2,600+ community detection rules, a lightweight Go ingestion pipeline, and dashboards that actually load fast — installed as real services (Windows service / Scheduled Task, or systemd on Linux), not a pile of scripts you have to remember to restart.
EasySIEM wires together the pieces of a real SIEM — log collection, storage, detection, and visualization — using SigmaHQ's open, vendor-neutral rule set instead of a proprietary rules language, and OpenSearch/Grafana instead of a SaaS bill.
Custom Go agents on Windows and Linux endpoints ship Event Log, Sysmon, journald, and auditd data over HTTPS to a small ingestion API, which authenticates each agent by its own API key and writes into OpenSearch. A detection engine converts SigmaHQ rules into OpenSearch queries with pySigma and runs them on a schedule, so hits show up as alerts — not just raw logs — in Grafana.
Everything server-side installs as a proper Windows service/Scheduled Task or a systemd unit on Linux, not a console window you have to keep open. And every component — the agents, the ingestion API, the TLS cert generator — is a plain Go binary calling documented OS APIs, which is also why it doesn't trip Windows Defender's heuristics the way a packed, obfuscated tool would. More on that below.
One ingestion path in, three consumers out: real-time detection, dashboards, and live log search.
Windows and Linux detection rules converted to real OpenSearch queries via pySigma — no hand-written detections to maintain.
Plain Go binaries calling documented OS APIs — no packing, no obfuscation, no process injection. Official signed tools (Sysmon, OpenSearch, Grafana) everywhere else.
ingest-api installs as a native Windows service (or systemd unit on Linux); the detect-engine runs as a Scheduled Task (or its own systemd unit). Nothing depends on a console window staying open.
An Overview dashboard with KPI gauges, plus dedicated Events, Alerts, and Agent Health views — provisioned automatically, not built by hand.
Every agent gets its own bearer API key over TLS. One compromised agent can't spoof another's identity — ingest-api stamps identity server-side.
One small Go codebase, cross-compiled for both platforms, shipping to the same ingestion pipeline with a shared event schema.
Add Loki and ingest-api dual-writes every event there as a raw log line — live-tail and LogQL-search in Grafana's Explore view, right alongside the dashboards.
Add Suricata and it runs Snort/Emerging-Threats-syntax rules against live traffic itself — its alerts land in the same Grafana Alerts dashboard as Sigma's host-based detections.
Two ways to get the server running — pick one.
Grab it from the Download section below.
It needs admin rights to register the ingest-api Windows service and the detect-engine's Scheduled Task.
The installer generates a TLS cert and a starter API key automatically, and writes both — plus next steps — to GETTING-STARTED.txt in the install directory.
http://localhost:3000 on the server itself — it opens straight to the Overview dashboard.
winget install -e --id GoLang.Go winget install -e --id Python.Python.3.12
.\scripts\install-opensearch.ps1
.\scripts\apply-index-templates.ps1
# from an elevated prompt:
.\scripts\install-grafana.ps1
go build -o bin\ingest-api.exe .\server\ingest
go build -o bin\gencert.exe .\tools\gencert
.\bin\gencert.exe -out-cert server\ingest\certs\server.crt -out-key server\ingest\certs\server.key -hosts localhost,127.0.0.1
# copy config.json.example to config.json, add an API key, then:
.\bin\ingest-api.exe -config server\ingest\config.json
git clone --depth 1 https://github.com/SigmaHQ/sigma.git rules\sigma cd server\detect python -m venv venv .\venv\Scripts\pip install sigma-cli pysigma-backend-opensearch pysigma-pipeline-sysmon requests .\venv\Scripts\python convert_rules.py .\venv\Scripts\python run_detections.py
go build -o bin\windows-agent.exe .\agents\windows
# or, for a Linux endpoint:
$env:GOOS="linux"; go build -o bin\linux-agent .\agents\linux
Full walkthrough — including Sysmon setup and agent config — is in docs/SETUP.md in the source download.
.exe —
ours included — will sometimes trigger a first-run SmartScreen prompt or a brief scan
delay. That's normal, and not something this project tries to evade: every component is
a plain binary calling documented APIs. See docs/DEFENDER.md in the source
download for exclusion commands and code-signing notes if you want to remove the prompt
entirely.
