2,600+ community detection rules, a lightweight Go ingestion pipeline, and dashboards that actually load fast — installed as real services (Windows service / Scheduled Task, or systemd on Linux), not a pile of scripts you have to remember to restart.
EasySIEM wires together the pieces of a real SIEM — log collection, storage, detection, and visualization — using SigmaHQ's open, vendor-neutral rule set instead of a proprietary rules language, and OpenSearch/Grafana instead of a SaaS bill.
Custom Go agents on Windows and Linux endpoints ship Event Log, Sysmon, journald, and auditd data over HTTPS to a small ingestion API, which authenticates each agent by its own API key and writes into OpenSearch. A detection engine converts SigmaHQ rules into OpenSearch queries with pySigma and runs them on a schedule, so hits show up as alerts — not just raw logs — in Grafana.
Everything server-side installs as a proper Windows service/Scheduled Task or a systemd unit on Linux, not a console window you have to keep open. And every component — the agents, the ingestion API, the TLS cert generator — is a plain Go binary calling documented OS APIs, which is also why it doesn't trip Windows Defender's heuristics the way a packed, obfuscated tool would. More on that below.
One ingestion path in, three consumers out: real-time detection, dashboards, and live log search.
Windows and Linux detection rules converted to real OpenSearch queries via pySigma — no hand-written detections to maintain.
Plain Go binaries calling documented OS APIs — no packing, no obfuscation, no process injection. Official signed tools (Sysmon, OpenSearch, Grafana) everywhere else.
ingest-api installs as a native Windows service (or systemd unit on Linux); the detect-engine runs as a Scheduled Task (or its own systemd unit). Nothing depends on a console window staying open.
An Overview dashboard with KPI gauges, plus dedicated Events, Alerts, and Agent Health views — provisioned automatically, not built by hand.
Three Grafana alert rules ship out of the box, split by severity (critical/high, medium, low/informational) — firing detections show up under Alerting > Active notifications with zero setup; wire in email/Slack/webhook delivery whenever you're ready.
Every agent gets its own bearer API key over TLS. One compromised agent can't spoof another's identity — ingest-api stamps identity server-side.
One small Go codebase, cross-compiled for both platforms, shipping to the same ingestion pipeline with a shared event schema.
Add Loki and ingest-api dual-writes every event there as a raw log line — live-tail and LogQL-search in Grafana's Explore view, right alongside the dashboards.
Add Suricata and it runs Snort/Emerging-Threats-syntax rules against live traffic itself — its alerts land in the same Grafana Alerts dashboard as Sigma's host-based detections.
Add Prometheus + windows_exporter (or node_exporter on Linux) and a provisioned "Server Health" dashboard shows the SIEM box's own CPU, memory, disk, and network — is the SIEM itself healthy, not just what it's watching.
Add Tempo and ingest-api (instrumented with OpenTelemetry) emits a span per event batch — HTTP handling plus the OpenSearch/Loki calls it makes — browsable in Grafana's Explore > Traces.
A FreeBSD pkg(8) package ships pf firewall filter log and Suricata alerts to the same pipeline — verified end-to-end against a real OPNsense box.
An opkg package (arm64/mipsle/arm) ships OpenWRT's logread system log and Suricata alerts — built and unit-tested, but not yet verified against a real router.
Two ways to get the server running — pick one.
Grab it from the Download section below.
It needs admin rights to register the ingest-api Windows service and the detect-engine's Scheduled Task.
tempo_url is wired into config.json automatically, browsable in Grafana's Explore > Traceseve.json too, if that's also checked) — no manual agent.json editingingest-api.exe only; needed for agents on other machines to reach this server (not needed for the windows-agent checkbox above, which talks to itself over localhost)The installer generates a TLS cert and a starter API key automatically, and writes both — plus next steps — to GETTING-STARTED.txt in the install directory. For more keys later, the installer also drops genkey.exe at C:\Program Files\EasySIEM\bin\genkey.exe — see the callout below.
https://localhost:3000 on the server itself — it opens straight to the Overview dashboard.
C:\Program Files\EasySIEM\bin\genkey.exe -agent-id windows-02 -os windows -restart
Generates the key, wires it into config.json's api_keys
directly, and restarts EasySiemIngestApi so it's live — no manual JSON
editing. Swap -os windows for -os linux when the new agent
is a Linux box instead; genkey just records it for the Agent Health
dashboard. -agent-id can be whatever you want — any string, no format
restrictions.
ingest-api.exe
on exactly TCP 8443, nothing broader.
