3,000+ community detection rules, a lightweight Go ingestion pipeline, and dashboards that actually load fast — installed as real services (Windows service / Scheduled Task, or systemd on Linux), not a pile of scripts you have to remember to restart.
EasySIEM wires together the pieces of a real SIEM — log collection, storage, detection, and visualization — using SigmaHQ's open, vendor-neutral rule set instead of a proprietary rules language, and OpenSearch/Grafana instead of a SaaS bill.
Custom Go agents on Windows and Linux endpoints ship Event Log, Sysmon, journald, and auditd data over HTTPS to a small ingestion API, which authenticates each agent by its own API key and writes into OpenSearch. A detection engine converts SigmaHQ rules into OpenSearch queries with pySigma and runs them on a schedule, so hits show up as alerts — not just raw logs — in Grafana.
Everything server-side installs as a proper Windows service/Scheduled Task or a systemd unit on Linux, not a console window you have to keep open. And every component — the agents, the ingestion API, the TLS cert generator — is a plain Go binary calling documented OS APIs, which is also why it doesn't trip Windows Defender's heuristics the way a packed, obfuscated tool would. More on that below.
One ingestion path in, three consumers out: real-time detection, dashboards, and live log search.
Windows and Linux detection rules converted to real OpenSearch queries via pySigma — no hand-written detections to maintain.
Plain Go binaries calling documented OS APIs — no packing, no obfuscation, no process injection. Official signed tools (Sysmon, OpenSearch, Grafana) everywhere else.
ingest-api installs as a native Windows service (or systemd unit on Linux); the detect-engine runs as a Scheduled Task (or its own systemd unit). Nothing depends on a console window staying open.
An Overview dashboard with KPI gauges, plus dedicated Events, Alerts, and Agent Health views — provisioned automatically, not built by hand.
Three Grafana alert rules ship out of the box, split by severity (critical/high, medium, low/informational) — firing detections show up under Alerting > Active notifications with zero setup; wire in email/Slack/webhook delivery whenever you're ready.
Every agent gets its own bearer API key over TLS. One compromised agent can't spoof another's identity — ingest-api stamps identity server-side.
One small Go codebase, cross-compiled for both platforms, shipping to the same ingestion pipeline with a shared event schema.
Add Loki and ingest-api dual-writes every event there as a raw log line — live-tail and LogQL-search in Grafana's Explore view, right alongside the dashboards.
Add Suricata and it runs Snort/Emerging-Threats-syntax rules against live traffic itself — its alerts land in the same Grafana Alerts dashboard as Sigma's host-based detections.
Add Prometheus + windows_exporter (or node_exporter on Linux) and a provisioned "Server Health" dashboard shows the SIEM box's own CPU, memory, disk, and network — is the SIEM itself healthy, not just what it's watching.
Add Tempo and ingest-api (instrumented with OpenTelemetry) emits a span per event batch — HTTP handling plus the OpenSearch/Loki calls it makes — browsable in Grafana's Explore > Traces.
A FreeBSD pkg(8) package ships pf firewall filter log and Suricata alerts to the same pipeline — verified end-to-end against a real OPNsense box.
An opkg package (arm64/mipsle/arm) ships OpenWRT's logread system log and Suricata alerts — built and unit-tested, but not yet verified against a real router.
Two ways to get the server running — pick one.
Grab it from the Download section below.
It needs admin rights to register the ingest-api Windows service and the detect-engine's Scheduled Task.
tempo_url is wired into config.json automatically, browsable in Grafana's Explore > Traceseve.json too, if that's also checked) — no manual agent.json editingingest-api.exe only; needed for agents on other machines to reach this server (not needed for the windows-agent checkbox above, which talks to itself over localhost)The installer generates a TLS cert and a starter API key automatically, and writes both — plus next steps — to GETTING-STARTED.txt in the install directory. For more keys later, the installer also drops genkey.exe at C:\Program Files\EasySIEM\bin\genkey.exe — see the callout below.
https://localhost:3000 on the server itself — it opens straight to the Overview dashboard.
Program Files
and restarts a Windows service, both of which need elevation; without it you'll get an
access-denied error. (The & and quotes are separately required whenever
a PowerShell path has a space, like Program Files here — without them it
misreads C:\Program as the command and everything after as arguments.)
