Why it's built this way

What you get

🧩

3,000+ SigmaHQ rules

Windows and Linux detection rules converted to real OpenSearch queries via pySigma — no hand-written detections to maintain.

🎯

MITRE ATT&CK mapped

SigmaHQ rules already carry ATT&CK technique/tactic tags — 88% of the compiled ruleset does — and they ride along onto every alert automatically, no extra setup. Suricata's own alerts get the same treatment if you enable metadata: yes in its eve-log config. The Console breaks detections down by tactic on its Alerts page and by technique on its ATT&CK Reference page, each technique linking to our own ATT&CK reference page for it.

🛡️

Defender-friendly by design

Plain Go binaries calling documented OS APIs — no packing, no obfuscation, no process injection. Official signed tools (Sysmon, OpenSearch) everywhere else.

⚙️

Real services, not scripts

ingest-api installs as a native Windows service (or systemd unit on Linux); the detect-engine runs as a Scheduled Task (or its own systemd unit). Nothing depends on a console window staying open.

📊

Dashboards that load

The Console's Overview shows the server's CPU, memory and disk, your KPIs and the most recent alerts; the Alerts, Logs and Firewall Blocks pages chart their volume over 24 hours, 7 days or 30 days, with breakdowns that click straight through to the rows behind them. Nothing to provision or build by hand.

🖥️

EasySIEM Console

EasySIEM's web interface — its own login, its own port (8444): live KPIs and trends, a paginated alert feed with source, severity and agent filters and search, a live firewall-block feed with real IPs alongside per-platform stats, an ATT&CK technique breakdown, raw log search over your full history, and CVE matches against every agent's installed software. It reads from the same OpenSearch cluster everything else does, and writes too where it saves a trip to the terminal — provisioning agent API keys, authoring custom detection rules, adjusting retention, running a CVE scan, or queuing a live "Processes & Services" snapshot to a single agent. Checked by default in both server installers — see Using the Console below, or open the interactive demo to click through the real thing with sample data.

📦

Software inventory, per agent

Windows and Linux agents report their OS patch level and every installed program/package on their own hourly schedule — separate from (and much coarser than) the usual 30-second heartbeat, since re-walking a box's whole package list every heartbeat would be pure waste for data that's realistically static between reboots. Windows reads it straight from the registry, the same place Add/Remove Programs itself does; Linux shells out to dpkg-query. Browse and search it, drill into the full list of pending OS updates, or fully decommission an agent (revokes its API key, drops it from the roster) right from its own row on the Console's Agent Health page — no terminal, no separate asset-inventory tool.

🩺

Live process & service snapshot

Agent Health's "Processes & Services" button queues a single real-time query to that one agent — picked up by its own fast poll loop (2-3s), not the usual heartbeat cadence — and returns its live process list and service/daemon states on the spot, no waiting on a scheduled report. Any row that matches an alert for that agent in the last 24h is highlighted red, so something already flagged stands out immediately instead of getting lost in a long list — and every row, flagged or not, carries its own "Alerts"/"Logs" links that open a new tab already searched for that exact process or service name on that agent, so a name that looks worth a second look is one click from its full alert and raw-log history, not a fresh search you build by hand.

🔭

Eighteen threat-hunting pages

Its own section of the Console, for the question an alert feed cannot answer: not “what fired?” but “what is unusual here?” The rarest executables and the rarest parent→child process pairs (Windows and Linux), files downloaded and then run, executables and services new to the fleet against a 30-day baseline, logon anomalies, credential access, service and driver installs, registry persistence, process injection, timestomping, regular-interval beaconing, agents gone quiet, log clearing and clock changes — plus Windows system names running from the wrong folder or under the wrong parent, marked in red. Most of these are meant to come back empty on a healthy estate, which is exactly what makes a single row worth reading.

🦠

CVE Watch (optional)

Scans every agent's reported installed software for known-vulnerable versions against a downloaded CVE index, on a schedule or on demand. Each match is also scored against FIRST.org's EPSS — how likely it actually is to be exploited, alongside its own CVSS severity. One standing alert summarizes what's found — configurable severity, timing, and repeat interval keep it from spamming you.

🌐

Geo IP

A Console page resolves every IP seen across your traffic to a country, entirely offline against a local database that ships with EasySIEM — no download, no account, and no IP is ever sent to a third party at request time. They land on a world map built into the page, one dot per country (or per city with DB-IP's free City Lite database), beside a ranked country list. It covers the last 7 days by default, or any window you pick from 1 hour to 30 days; click any dot or country for its complete IP list.

🤖

AI Security Review

Hands Claude, Gemini, Groq, OpenAI, DeepSeek or Meta — or a model you run yourself with Ollama — a digest of your own data, and asks it to call out real threats and misconfigurations. Point it at one agent for a thorough look at a single machine, at one alert for a verdict, or at the deployment itself for posture rather than threats. Most of the hunting pages carry their own review button too, each answering the question that page deliberately leaves open: whether a rare thing is a bad thing.

Bring your own API key for any hosted provider; each says plainly where your digest goes. With Ollama it never leaves the machine you name. Every analysis is saved to your own OpenSearch to reopen or delete, and nothing runs on a schedule — each one is a deliberate click.

📟

Alert notifications

Sends a message to your phone when serious alerts land — SMS through your own Twilio account, or a push notification through Pushover, which can keep repeating until you acknowledge it. Both stay off until you switch them on, and each channel is switched on separately: saving credentials only says a device can be reached, not that it should be paged. Each alert is its own message, sent at a priority that follows its own severity, with Critical and High adjustable if you want something different. An hourly ceiling bounds the volume — anything from unlimited down to a single message an hour.