Already installed without checking that box? Windows Firewall ships with inbound rules
for ingest-api.exe from earlier builds already, but they're scoped to
specific binary paths, not wherever your install actually landed, so add one yourself:
New-NetFirewallRule -DisplayName "EasySIEM ingest-api" -Direction Inbound `
-Program "C:\Program Files\EasySIEM\bin\ingest-api.exe" -Protocol TCP `
-LocalPort 8443 -Action Allow -Profile Any
Run that in an elevated PowerShell prompt on the server (adjust the path if you
installed somewhere other than the default). Confirm it worked from another machine on
the network: curl -k https://<server-hostname>:8443/v1/health should return
ok almost instantly; if it hangs for several seconds and then fails,
that's the firewall.
winget install -e --id GoLang.Go winget install -e --id Python.Python.3.12
.\scripts\install-opensearch.ps1
.\scripts\apply-index-templates.ps1
# from an elevated prompt:
.\scripts\install-grafana.ps1
go build -o bin\ingest-api.exe .\server\ingest
go build -o bin\gencert.exe .\tools\gencert
.\bin\gencert.exe -out-cert server\ingest\certs\server.crt -out-key server\ingest\certs\server.key -hosts localhost,127.0.0.1
# copy config.json.example to config.json, add an API key, then:
.\bin\ingest-api.exe -config server\ingest\config.json
git clone --depth 1 https://github.com/SigmaHQ/sigma.git rules\sigma cd server\detect python -m venv venv .\venv\Scripts\pip install sigma-cli pysigma-backend-opensearch pysigma-pipeline-sysmon requests .\venv\Scripts\python convert_rules.py .\venv\Scripts\python run_detections.py
go build -o bin\windows-agent.exe .\agents\windows
# or, for a Linux endpoint:
$env:GOOS="linux"; go build -o bin\linux-agent .\agents\linux
Full walkthrough — including Sysmon setup and agent config — is in
docs/SETUP.md in the source download. Prefer a wizard over hand-editing
agent.json? See Windows Agent /
Linux Agent below for the dedicated installers instead.
.exe —
ours included — will sometimes trigger a first-run SmartScreen prompt or a brief scan
delay. That's normal, and not something this project tries to evade: every component is
a plain binary calling documented APIs. See docs/DEFENDER.md in the source
download for exclusion commands and code-signing notes if you want to remove the prompt
entirely.
A standalone installer for Windows boxes you want monitored — separate from the server installer above, and separate from its "monitor this box too" checkbox (that one's for the server machine itself; this one's for deploying to other Windows endpoints). Asks for the server hostname and API key right in the wizard.
Grab it from the Download section below.
Find both in the server's GETTING-STARTED.txt, or generate a fresh key
on the server itself with genkey — bin\genkey.exe on a
Windows server, easysiem-genkey on a Linux one — which wires it into
the server's config.json directly, no manual editing. The agent ID
defaults to this machine's computer name.
Copy server.crt from the server's
C:\Program Files\EasySIEM\server\ingest\certs\ to this machine first,
then browse to it in the wizard. Leave it blank instead to skip TLS verification —
fine for a quick lab test, not for anything beyond one.
A checkbox on the same page — recommended, since windows-agent needs it for process/network telemetry beyond the Security/System/PowerShell logs alone.
agent.json, copies
the certificate, and registers windows-agent.exe as a Scheduled Task
(EasySiemWindowsAgent, runs at startup as SYSTEM — also what lets it read the
Security event log). Re-run the installer to reconnect this box to a different server or
change its key.
Prefer to run the backend on Linux instead of Windows? A .deb installs
ingest-api and the detect-engine as systemd services, running as a
dedicated unprivileged account rather than root. It does not include
OpenSearch, Grafana, Loki, Prometheus, or Tempo — all five already have official
Debian/Ubuntu packages, so this doesn't try to duplicate them.