& "C:\Program Files\EasySIEM\bin\genkey.exe" -agent-id windows-02 -os windows -restart
Generates the key, wires it into config.json's api_keys
directly, and restarts EasySiemIngestApi so it's live — no manual JSON
editing. Swap -os windows for -os linux when the new agent
is a Linux box instead; genkey just records it for the Agent Health
dashboard. -agent-id can be whatever you want — any string, no format
restrictions.
ingest-api.exe
on exactly TCP 8443, nothing broader.
Already installed without checking that box? Windows Firewall ships with inbound rules
for ingest-api.exe from earlier builds already, but they're scoped to
specific binary paths, not wherever your install actually landed, so add one yourself:
New-NetFirewallRule -DisplayName "EasySIEM ingest-api" -Direction Inbound `
-Program "C:\Program Files\EasySIEM\bin\ingest-api.exe" -Protocol TCP `
-LocalPort 8443 -Action Allow -Profile Any
Run that in an elevated PowerShell prompt on the server (adjust the path if you
installed somewhere other than the default). Confirm it worked from another machine on
the network: curl -k https://<server-hostname>:8443/v1/health should return
ok almost instantly; if it hangs for several seconds and then fails,
that's the firewall.
winget install -e --id GoLang.Go winget install -e --id Python.Python.3.12
.\scripts\install-opensearch.ps1
.\scripts\apply-index-templates.ps1
# from an elevated prompt:
.\scripts\install-grafana.ps1
go build -o bin\ingest-api.exe .\server\ingest
go build -o bin\gencert.exe .\tools\gencert
.\bin\gencert.exe -out-cert server\ingest\certs\server.crt -out-key server\ingest\certs\server.key -hosts localhost,127.0.0.1
# copy config.json.example to config.json, add an API key, then:
.\bin\ingest-api.exe -config server\ingest\config.json
git clone --depth 1 https://github.com/SigmaHQ/sigma.git rules\sigma cd server\detect python -m venv venv .\venv\Scripts\pip install sigma-cli pysigma-backend-opensearch pysigma-pipeline-sysmon requests .\venv\Scripts\python convert_rules.py .\venv\Scripts\python run_detections.py
go build -o bin\windows-agent.exe .\agents\windows
# or, for a Linux endpoint:
$env:GOOS="linux"; go build -o bin\linux-agent .\agents\linux
Full walkthrough — including Sysmon setup and agent config — is in
docs/SETUP.md in the source download. Prefer a wizard over hand-editing
agent.json? See Windows Agent /
Linux Agent below for the dedicated installers instead.
.exe —
ours included — will sometimes trigger a first-run SmartScreen prompt or a brief scan
delay. That's normal, and not something this project tries to evade: every component is
a plain binary calling documented APIs. See docs/DEFENDER.md in the source
download for exclusion commands and code-signing notes if you want to remove the prompt
entirely.
A standalone installer for Windows boxes you want monitored — separate from the server installer above, and separate from its "monitor this box too" checkbox (that one's for the server machine itself; this one's for deploying to other Windows endpoints). Asks for the server hostname and API key right in the wizard.
Grab it from the Download section below.
Need a key? Two ways to get one — both run on the server, not this machine:
Already have a server running? It printed a starter key when
installed, saved to GETTING-STARTED.txt (Windows) or
~/easysiem-getting-started.txt (Linux) — grab it from there if that key
isn't already used by another agent.
Or generate a fresh one (works any time, for any number of agents).
If the server's on Windows, run PowerShell as Administrator first — it
writes into Program Files and restarts a Windows service, both of which
need elevation. (The & and quotes are separately required whenever a
PowerShell path has a space, like Program Files here.)
Windows server:
& "C:\Program Files\EasySIEM\bin\genkey.exe" -agent-id windows-02 -os windows -restart
Linux server:
sudo easysiem-genkey -agent-id windows-02 -os windows -restart
Prints the new key, wires it into the server's config, and restarts the ingest
service so it's live — one line, nothing else to do. -agent-id can be
whatever you want (any string, no format restrictions) — the wizard's own default is
this machine's computer name, so match that if you'd rather not think of one.