⛔

Firewall Blocks page

One page normalizes blocked-traffic telemetry from every platform this project collects it from onto a shared action:"block" field: OPNsense's pf filterlog and OpenWRT's fw4/nftables logs out of the box, generic Linux's iptables/nftables LOG rules, and Windows Filtering Platform block events — the last two are opt-in, see the install checkboxes below. Blocks over time, and the top sources, destination ports, protocols, rules and interfaces, over the last 24 hours, 7 days or 30 days.

🕵️

Lateral movement hunting

Click through from any alert or event row to a dedicated page tracing that host, account, or IP across every other host it touched — a timeline of which hosts light up, logon history, process activity, network connections, other alerts, all in one place. detect-engine also cross-correlates automatically: a host tripping both a Sigma and a Suricata detection within 15 minutes of each other gets its own high-level alert, no rule-writing required.

🚩

IP reputation checking

Every alert's source and destination IP is checked against ipsum, an aggregated blocklist built from dozens of honeypots and threat feeds — the local copy refreshes automatically once a day, nothing to maintain. A hit flags the alert and highlights its entire row in red on the Console's Alerts, Lateral Movement, and Overview pages, so known-bad activity stands out without having to go IP-hunting yourself.

🔔

Alert notifications

A message on your phone when an alert lands — through Pushover, or SMS through Twilio, on your own account. Pick the lowest severity worth a message and a ceiling per hour, and leave CVE Watch findings out if you like; each channel has a test button, so you can prove the path works before anything depends on it.

🔑

Per-agent authentication

Every agent gets its own bearer API key over TLS. One compromised agent can't spoof another's identity — ingest-api stamps identity server-side.

🐧

Windows + Linux agents

One small Go codebase, cross-compiled for both platforms, shipping to the same ingestion pipeline with a shared event schema.

🔍

Raw log search

Every event is searchable in the Console's Logs page — plain substring, full regex (\d, \b, anchors, alternation), or Lucene field queries like EventID:4625 when you want one exact thing. Exclusions, case-insensitive matching, an exact match count, and windows up to 30 days. Nothing extra to install: it reads the same OpenSearch index everything else does.

📡

Network detection (optional)

Add Suricata and it runs Snort/Emerging-Threats-syntax rules against live traffic itself — its alerts land on the Console's Alerts page alongside Sigma's host-based detections.

📈

Server health

Add Prometheus + windows_exporter (or node_exporter on Linux) and the Console's Overview opens on the SIEM box's own CPU, memory and disk gauges, while its Server Health page adds network and history. On every install, with Prometheus or without, that page also checks the SIEM itself: OpenSearch's status and headroom, whether events are still arriving, how long the disk lasts at your retention settings, and when the detection engine last ran — is the SIEM itself healthy, not just what it's watching.

🧱

OPNsense agent

A FreeBSD pkg(8) package ships the pf firewall filter log, Suricata alerts, sshd logins, file-integrity changes (including /boot/loader.conf) and FreeBSD's own pkg audit CVE feed to the same pipeline — with four ready-made detection rules to alert on them. Verified end-to-end against a real OPNsense box.

📶

OpenWRT agent

An opkg package (arm64/mipsle/arm) or apk package (x86_64) ships OpenWRT's logread system log and Suricata alerts. The apk/x86_64 build's verified end-to-end against a real running OpenWRT 25.12.5 instance; the opkg builds are still unit-tested only, not yet verified against real router hardware.

Using the Console

A faster daily check-in

The Console is EasySIEM's own dashboard on port 8444 — checked by default in both server installers, and on most days the only thing you'll need to open. Alerts, firewall blocks, agent health and server health at a glance. Raw log search across your full 30-day history — regex, Lucene field queries, exclusions, case-insensitive matching and an exact match count. Every agent's installed software cross-referenced against known CVEs. A world map of where your traffic's IPs are, and the addresses raising the most alerts.

It writes as well as reads: author custom detection rules, issue and revoke agent API keys, trigger a CVE scan on demand, inspect a live agent, or change how long data is kept — all from the browser, without hand-editing a config file. And when you do want the full picture, every "Raw event" and "Lateral movement" link opens the complete drill-down — the Lateral Movement page even charts which other hosts the same account or IP touched, over whatever window you pick.

The EasySIEM Console's Alerts page, showing the public demo's sample data: a chart of alerts over time by severity with a 24-hour, 7-day or 30-day window, breakdowns by level, source, ATT&CK tactic and rule beside it, and the alert feed below with its source and severity filters

Log in

Open https://<this box>:8444 — your browser will warn about the self-signed cert once. Username is admin; the password is shown at the end of the installer, and on Windows also saved in CREDENTIALS.txt in the install directory, which only administrators can open.

Overview

The default landing page: this server's CPU, memory and disk gauges and its uptime (from Prometheus, installed by default), four KPI tiles (Alerts, Critical/High, Active Agents, Events Ingested), a paginated "Most Recent Alerts" feed (filter it by severity, search it, or sort it by agent A–Z or Z–A), an IP-reputation panel for anything ipsum-flagged, a Firewall Blocks summary, Agent Coverage (any agent that has stopped reporting, or still reports but has lost a log source) and CVE Exposure (the worst CVEs CVE Watch has found, and on how many hosts).

Alerts

The full alert feed (the last 24h, or any dates you pick), paginated 100 at a time and filterable by detection source (Sigma/Suricata/Correlated), severity and agent, with an Agent menu that shows how many alerts each agent has, plus free-text search across rule title, host, and agent ID — all server-side, so filters and paging actually reach every alert, not just whatever loaded first. Above it, alerts over time by severity for the last 24 hours, 7 days or 30 days, broken down by level, source, ATT&CK tactic and rule — click a level or a source to filter the feed to it.