From their own official packages: OpenSearch for Debian and Grafana for Debian.
wget https://easysiem.com/downloads/easysiem-server_1.0.0_amd64.deb sudo apt install ./easysiem-server_1.0.0_amd64.deb
Generates a TLS cert and a starter API key, writes a working config, and starts
both services automatically — the key is printed at the end of the install (and
saved in /etc/easysiem-server/ingest-config.json).
sudo /usr/share/easysiem-server/apply-index-templates.sh
sudo grafana-cli plugins install grafana-opensearch-datasource
sudo cp /etc/easysiem-server/grafana-provisioning/datasources/opensearch.yml \
/etc/grafana/provisioning/datasources/
sudo cp -r /etc/easysiem-server/grafana-provisioning/dashboards/* \
/etc/grafana/provisioning/dashboards/
sudo mkdir -p /etc/grafana/provisioning/alerting
sudo cp /etc/easysiem-server/grafana-provisioning/alerting/siem-alerts.yaml \
/etc/grafana/provisioning/alerting/
sudo systemctl restart grafana-server
That last file provisions three Grafana alert rules split by severity (critical/high, medium, low/informational) — firing detections show up under Alerting > Active notifications in Grafana's own UI. No delivery is configured yet; point the default notification policy at a real contact point (Alerting > Notification policies) to add email/Slack/webhook.
Give it the printed API key, a copy of
/var/lib/easysiem-server/certs/server.crt, and
server_url: https://<this-host>:8443. See
Linux Agent below, or build the Windows agent from
source. Need a key for another agent later?
sudo easysiem-genkey -agent-id linux-02 -os linux -restart — one
line, already installed by this package. -agent-id can be whatever
you want — any string, no format restrictions.
easysiem-server account,
not root — unlike the agent, neither service needs any special system access.
sudo apt remove easysiem-server keeps your config and data;
apt purge removes those and the dedicated account too. Full docs, including
how to add more agent keys: /usr/share/doc/easysiem-server/README.md.
127.0.0.1 only — it has no built-in auth), copy
/etc/easysiem-server/grafana-provisioning/datasources/loki.yml into
Grafana's provisioning, and add "loki_url": "http://localhost:3100" to
ingest-config.json. Full steps in the README.
sudo apt install prometheus prometheus-node-exporter — both are in
Debian/Ubuntu's own repos, no third-party repo needed. Add a
node_exporter scrape job to /etc/prometheus/prometheus.yml,
then copy
/etc/easysiem-server/grafana-provisioning/datasources/prometheus.yml into
Grafana's provisioning. Full steps in the README.
sudo apt install tempo —
same Grafana apt repo as Loki. Add "tempo_url": "http://localhost:4318"
to ingest-config.json and copy
/etc/easysiem-server/grafana-provisioning/datasources/tempo.yml into
Grafana's provisioning — traces show up in Explore > Traces. Full steps in the
README.
A .deb package for Debian/Ubuntu boxes you want monitored. Ships
journald and auditd events to an EasySIEM server that's
already running — see Install above if you haven't set that up
yet.
wget https://easysiem.com/downloads/easysiem-agent_1.0.0_amd64.deb sudo apt install ./easysiem-agent_1.0.0_amd64.deb
The package uses debconf, so the install itself prompts you right there in the
terminal for the server hostname or IP, the API key
(from the server's GETTING-STARTED.txt, or generated fresh with
easysiem-genkey on the server, wired into config.json
automatically; masked while typing), and a
path to the server's server.crt you've copied over
beforehand (leave blank to skip TLS verification instead — fine for a quick lab
test). Answer all three and it writes the config, copies the cert, and starts
easysiem-agent automatically — nothing left to do.
sudo systemctl status easysiem-agent journalctl -u easysiem-agent -f
sudo easysiem-genkey -agent-id linux-02 -os linux -restart
Generates the key, wires it into config.json's api_keys
directly, and restarts easysiem-ingest so it's live — no manual JSON
editing.
sudo cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json, edit it,
then sudo systemctl enable --now easysiem-agent. To change already-saved
answers: remove /etc/easysiem/agent.json first, then
sudo dpkg-reconfigure easysiem-agent (it won't overwrite an existing config on
its own — an upgrade shouldn't silently clobber hand edits).
journalctl -u easysiem-agent -f; a connection that hangs for several seconds
and then times out (rather than failing instantly, or an immediate 401) points at the
firewall specifically, not a bad hostname or key.