Prefer to run the backend on Linux instead of Windows? A .deb installs
ingest-api and the detect-engine as systemd services, running as a
dedicated unprivileged account rather than root. It does not include
OpenSearch, Grafana, or Loki — all three already have official Debian/Ubuntu packages,
so this doesn't try to duplicate them.
From their own official packages: OpenSearch for Debian and Grafana for Debian.
wget https://easysiem.com/downloads/easysiem-server_1.0.0_amd64.deb sudo apt install ./easysiem-server_1.0.0_amd64.deb
Generates a TLS cert and a starter API key, writes a working config, and starts
both services automatically — the key is printed at the end of the install (and
saved in /etc/easysiem-server/ingest-config.json).
sudo /usr/share/easysiem-server/apply-index-templates.sh
sudo grafana-cli plugins install grafana-opensearch-datasource
sudo cp /etc/easysiem-server/grafana-provisioning/datasources/opensearch.yml \
/etc/grafana/provisioning/datasources/
sudo cp -r /etc/easysiem-server/grafana-provisioning/dashboards/* \
/etc/grafana/provisioning/dashboards/
sudo systemctl restart grafana-server
Give it the printed API key, a copy of
/var/lib/easysiem-server/certs/server.crt, and
server_url: https://<this-host>:8443. See
Linux Agent below, or build the Windows agent from
source.
easysiem-server account,
not root — unlike the agent, neither service needs any special system access.
sudo apt remove easysiem-server keeps your config and data;
apt purge removes those and the dedicated account too. Full docs, including
how to add more agent keys: /usr/share/doc/easysiem-server/README.md.
127.0.0.1 only — it has no built-in auth), copy
/etc/easysiem-server/grafana-provisioning/datasources/loki.yml into
Grafana's provisioning, and add "loki_url": "http://localhost:3100" to
ingest-config.json. Full steps in the README.
A .deb package for Debian/Ubuntu boxes you want monitored. Ships
journald and auditd events to an EasySIEM server that's
already running — see Install above if you haven't set that up
yet.
wget https://easysiem.com/downloads/easysiem-agent_1.0.0_amd64.deb sudo apt install ./easysiem-agent_1.0.0_amd64.deb
Registers the systemd unit automatically. The agent does not start yet — it needs a real config first.
sudo cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json sudo nano /etc/easysiem/agent.json
Set server_url to your server's https://host:8443, and
api_key to a key generated on the server
(scripts\gen-api-key.ps1, or the starter key from its
GETTING-STARTED.txt).
Grab server.crt from
C:\Program Files\EasySIEM\server\ingest\certs\ on the server (however's
convenient — SFTP, a shared drive, pasting its contents) and place it at
/etc/easysiem/server.crt on this box, matching the
ca_cert_path already set in agent.json.example.
sudo systemctl enable --now easysiem-agent journalctl -u easysiem-agent -f
The second command tails its logs, so you can confirm it's actually shipping events.
/var/log/audit/audit.log (usually root:adm 0640) and the full
journald stream. The systemd unit has a commented-out User=/Group=
for running it as a dedicated account instead (needs adm +
systemd-journal group membership) — see SECURITY.md in the
package's /usr/share/doc/easysiem-agent/.
sudo apt remove easysiem-agent keeps your config; apt purge
removes it too.
ppa:oisf/suricata-stable on Ubuntu), point
it at your interface, run suricata-update for the free ET Open
ruleset, then set "suricata_eve_path": "/var/log/suricata/eve.json"
in agent.json — its alerts land in the same Grafana Alerts dashboard
as Sigma's. Full steps in the README.
Installs ingest-api as a Windows service and the detect-engine as a
Scheduled Task, with optional OpenSearch, Grafana, and Sysmon components. Requires
Administrator.
ingest-api + the detect-engine as systemd services (not OpenSearch/Grafana
— see Linux Server above). Runs as a dedicated
unprivileged account.
The Linux agent as a systemd service — ships journald and auditd events to an EasySIEM server. See Linux Agent above for setup.
⬇ Download .deb
Agents, ingest-api, the detect-engine, install scripts, and full docs
(SETUP.md, DEFENDER.md, SECURITY.md) — for
building agents yourself or customizing the server.