Firewall Blocks

Total/unique-IP/top-protocol stats and a per-platform breakdown (OPNsense, OpenWRT, Linux, Windows), plus a live "Recent Blocks" table underneath with the actual source/destination IPs, ports, protocol, and interface behind those numbers. Pick a window — 24 hours, 7 days or 30 days — for the stats, a chart of blocks over time, and the top sources, destination ports, protocols, firewall rules and interfaces; click any of them, or a platform's own bar, to filter the table to it.

Geo IP

Where the IPs in your traffic are, worked out entirely on the server: a world map with a dot for each country, sized by events — or for each city once you install DB-IP's free City Lite database — beside every country ranked by events. Hover a dot for its IPs and events, zoom in and drag around, and click a dot or a country for every address behind it. Both ends of each flow count, since behind NAT the remote party is usually the destination, and your own public address is left out so it can't swamp the map.

Logs

Every event your agents have sent, searchable as raw text over a window up to 30 days, with an exact match count rather than a capped estimate. Filter by agent, OS or channel, narrow to a date range, and page through the results. Above the search, event volume over time and the top Event IDs, hosts and agents — click one to search for exactly those events.

The quick box at the top is a plain substring search. Advanced opens a row of conditions that all have to match, and each one picks how it reads what you typed:

contains / does not contain — literal text, no special characters to escape.
matches regex / does not match regex — the syntax you already know: \d, \w, \s and word boundaries (\b) all work, along with anchors, alternation and character classes. An IPv4 address is \b([0-9]{1,3}\.){3}[0-9]{1,3}\b; an email address is [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}.
Lucene query / NOT Lucene query — searches the event's own fields instead of the raw line, which is the only way to ask for one exactly: EventID:4625, EventID:(4624 OR 4625), Channel:"Security" AND agent.os:windows, _exists_:TargetUserName. Same syntax as a Custom Rule's own query, so it carries over. Field names and values are case-sensitive, and an unqualified word searches every indexed field — for the whole line, use contains.

Tick ignore case to fold case on any of them. Underneath the conditions, the Console prints the query it actually ran — patterns get rewritten on the way to the index, and a search that finds nothing is much easier to debug when you can see what was really asked.

Hunting

Its own section in the sidebar — eighteen pages answering a different question from the alert feed. An alert tells you a rule matched. These ask what is unusual about your estate in the first place: the rarest executables and the rarest parent→child process pairs (Windows and Linux), files that were downloaded and then executed, executables and services new to the fleet measured against a 30-day baseline, logon anomalies, credential access, service and driver installs, registry persistence, process injection, timestomping, regular-interval beaconing, and agents that have stopped reporting.

Two of them earn their keep by being boring. Tampering watches for cleared logs, a stopped event-log or Sysmon service, audit-policy edits and clock changes — then counts out the dull explanations by default (a clean shutdown stops the event log; the time service nudges the clock), prints how many it set aside, and lets you bring them back as low-severity rows. System Impostors lists every process using a Windows system name and marks in red any running from the wrong folder or started by the wrong parent — a svchost.exe in a temp folder, or one started by Word. On a healthy machine it flags nothing, and says so rather than looking broken.

These pages work hard not to overstate what they know. Each reports how far your data actually reaches, so asking for 30 days on a week of history tells you it covered a week rather than quietly reporting a quiet estate. Rarest-first ordering is labelled indicative rather than exact, because it is approximate across shards. And a table that hit its row limit says so — on the first-seen baseline especially, where a truncated baseline would not hide findings but invent them.

Agent Health, Agent Keys, Server Health, ATT&CK Reference

A live roster of every agent reporting in — including its OS patch level and a searchable list of every installed program/package, reported on its own hourly schedule so it's real without hammering the endpoint (Windows: the registry, the same place Add/Remove Programs itself reads; Linux: dpkg-query). Click the pending-updates count for the full list of what's outstanding, or "Processes & Services" for a live, on-demand snapshot of that one agent's running processes and service/daemon states — queued to it directly and picked up within a few seconds, not the next scheduled report — with any row matching one of its own alerts from the last 24h highlighted red, and every row (flagged or not) carrying its own "Alerts"/"Logs" links that pivot straight into that exact process or service name, already searched and scoped to that one agent, in a new tab. "Remove" fully decommissions an agent: revokes its API key and drops it from the roster (its historical alerts/events stay untouched); bringing it back means provisioning a fresh key from the Agent Keys page. That page also lets you provision a new agent's API key and download this server's CA certificate without a terminal; this box's own CPU/memory/disk/network, if Prometheus is installed, and the SIEM's own health on every install (OpenSearch's status and disk, whether events are still arriving, storage runway at your retention settings, and when the detection engine last ran); and a breakdown of ATT&CK techniques seen in the last 24h, each linking to our own reference pages.

CVE Watch (optional)

Scans every agent's reported installed software for known-vulnerable versions against a downloaded CVE index — see docs/SETUP.md §4b to turn it on. Runs on a 12h schedule, or click Scan Now to check right away. A single summary alert on the Overview and Alerts pages tells you something was found, with its own Alert settings for minimum severity, the severity the alert itself goes out at, time of day, and how often it's allowed to repeat.

AI Security Review

Paste your own API key for Claude, Gemini, Groq, OpenAI, DeepSeek or Meta — each with a link and instructions on the page — or point it at a model you run yourself with Ollama. Then pick a window, from 1 hour to 7 days.

Pick an agent and click Run Deep Review for the thorough look at one machine, or leave the selector on Server health and click Run Health Review for the deployment itself. The AI button on any alert row explains just that alert. Hunting pages that carry their own ✨ AI review these results button each review exactly the rows listed on them under whatever filters you have set, asking the question that page cannot answer for itself. Findings come back with a severity, a recommendation, and what in your own data backs them up.