/var/log/audit/audit.log (usually root:adm 0640) and the full
journald stream. The systemd unit has a commented-out User=/Group=
for running it as a dedicated account instead (needs adm +
systemd-journal group membership) — see SECURITY.md in the
package's /usr/share/doc/easysiem-agent/.
sudo apt remove easysiem-agent keeps your config; apt purge
removes it too.
ppa:oisf/suricata-stable on Ubuntu), point
it at your interface, run suricata-update for the free ET Open
ruleset, then set "suricata_eve_path": "/var/log/suricata/eve.json"
in agent.json — its alerts land in the same Grafana Alerts dashboard
as Sigma's. Full steps in the README.
A FreeBSD pkg(8) package for OPNsense firewalls. Ships the pf
firewall filter log and, if the os-suricata plugin is installed,
Suricata IDS/IPS alerts, to an EasySIEM server that's already running — see
Install above if you haven't set that up yet.
fetch https://easysiem.com/downloads/easysiem-opnsense-agent-1.0.0.txz pkg add easysiem-opnsense-agent-1.0.0.txz
fetch is FreeBSD's built-in downloader (part of the base system, no
install needed) — run both from the OPNsense console or an SSH session.
cp /usr/local/etc/easysiem/agent.json.example /usr/local/etc/easysiem/agent.json
Edit agent.json: server_url, an api_key
(generate one with genkey on the server — see the callouts under
Install above), agent_id (any string), and either
ca_cert_path pointing at a copy of the server's
server.crt or insecure_skip_verify: true for a quick
lab test. Set filterlog_path if your OPNsense version keeps the
pf log somewhere other than the default
/var/log/filter/latest.log, and suricata_eve_path if
the os-suricata plugin is installed.
sysrc easysiem_opnsense_enable=YES service easysiem_opnsense start
eve.json, if configured) needs it. See SECURITY.md in
the package's docs.
An opkg package for OpenWRT routers. Ships the system log
(logread — firewall drop/accept lines included, if firewall
logging is enabled) and, if installed, Suricata IDS/IPS alerts, to an
EasySIEM server that's already running — see Install
above if you haven't set that up yet.
opkg print-architecture
Match the output against one of the three builds below (generic
aarch64/mipsel_24kc/arm_cortex-a7 —
if none match, see the package README for building your own or using the
raw binary directly).
wget https://easysiem.com/downloads/easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk opkg install easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk
Most current OpenWRT builds' BusyBox wget handles HTTPS fine;
if yours errors on the certificate, opkg install wget-ssl first,
or download the file elsewhere and scp it over instead.
cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json
Edit agent.json: server_url, an api_key
(generate one with genkey on the server — see the callouts under
Install above), agent_id (any string), and either
ca_cert_path pointing at a copy of the server's
server.crt or insecure_skip_verify: true for a quick
lab test. Set suricata_eve_path if you've installed Suricata via
opkg yourself.
/etc/init.d/easysiem-openwrt-agent enable /etc/init.d/easysiem-openwrt-agent start
logread and Suricata's
eve.json (if configured) both need it. The static binary is
roughly 6.5–7.9 MB depending on architecture — fine for most current routers
(128 MB+ flash is common), worth checking df -h / first on
anything older/smaller.
Installs ingest-api as a Windows service and the detect-engine as a
Scheduled Task, with optional OpenSearch, Grafana, and Sysmon components. Requires
Administrator.
Deploy the agent to other Windows endpoints — asks for the server hostname, API key, and certificate right in the wizard. See Windows Agent above. Requires Administrator.
⬇ Download installer
ingest-api + the detect-engine as systemd services (not OpenSearch/Grafana
— see Linux Server above). Runs as a dedicated
unprivileged account.
The Linux agent as a systemd service — ships journald and auditd events to an EasySIEM server. See Linux Agent above for setup.
⬇ Download .debThe OPNsense agent as a FreeBSD package — ships pf firewall filter log and Suricata alerts. See OPNsense Agent above for setup.
⬇ Download .txz
The OpenWRT agent as an opkg package — ships the system log
(logread) and Suricata alerts. Pick the architecture matching
your router (check opkg print-architecture if unsure). See
OpenWRT Agent above for setup.
Agents, ingest-api, the detect-engine, install scripts, and full docs
(SETUP.md, DEFENDER.md, SECURITY.md) — for
building agents yourself or customizing the server.