete /usr/local/etc/easysiem/, /var/db/easysiem/, and /var/log/easysiem_opnsense.log yourself for a genuinely clean slate.

For endpoints

OpenWRT Agent

A package for OpenWRT routers, in whichever format your build uses. Ships the system log (logread — firewall drop/accept lines included, if firewall logging is enabled) and, if installed, Suricata IDS/IPS alerts, to an EasySIEM server that's already running — see Install above if you haven't set that up yet.

Check which package manager your router has

OpenWRT 24.x and later (including 25.x) replaced opkg with apk-tools — check which one you actually have before picking a package below:

opkg --version || apk --version

If you have opkg: check your architecture, then download and install —

opkg print-architecture

Match the output against one of the three .ipk builds below (generic aarch64/mipsel_24kc/arm_cortex-a7 — if none match, see the package README for building your own or using the raw binary directly).

wget https://easysiem.com/downloads/easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk
opkg install easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk

Most current OpenWRT builds' BusyBox wget handles HTTPS fine; if yours errors on the certificate, opkg install wget-ssl first, or download the file elsewhere and scp it over instead.

If you have apk instead (OpenWRT 24.x+, including 25.x's x86/64 target) — currently built for x86_64 only (VMs, PCs, x86 appliances; see the package README for building your own for an ARM/MIPS apk-based router):

wget https://easysiem.com/downloads/easysiem-openwrt-agent_1.0.0_x86_64.apk
apk add --allow-untrusted easysiem-openwrt-agent_1.0.0_x86_64.apk

--allow-untrusted is expected and fine here — it just means the package isn't signed by a key apk already trusts, same as any other locally-built package.

Configure

cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json

Edit agent.json: server_url, an api_key (generate one with genkey on the server — see the callouts under Install above), agent_id (any string), and either ca_cert_path pointing at a copy of the server's server.crt or insecure_skip_verify: true for a quick lab test. Set suricata_eve_path if you've installed Suricata via opkg yourself.

Enable and start

/etc/init.d/easysiem-openwrt-agent enable
/etc/init.d/easysiem-openwrt-agent start

Runs as root by default — logread and Suricata's eve.json (if configured) both need it. The static binary is roughly 6.5–7.9 MB depending on architecture — fine for most current routers (128 MB+ flash is common), worth checking df -h / first on anything older/smaller.

Uninstalling?

opkg remove easysiem-openwrt-agent

apk del easysiem-openwrt-agent

Either package's own script stops and disables the service automatically first, no manual /etc/init.d/easysiem-openwrt-agent stop step needed. Leaves /etc/easysiem (your agent.json and resume state) in place — rm -rf /etc/easysiem yourself for a genuinely clean slate.

Get it

Download

🪟

EasySiemSetup.exe

Windows installer · ~34 MB

Installs ingest-api as a Windows service and the detect-engine as a Scheduled Task, with optional OpenSearch, Grafana, and Sysmon components. Requires Administrator.

⬇ Download installer

🪟

EasySiemWindowsAgentSetup.exe

Windows installer · ~7.5 MB

Deploy the agent to other Windows endpoints — asks for the server hostname, API key, and certificate right in the wizard. See Windows Agent above. Requires Administrator.

⬇ Download installer

🐧

easysiem-server.deb

Debian/Ubuntu · amd64

ingest-api + the detect-engine as systemd services (not OpenSearch/Grafana — see Linux Server above). Runs as a dedicated unprivileged account.

⬇ Download .deb

🐧

easysiem-agent.deb

Debian/Ubuntu · amd64

The Linux agent as a systemd service — ships journald and auditd events to an EasySIEM server. See Linux Agent above for setup.

⬇ Download .deb

🧱

easysiem-opnsense-agent.txz

FreeBSD pkg(8) · amd64

The OPNsense agent as a FreeBSD package — ships pf firewall filter log and Suricata alerts. See OPNsense Agent above for setup.

⬇ Download .txz

📶

easysiem-openwrt-agent.ipk

OpenWRT opkg · 3 architectures · experimental

The OpenWRT agent as an opkg package — ships the system log (logread) and Suricata alerts. Pick the architecture matching your router (check opkg print-architecture if unsure). See OpenWRT Agent above for setup.

⬇ arm64 ⬇ mipsle ⬇ arm

📶

easysiem-openwrt-agent.apk

OpenWRT apk-tools · x86_64 · verified live

For OpenWRT 24.x+ (including 25.x), which replaced opkg with apk-tools — same agent, same features, different package format. Built for the x86/64 target (VMs, PCs, x86 appliances). Unlike the .ipk builds, this one's been installed, run, and uninstalled end-to-end against a real running OpenWRT 25.12.5 instance, with real logread events confirmed landing in OpenSearch. See OpenWRT Agent above for setup.

⬇ x86_64

📦

Source code

.zip · full repo

Agents, ingest-api, the detect-engine, install scripts, and full docs (SETUP.md, DEFENDER.md, SECURITY.md) — for building agents yourself or customizing the server.

⬇ Download source

EasySIEM — a SIEM you run yourself, built on SigmaHQ, OpenSearch & Grafana

Detection rules you didn't have to write, running on infrastructure you actually control

Architecture

What you get

3,000+ SigmaHQ rules

MITRE ATT&CK mapped

Defender-friendly by design

Real services, not scripts

Dashboards that load

EasySIEM Console (experimental)

Software inventory, per agent

AI Security Review

Firewall Blocks dashboard

Lateral movement hunting

IP reputation checking

Alerting, provisioned

Per-agent authentication

Windows + Linux agents

Live log search (optional)

Network detection (optional)

Server health (optional)

Request tracing (optional)

OPNsense agent

OpenWRT agent

A faster daily check-in than opening Grafana

Log in

Overview

Alerts

Firewall Blocks

Agent Health, Agent Keys, Server Health, ATT&CK Reference

AI Security Review

Change your password

Forgot the password entirely?

System Requirements

Minimum

Recommended

Installation

Download EasySiemSetup.exe

Run it as Administrator

Pick your optional components

Grab your API key

Open Grafana

Prerequisites

Install OpenSearch and Grafana

Build and run ingest-api

Convert Sigma rules and run detections

Build and deploy an agent

Windows Agent

Download and run as Administrator

Enter your server's hostname and API key

Browse to the server's certificate (recommended)

Optionally install Sysmon too

Optionally enable Windows Firewall block auditing

Linux Server

Download and run the installer

Connect another agent

Linux Agent

Download and run the installer — it asks three questions

Confirm it's running

OPNsense Agent

Download and install

Configure

Enable and start

OpenWRT Agent

Check which package manager your router has

Configure

Enable and start

Download

EasySiemSetup.exe

EasySiemWindowsAgentSetup.exe

easysiem-server.deb

easysiem-agent.deb

easysiem-opnsense-agent.txz

easysiem-openwrt-agent.ipk

easysiem-openwrt-agent.apk

Source code