Change your password

"Change password" in the top bar asks for your current password before it accepts a new one, so a signed-in tab left unattended isn't enough to take the account over.

Forgot the password entirely?

On Windows: stop the EasySiemConsole service, run bin\console.exe -hash-password <new password>, paste the printed hash into console_password_hash in server\console\config.json, then start the service back up. On Linux: sudo systemctl stop easysiem-console, the same -hash-password flag against /etc/easysiem-server/console-config.json, then sudo systemctl start easysiem-console. Neither step needs the old password — it's a direct overwrite, not a reset flow that emails you a link.

Get running

Installation

Two ways to get the server running — pick one.

Download EasySiemSetup.exe

Grab it from the Download section below.

Run it as Administrator

It needs admin rights to register the ingest-api Windows service and the detect-engine's Scheduled Task.

Pick your optional components

OpenSearch — downloads ~450 MB from opensearch.org, skipped if already installed
Prometheus — installs Prometheus + windows_exporter together, already scraping and feeding the Console's Server Health page and the gauges heading its Overview (CPU/memory/disk/network for this box)
EasySIEM Console — the web dashboard, on port 8444, checked by default; you choose its login next (leave the password blank to have a strong one generated, shown when setup finishes and saved to CREDENTIALS.txt) — see Using the Console below for a tour
Sysmon — only if this same box is also a monitored endpoint
Suricata — network IDS, runs Snort/ET-syntax rules against live traffic; only if this box is also a monitored endpoint. Needs one manual click-through for Npcap (its free edition has no silent installer) — a setup window will appear
CVE Watch feed — downloads a pre-built CVE index (~51MB, 2019-2026 snapshot) and cross-references it against every agent's own installed software, raising alerts for known-vulnerable versions; see the "CVE Watch" page in the Console for status and an on-demand Scan Now button
windows-agent — installs and fully configures the agent on this same box for self-monitoring, wired to the starter API key (and Suricata's eve.json too, if that's also checked) — no manual agent.json editing
Open Windows Firewall — TCP 8443 for ingest-api.exe only; needed for agents on other machines to reach this server (not needed for the windows-agent checkbox above, which talks to itself over localhost)
Enable Windows Firewall block auditing — turns on the "Filtering Platform Packet Drop"/"Filtering Platform Connection" audit subcategories so this machine's blocked traffic shows up on the Console's Firewall Blocks page; only useful alongside the windows-agent checkbox above, checked by default, needs a reboot to take effect, and can be noisy on an internet-facing box since every blocked packet ships with no per-rule filter

Grab your API key

The installer generates a TLS cert and a starter API key automatically. The key is shown when setup finishes and saved to CREDENTIALS.txt in the install directory, which only administrators can open; next steps are in GETTING-STARTED.txt beside it.

For more keys later, the easiest route is the Console's Agent Keys page (https://localhost:8444) — enter an agent ID, pick its OS, and it provisions the key, wires it into config.json and restarts the ingest service so it is live immediately — no manual JSON editing, no elevation. The same page downloads this server's CA certificate, which each agent needs to trust it — so a new agent can be set up entirely from the browser. Or use the command line: the installer also drops genkey.exe at C:\Program Files\EasySIEM\bin\genkey.exe — see below.

Open the Console

https://localhost:8444 on the server itself — log in with the admin username/password you set during install (your browser will warn about the self-signed cert once), and it opens straight to the Overview page. See Using the Console below for a tour.

Prefer the command line? One line, on the server. Run PowerShell as Administrator first — it writes into Program Files and restarts a Windows service, both of which need elevation; without it you'll get an access-denied error. (The & and quotes are separately required whenever a PowerShell path has a space, like Program Files here — without them it misreads C:\Program as the command and everything after as arguments.)

& "C:\Program Files\EasySIEM\bin\genkey.exe" -agent-id windows-02 -os windows -restart

Same result as the Console route above — the key is written into config.json's api_keys and EasySiemIngestApi restarted, so it's live straight away. Swap -os windows for -os linux when the new agent is a Linux box instead; genkey just records it for the Agent Health dashboard. -agent-id can be whatever you want — any string, no format restrictions.

Deploying agents from other machines? Check the "Open Windows Firewall" box in step 3 above — unchecked by default, since opening an inbound port is a real choice, not something to enable silently. Skip it if every agent runs on the server box itself (the "monitor this box too" checkbox); only remote agents need it. It scopes the rule to exactly ingest-api.exe on exactly TCP 8443, nothing broader.

Already installed without checking that box? Windows Firewall ships with inbound rules for ingest-api.exe from earlier builds already, but they're scoped to specific binary paths, not wherever your install actually landed, so add one yourself:

New-NetFirewallRule -DisplayName "EasySIEM ingest-api" -Direction Inbound `
    -Program "C:\Program Files\EasySIEM\bin\ingest-api.exe" -Protocol TCP `
    -LocalPort 8443 -Action Allow -Profile Any

Run that in an elevated PowerShell prompt on the server (adjust the path if you installed somewhere other than the default). Confirm it worked from another machine on the network: curl -k https://<server-hostname>:8443/v1/health should return ok almost instantly; if it hangs for several seconds and then fails, that's the firewall.

Uninstalling? Just re-run EasySiemSetup.exe — it detects the existing install and asks: Yes to repair/reinstall (your config, API key(s), and TLS certificate are kept), No to uninstall, or Cancel to leave everything alone. Choosing No hands off to the real uninstaller, which stops and removes the EasySiemIngestApi service, every Scheduled Task this installer registered (detect-engine, and Prometheus/ Suricata/windows-agent if you installed them), the firewall rule if you opened one, and OpenSearch/Sysmon (service and driver included, for Sysmon) if you installed those, plus a Grafana an earlier release installed. (The ordinary Windows way works too — Settings > Apps, or the "Uninstall EasySIEM" shortcut in the Start Menu group — it's the exact same uninstaller either way.)