Copy server.crt from the server's
C:\Program Files\EasySIEM\server\ingest\certs\ to this machine first,
then browse to it in the wizard. Leave it blank instead to skip TLS verification —
fine for a quick lab test, not for anything beyond one.
A checkbox on the same page — recommended, since windows-agent needs it for process/network telemetry beyond the Security/System/PowerShell logs alone.
agent.json, copies
the certificate, and registers windows-agent.exe as a Scheduled Task
(EasySiemWindowsAgent, runs at startup as SYSTEM — also what lets it read the
Security event log). Re-run the installer to reconnect this box to a different server or
change its key.
Prefer to run the backend on Linux instead of Windows? One guided script installs
ingest-api and the detect-engine (running as a dedicated unprivileged
account rather than root), then walks you through each optional piece one at a
time — OpenSearch, Grafana, Loki, Prometheus, Tempo — and finally asks whether to
install the agent on this same box too, so it monitors itself.
curl -fsSL -O https://easysiem.com/install.sh chmod +x install.sh sudo ./install.sh
Asks before installing anything optional — say no to any piece you don't want, or
already have running your own way. Safe to re-run any time; every step, including
this script itself, checks what's already done first. Ends with a summary (API
key, Grafana URL, next steps) printed and saved to
~/easysiem-getting-started.txt.
The installer already connects this box's own agent if you said yes to that step.
For a different machine: give it the API key from the summary above, a copy of
/var/lib/easysiem-server/certs/server.crt, and
server_url: https://<this-host>:8443. See
Linux Agent below, or build the Windows agent from
source. Need a fresh key later?
sudo easysiem-genkey -agent-id linux-02 -os linux -restart — one
line, already installed by the server package. Swap -os linux for
-os windows when the new agent is a Windows box instead —
-os just records it for the Agent Health dashboard.
-agent-id can be whatever you want — any string, no format
restrictions.
/usr/share/easysiem-server/install-*.sh — run
install-opensearch.sh or install-grafana.sh directly instead
(Loki/Prometheus/Tempo have their own callouts below). Full docs for each, including
what they fix that a plain apt install wouldn't:
/usr/share/doc/easysiem-server/README.md, once the server package is
installed.
easysiem-server account,
not root — unlike the agent, neither service needs any special system access.
sudo apt remove easysiem-server keeps your config and data;
apt purge removes those and the dedicated account too. Full docs, including
how to add more agent keys: /usr/share/doc/easysiem-server/README.md.
Want to remove everything at once — the server, and optionally OpenSearch/Grafana/
Loki/Prometheus/Tempo too — instead of one apt purge at a time?
curl -fsSL -O https://easysiem.com/uninstall.sh chmod +x uninstall.sh sudo ./uninstall.shOnly asks about a piece if it's actually installed; removing the third-party backends defaults to no and says so — those hold real data.
sudo /usr/share/easysiem-server/install-loki.sh — installs Loki from its
official apt repo, binds it to 127.0.0.1 only (it has no built-in auth),
wires the Grafana datasource in, and points ingest-config.json at it. Safe
to re-run any time.
sudo /usr/share/easysiem-server/install-prometheus.sh — installs
Prometheus + node_exporter from Debian/Ubuntu's own repos, binds both to
127.0.0.1 only (neither does by default), and wires the Grafana
datasource in. Safe to re-run any time.
sudo /usr/share/easysiem-server/install-tempo.sh — installs Tempo from
the same Grafana apt repo as Loki, works around a real bug in its stock Debian config
that otherwise crash-loops the service, binds it to 127.0.0.1 only, and
wires up both the Grafana datasource and ingest-config.json's
tempo_url — traces show up in Explore > Traces. Safe to re-run any time.
A .deb package for Debian/Ubuntu boxes you want monitored. Ships
journald and auditd events to an EasySIEM server that's
already running — see Install above if you haven't set that up
yet.
curl -fsSL -O https://easysiem.com/agent-install.sh chmod +x agent-install.sh sudo ./agent-install.sh
Asks for the server hostname or IP, the API key
(from the server's easysiem-getting-started.txt, or generated fresh with
easysiem-genkey on the server), and a
path to the server's server.crt you've copied over
beforehand (leave blank to skip TLS verification instead — fine for a quick lab
test). Writes the config, copies the cert, and starts easysiem-agent
itself — nothing left to do by hand. Safe to re-run any time; it asks before
overwriting an existing config.
sudo systemctl status easysiem-agent journalctl -u easysiem-agent -f
sudo easysiem-genkey -agent-id linux-02 -os linux -restart
Generates the key, wires it into config.json's api_keys
directly, and restarts easysiem-ingest so it's live — no manual JSON
editing.