Upgrading from a release that installed Grafana? Setup removes the Grafana it installed, with its data — the Console shows everything its dashboards did. A Grafana that EasySIEM didn't install is left exactly as it was, and GETTING-STARTED.txt says which happened.

Prerequisites

winget install -e --id GoLang.Go
winget install -e --id Python.Python.3.12

Install OpenSearch

.\scripts\install-opensearch.ps1
.\scripts\apply-index-templates.ps1

Build and run ingest-api

go build -o bin\ingest-api.exe .\server\ingest
go build -o bin\gencert.exe .\tools\gencert
.\bin\gencert.exe -out-cert server\ingest\certs\server.crt -out-key server\ingest\certs\server.key -hosts localhost,127.0.0.1
# copy config.json.example to config.json, add an API key, then:
.\bin\ingest-api.exe -config server\ingest\config.json

Convert Sigma rules and run detections

git clone --depth 1 https://github.com/SigmaHQ/sigma.git rules\sigma
cd server\detect
python -m venv venv
.\venv\Scripts\pip install sigma-cli pysigma-backend-opensearch pysigma-pipeline-sysmon requests
.\venv\Scripts\python convert_rules.py
.\venv\Scripts\python run_detections.py

Build and deploy an agent

go build -o bin\windows-agent.exe .\agents\windows
# or, for a Linux endpoint:
$env:GOOS="linux"; go build -o bin\easysiem-agent .\agents\linux

Full walkthrough — including Sysmon setup and agent config — is in docs/SETUP.md in the source download. Prefer a wizard over hand-editing agent.json? See Windows Agent / Linux Agent below for the dedicated installers instead.

A note on Windows Defender: a brand-new, unsigned .exe — ours included — will sometimes trigger a first-run SmartScreen prompt or a brief scan delay. That's normal, and not something this project tries to evade: every component is a plain binary calling documented APIs. See docs/DEFENDER.md in the source download for exclusion commands and code-signing notes if you want to remove the prompt entirely.

For endpoints

Windows Agent

A standalone installer for Windows boxes you want monitored — separate from the server installer above, and separate from its "monitor this box too" checkbox (that one's for the server machine itself; this one's for deploying to other Windows endpoints). Asks for the server hostname and API key right in the wizard.

Download and run as Administrator

Grab it from the Download section below.

Enter your server's hostname and API key

Each agent needs its own API key, and the server makes them. Three ways to get one:

From the Console — the easiest, no terminal:

Open the Console: https://localhost:8444 on the server itself, or https://<server>:8444 from this machine if it can reach that port. Sign in with the admin login from the server install.
Click Agent Keys in the sidebar.
Under Generate a new key, type an Agent ID — any name you like; this wizard's own default is the machine's computer name, so using that keeps them matched — pick windows as the OS, and click Generate & add.
Click Copy and paste the key into this wizard's API key box. It's shown only once, so paste it before you leave the page. It's already live: the Console wrote it into the server's config and restarted the ingest service.

While you're on that page, ⬇ Download server.crt saves the certificate the next step asks for.

From the starter key. The server printed one when it was installed, saved to CREDENTIALS.txt (Windows, administrators only) or ~/easysiem-getting-started.txt (Linux) — fine to use if no other agent has it yet.

Or optionally from the command line, on the server (works any time, for any number of agents). If the server's on Windows, run PowerShell as Administrator first — it writes into Program Files and restarts a Windows service, both of which need elevation. (The & and quotes are separately required whenever a PowerShell path has a space, like Program Files here.)

Windows server:

& "C:\Program Files\EasySIEM\bin\genkey.exe" -agent-id windows-02 -os windows -restart

Linux server:

sudo easysiem-genkey -agent-id windows-02 -os windows -restart

Prints the new key, wires it into the server's config, and restarts the ingest service so it's live — one line, nothing else to do. -agent-id can be whatever you want (any string, no format restrictions) — the wizard's own default is this machine's computer name, so match that if you'd rather not think of one.

Browse to the server's certificate (recommended)

Get server.crt onto this machine first: the Console's Agent Keys page has a ⬇ Download server.crt button, or copy it from the server's C:\Program Files\EasySIEM\server\ingest\certs\ (Windows) or /var/lib/easysiem-server/certs/ (Linux, with sudo). Then browse to it in the wizard's Path to server.crt box. Leave it blank instead to skip TLS verification — fine for a quick lab test, not for anything beyond one.

Optionally install Sysmon too

A checkbox on the same page — recommended, since windows-agent needs it for process/network telemetry beyond the Security/System/PowerShell logs alone.

Optionally enable Windows Firewall block auditing

Another checkbox on the same page — turns on the audit subcategories this box's blocked traffic needs to show up on the Console's Firewall Blocks page. Off by default, needs a reboot to take effect, and can be noisy on an internet-facing box.

That's it — finishing the wizard writes agent.json, copies the certificate, and registers windows-agent.exe as a Scheduled Task (EasySiemWindowsAgent, runs at startup as SYSTEM — also what lets it read the Security event log). Re-run the installer to reconnect this box to a different server or change its key.

Agent won't connect? Check the server's Windows Firewall first — see the firewall note under Install above. It's the most common reason a freshly-installed agent just sits there retrying.

For Linux hosts

Linux Server

Prefer to run the backend on Linux instead of Windows? One guided script installs ingest-api, the detect-engine, and the EasySIEM Console (all running as a dedicated unprivileged account rather than root), then walks you through each optional piece one at a time — OpenSearch, Prometheus — and finally asks whether to install the agent on this same box too, so it monitors itself.

Download and run the installer

curl -fsSL -O https://easysiem.com/install.sh
chmod +x install.sh
sudo ./install.sh

Asks before installing anything optional — say no to any piece you don't want, or already have running your own way. Safe to re-run any time; every step, including this script itself, checks what's already done first. Ends with a summary (API key, the Console's URL and login, next steps) printed and saved to ~/easysiem-getting-started.txt.

Connect another agent

The installer already connects this box's own agent if you said yes to that step. For a different machine: give it the API key from the summary above, a copy of /var/lib/easysiem-server/certs/server.crt, and server_url: https://<this-host>:8443. See Linux Agent below, or build the Windows agent from source. Need a fresh key later? sudo easysiem-genkey -agent-id linux-02 -os linux -restart — one line, already installed by the server package. Swap -os linux for -os windows when the new agent is a Windows box instead — -os just records it for the Agent Health dashboard. -agent-id can be whatever you want — any string, no format restrictions. Prefer a UI over SSH? If you installed the Console (optional, on port 8444 — see Using the Console), its Agent Keys page does the same thing — enter an agent ID, click Generate, copy the key — plus a ⬇ Download server.crt button so you don't need /var/lib/easysiem-server/certs/server.crt's path above at all.

Prefer full manual control, one piece at a time? The installer just calls the same idempotent scripts it ships at /usr/share/easysiem-server/install-*.sh — run install-opensearch.sh directly instead (Prometheus has its own callout below). Full docs for each, including what they fix that a plain apt install wouldn't: /usr/share/doc/easysiem-server/README.md, once the server package is installed.

Runs as a dedicated unprivileged easysiem-server account, not root — unlike the agent, neither service needs any special system access. sudo apt remove easysiem-server keeps your config and data; apt purge removes those and the dedicated account too. Full docs, including how to add more agent keys: /usr/share/doc/easysiem-server/README.md.

Uninstalling everything at once? One script removes the server, and optionally OpenSearch/Prometheus too (and a Grafana an earlier release installed) — instead of working through apt purge one piece at a time:

curl -fsSL -O https://easysiem.com/uninstall.sh
chmod +x uninstall.sh
sudo ./uninstall.sh

Only asks about a piece if it's actually installed; removing the third-party backends defaults to no and says so — those hold real data.

Want the Server Health page too? sudo /usr/share/easysiem-server/install-prometheus.sh — installs Prometheus + node_exporter from Debian/Ubuntu's own repos, binds both to 127.0.0.1 only (neither does by default) — the Console's Server Health page reads it directly. Safe to re-run any time.

For endpoints

Linux Agent

A .deb package for Debian/Ubuntu boxes you want monitored. Ships journald and auditd events to an EasySIEM server that's already running — see Install above if you haven't set that up yet.

Download and run the installer — it asks three questions

curl -fsSL -O https://easysiem.com/agent-install.sh
chmod +x agent-install.sh
sudo ./agent-install.sh

Asks for the server hostname or IP and the API key (from the server's easysiem-getting-started.txt, or generated fresh with easysiem-genkey on the server) — then fetches the server's TLS certificate automatically and shows its SHA256 fingerprint for you to confirm against the one the server printed at its own install time (also saved to server.crt.fingerprint right next to server.crt there, if you don't have that output anymore). Confirming it is what makes the automatic fetch trustworthy — without that one check, whoever's on the network path during the fetch could hand you a certificate of their own instead. Say no (or if the fetch fails — server unreachable, or an older server without this endpoint) and it falls back to asking for a local path instead, same as before. Writes the config and starts easysiem-agent itself — nothing left to do by hand. Safe to re-run any time; it asks before overwriting an existing config.

Confirm it's running

sudo systemctl status easysiem-agent
journalctl -u easysiem-agent -f

Need an API key? Run this on the server (not this agent box) — one line:

sudo easysiem-genkey -agent-id linux-02 -os linux -restart

Generates the key, wires it into config.json's api_keys directly, and restarts easysiem-ingest so it's live — no manual JSON editing. -agent-id can be whatever you want — any string, no format restrictions; linux-02 above is just an example, not a required name. Swap -os linux for -os windows if the agent you're installing is actually on Windows instead — genkey just records it for the Agent Health dashboard, it doesn't affect the key itself.

Prefer a UI over SSH? If you installed the Console (optional, on port 8444 on the server — see Using the Console), its Agent Keys page does the exact same thing without a terminal: enter an agent ID, click Generate & add, and copy the key it shows you — it's only ever displayed once, so paste it into agent.json (or this installer's prompt) right away. Same page has the ⬇ Download server.crt button mentioned below, too.

Automatic fetch declined or unavailable, and want server.crt on this box some other way? The Console's Agent Keys page has a ⬇ Download server.crt button — that saves it to whatever machine your browser is running on, which usually isn't this agent box itself. Copy it over with scp (built into every Linux/macOS terminal, and Windows 10/11's PowerShell too):

scp path\to\server.crt user@this-agent-box:/tmp/server.crt

Run that from wherever the file actually landed (e.g. your Downloads folder), swapping in this agent box's real SSH username/host. Then point the installer's manual-path prompt (or ca_cert_path in agent.json if configuring by hand) at /tmp/server.crt — or wherever you copied it to.

Prefer the raw .deb, or scripting an unattended install? sudo apt install ./easysiem-agent_1.0.0_amd64.deb still works directly — it uses debconf for the same three questions, though which frontend actually prompts you depends on your terminal (falls back to installed-but-unconfigured if none can). Configure by hand afterward: sudo cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json, edit it, then sudo systemctl enable --now easysiem-agent — or sudo dpkg-reconfigure easysiem-agent to retry debconf's prompts (remove /etc/easysiem/agent.json first; it won't overwrite an existing one on its own).

Agent won't connect? If the server is Windows, check its Windows Firewall first — see the firewall note under Install above. Journal it with journalctl -u easysiem-agent -f; a connection that hangs for several seconds and then times out (rather than failing instantly, or an immediate 401) points at the firewall specifically, not a bad hostname or key.

Runs as root by default — it needs read access to /var/log/audit/audit.log (usually root:adm 0640) and the full journald stream. The systemd unit has a commented-out User=/Group= for running it as a dedicated account instead (needs adm + systemd-journal group membership) — see SECURITY.md in the package's /usr/share/doc/easysiem-agent/.

Want network detection too? Install Suricata from its official Ubuntu PPA/Debian package (ppa:oisf/suricata-stable on Ubuntu), point it at your interface, run suricata-update for the free ET Open ruleset, then set "suricata_eve_path": "/var/log/suricata/eve.json" in agent.json — its alerts land on the Console's Alerts page alongside Sigma's. Full steps in the README.

Uninstalling?

sudo apt remove easysiem-agent

Stops and disables the service automatically — its own preremove script handles that, no manual systemctl stop first. Keeps /etc/easysiem (your agent.json) and its resume state; sudo apt purge easysiem-agent instead removes those too, for a genuinely clean slate.

For endpoints

OPNsense Agent

A FreeBSD pkg(8) package for OPNsense firewalls. Ships the pf firewall filter log and, if the os-suricata plugin is installed, Suricata IDS/IPS alerts — plus sshd authentication, file-integrity monitoring (with a dedicated /boot/loader.conf watcher) and FreeBSD's own pkg audit vulnerability feed, all enabled by default in the shipped config. Sends to an EasySIEM server that's already running — see Install above if you haven't set that up yet.

Download and install

fetch https://easysiem.com/downloads/easysiem-opnsense-agent-1.0.0.txz
pkg add easysiem-opnsense-agent-1.0.0.txz

fetch is FreeBSD's built-in downloader (part of the base system, no install needed) — run both from the OPNsense console or an SSH session.

Configure — guided

easysiem-opnsense-setup

Asks for the server, the API key, an agent ID and the TLS certificate, writes agent.json, then enables and starts the service — so this step and the next are both done. Safe to re-run whenever any of those change: each prompt offers the current value as its default, and anything you have tuned by hand is left alone.

The installer prints this command rather than asking during pkg add because FreeBSD's pkg cannot prompt — it gives install scripts no terminal, and installing from the OPNsense web GUI has none at all.

Prefer to do it by hand? Copy agent.json.example to agent.json and set server_url, an api_key (generate one on the Console's Agent Keys page, or with genkey on the server — see the callouts under Install above), agent_id (any string), and either ca_cert_path pointing at a copy of the server's server.crt or insecure_skip_verify: true for a quick lab test. Then sysrc easysiem_opnsense_enable=YES and service easysiem_opnsense start.

Either way, set filterlog_path if your OPNsense version keeps the pf log somewhere other than the default /var/log/filter/latest.log, and suricata_eve_path if the os-suricata plugin is installed.

The detection rules are already there. Both server installers — install.sh on Linux and the Windows installer — seed four OPNsense Custom Rules, so alerting works the moment a firewall connects, with nothing to run on either side. They're visible and editable on the Console's Custom Rules page, on Linux and Windows alike:

OPNsense Critical File Changed (critical) — a monitored security-critical file was created, changed or deleted, including the boot loader config
OPNsense Vulnerable Package Detected (high) — the set of vulnerable installed packages changed, per FreeBSD's own maintained CVE database
OPNsense SSH Failed Login (medium) — a failed or invalid-user SSH attempt against the firewall itself
OPNsense SSH Successful Login (informational) — routine admin access, tracked for audit visibility

They match nothing but OPNsense-sourced events, so a server with no firewall attached simply never fires them. Edit or disable any of them in the Console; a later server upgrade won't undo your changes.

One exception: installing the .deb by hand with dpkg -i rather than running install.sh skips this, the same way it skips the index templates and the retention policy — those all need OpenSearch already running, which the package alone can't assume. Seed them yourself afterwards with sudo /usr/share/easysiem-server/seed-opnsense-custom-rules.sh.

Runs as root by default — reading the pf filter log (and Suricata's eve.json, if configured) needs it. See SECURITY.md in the package's docs.

Uninstalling?

pkg delete easysiem-opnsense-agent

That's it — the package's own scripts stop the service and clear rc.conf's easysiem_opnsense_enable flag automatically, no manual service ... stop step needed first. Leaves agent.json (your server_url/api_key), the resume state, and the log file in place — delete /usr/local/etc/easysiem/, /var/db/easysiem/, and /var/log/easysiem_opnsense.log yourself for a genuinely clean slate.

For endpoints

OpenWRT Agent

A package for OpenWRT routers, in whichever format your build uses. Ships the system log (logread — firewall drop/accept lines included, if firewall logging is enabled) and, if installed, Suricata IDS/IPS alerts, to an EasySIEM server that's already running — see Install above if you haven't set that up yet.

Check which package manager your router has

OpenWRT 24.x and later (including 25.x) replaced opkg with apk-tools — check which one you actually have before picking a package below:

opkg --version || apk --version

If you have opkg: check your architecture, then download and install —

opkg print-architecture

Match the output against one of the three .ipk builds below (generic aarch64/mipsel_24kc/arm_cortex-a7 — if none match, see the package README for building your own or using the raw binary directly).

wget https://easysiem.com/downloads/easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk
opkg install easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk

Most current OpenWRT builds' BusyBox wget handles HTTPS fine; if yours errors on the certificate, opkg install wget-ssl first, or download the file elsewhere and scp it over instead.

If you have apk instead (OpenWRT 24.x+, including 25.x's x86/64 target) — currently built for x86_64 only (VMs, PCs, x86 appliances; see the package README for building your own for an ARM/MIPS apk-based router):

wget https://easysiem.com/downloads/easysiem-openwrt-agent_1.0.0_x86_64.apk
apk add --allow-untrusted easysiem-openwrt-agent_1.0.0_x86_64.apk

--allow-untrusted is expected and fine here — it just means the package isn't signed by a key apk already trusts, same as any other locally-built package.

Configure

cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json

Edit agent.json: server_url, an api_key (generate one on the Console's Agent Keys page, or with genkey on the server — see the callouts under Install above), agent_id (any string), and either ca_cert_path pointing at a copy of the server's server.crt or insecure_skip_verify: true for a quick lab test. Set suricata_eve_path if you've installed Suricata via opkg yourself.

Enable and start

/etc/init.d/easysiem-openwrt-agent enable
/etc/init.d/easysiem-openwrt-agent start

Runs as root by default — logread and Suricata's eve.json (if configured) both need it. The static binary is roughly 6.5–7.9 MB depending on architecture — fine for most current routers (128 MB+ flash is common), worth checking df -h / first on anything older/smaller.

Uninstalling?

opkg remove easysiem-openwrt-agent

apk del easysiem-openwrt-agent

Either package's own script stops and disables the service automatically first, no manual /etc/init.d/easysiem-openwrt-agent stop step needed. Leaves /etc/easysiem (your agent.json and resume state) in place — rm -rf /etc/easysiem yourself for a genuinely clean slate.

Get it

Download

🪟

EasySiemSetup.exe

Windows installer · ~34 MB

Installs ingest-api as a Windows service and the detect-engine as a Scheduled Task, with the EasySIEM Console and optional OpenSearch and Sysmon components. Requires Administrator.

⬇ Download installer

🪟

EasySiemWindowsAgentSetup.exe

Windows installer · ~7.5 MB

Deploy the agent to other Windows endpoints — asks for the server hostname, API key, and certificate right in the wizard. See Windows Agent above. Requires Administrator.

⬇ Download installer

🐧

easysiem-server.deb

Debian/Ubuntu · amd64

ingest-api, the detect-engine and the Console as systemd services (not OpenSearch — see Linux Server above). Runs as a dedicated unprivileged account.

⬇ Download .deb

🐧

easysiem-agent.deb

Debian/Ubuntu · amd64

The Linux agent as a systemd service — ships journald and auditd events to an EasySIEM server. See Linux Agent above for setup.

⬇ Download .deb

🧱

easysiem-opnsense-agent.txz

FreeBSD pkg(8) · amd64

The OPNsense agent as a FreeBSD package — ships the pf firewall filter log, Suricata alerts, sshd logins, file-integrity changes and FreeBSD's own pkg audit CVE feed. easysiem-opnsense-setup comes with it: one guided command that asks for the server, key and certificate, then starts the service. See OPNsense Agent above.

⬇ Download .txz

📶

easysiem-openwrt-agent.ipk

OpenWRT opkg · 3 architectures · experimental

The OpenWRT agent as an opkg package — ships the system log (logread) and Suricata alerts. Pick the architecture matching your router (check opkg print-architecture if unsure). See OpenWRT Agent above for setup.

⬇ arm64 ⬇ mipsle ⬇ arm

📶

easysiem-openwrt-agent.apk

OpenWRT apk-tools · x86_64 · verified live

For OpenWRT 24.x+ (including 25.x), which replaced opkg with apk-tools — same agent, same features, different package format. Built for the x86/64 target (VMs, PCs, x86 appliances). Unlike the .ipk builds, this one's been installed, run, and uninstalled end-to-end against a real running OpenWRT 25.12.5 instance, with real logread events confirmed landing in OpenSearch. See OpenWRT Agent above for setup.

⬇ x86_64

EasySIEM — a SIEM you run yourself, built on SigmaHQ & OpenSearch

Detection rules you didn't have to write, running on infrastructure you actually control

Architecture

What you get

3,000+ SigmaHQ rules

MITRE ATT&CK mapped

Defender-friendly by design

Real services, not scripts

Dashboards that load

EasySIEM Console

Software inventory, per agent

Live process & service snapshot

Eighteen threat-hunting pages

CVE Watch (optional)

Geo IP

AI Security Review

Alert notifications

Firewall Blocks page

Lateral movement hunting

IP reputation checking

Alert notifications

Per-agent authentication

Windows + Linux agents

Raw log search

Network detection (optional)

Server health

OPNsense agent

OpenWRT agent

A faster daily check-in

Log in

Overview

Alerts

Firewall Blocks

Geo IP

Logs

Hunting

Agent Health, Agent Keys, Server Health, ATT&CK Reference

CVE Watch (optional)

AI Security Review

Change your password

Forgot the password entirely?

System Requirements

Minimum

Recommended

Installation

Download EasySiemSetup.exe

Run it as Administrator

Pick your optional components

Grab your API key

Open the Console

Prerequisites

Install OpenSearch

Build and run ingest-api

Convert Sigma rules and run detections

Build and deploy an agent

Windows Agent

Download and run as Administrator

Enter your server's hostname and API key

Browse to the server's certificate (recommended)

Optionally install Sysmon too

Optionally enable Windows Firewall block auditing

Linux Server

Download and run the installer

Connect another agent

Linux Agent

Download and run the installer — it asks three questions

Confirm it's running

OPNsense Agent

Download and install

Configure — guided

OpenWRT Agent

Check which package manager your router has

Configure

Enable and start

Download

EasySiemSetup.exe

EasySiemWindowsAgentSetup.exe

easysiem-server.deb

easysiem-agent.deb

easysiem-opnsense-agent.txz