.deb, or scripting an unattended install?
sudo apt install ./easysiem-agent_1.0.0_amd64.deb still works directly — it
uses debconf for the same three questions, though which frontend actually prompts you
depends on your terminal (falls back to installed-but-unconfigured if none can). Configure
by hand afterward: sudo cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json,
edit it, then sudo systemctl enable --now easysiem-agent — or
sudo dpkg-reconfigure easysiem-agent to retry debconf's prompts (remove
/etc/easysiem/agent.json first; it won't overwrite an existing one on its own).
journalctl -u easysiem-agent -f; a connection that hangs for several seconds
and then times out (rather than failing instantly, or an immediate 401) points at the
firewall specifically, not a bad hostname or key.
/var/log/audit/audit.log (usually root:adm 0640) and the full
journald stream. The systemd unit has a commented-out User=/Group=
for running it as a dedicated account instead (needs adm +
systemd-journal group membership) — see SECURITY.md in the
package's /usr/share/doc/easysiem-agent/.
sudo apt remove easysiem-agent keeps your config; apt purge
removes it too.
ppa:oisf/suricata-stable on Ubuntu), point
it at your interface, run suricata-update for the free ET Open
ruleset, then set "suricata_eve_path": "/var/log/suricata/eve.json"
in agent.json — its alerts land in the same Grafana Alerts dashboard
as Sigma's. Full steps in the README.
A FreeBSD pkg(8) package for OPNsense firewalls. Ships the pf
firewall filter log and, if the os-suricata plugin is installed,
Suricata IDS/IPS alerts, to an EasySIEM server that's already running — see
Install above if you haven't set that up yet.
fetch https://easysiem.com/downloads/easysiem-opnsense-agent-1.0.0.txz pkg add easysiem-opnsense-agent-1.0.0.txz
fetch is FreeBSD's built-in downloader (part of the base system, no
install needed) — run both from the OPNsense console or an SSH session.
cp /usr/local/etc/easysiem/agent.json.example /usr/local/etc/easysiem/agent.json
Edit agent.json: server_url, an api_key
(generate one with genkey on the server — see the callouts under
Install above), agent_id (any string), and either
ca_cert_path pointing at a copy of the server's
server.crt or insecure_skip_verify: true for a quick
lab test. Set filterlog_path if your OPNsense version keeps the
pf log somewhere other than the default
/var/log/filter/latest.log, and suricata_eve_path if
the os-suricata plugin is installed.
sysrc easysiem_opnsense_enable=YES service easysiem_opnsense start
eve.json, if configured) needs it. See SECURITY.md in
the package's docs.
An opkg package for OpenWRT routers. Ships the system log
(logread — firewall drop/accept lines included, if firewall
logging is enabled) and, if installed, Suricata IDS/IPS alerts, to an
EasySIEM server that's already running — see Install
above if you haven't set that up yet.
opkg print-architecture
Match the output against one of the three builds below (generic
aarch64/mipsel_24kc/arm_cortex-a7 —
if none match, see the package README for building your own or using the
raw binary directly).
wget https://easysiem.com/downloads/easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk opkg install easysiem-openwrt-agent_1.0.0_aarch64_generic.ipk
Most current OpenWRT builds' BusyBox wget handles HTTPS fine;
if yours errors on the certificate, opkg install wget-ssl first,
or download the file elsewhere and scp it over instead.
cp /etc/easysiem/agent.json.example /etc/easysiem/agent.json
Edit agent.json: server_url, an api_key
(generate one with genkey on the server — see the callouts under
Install above), agent_id (any string), and either
ca_cert_path pointing at a copy of the server's
server.crt or insecure_skip_verify: true for a quick
lab test. Set suricata_eve_path if you've installed Suricata via
opkg yourself.
/etc/init.d/easysiem-openwrt-agent enable /etc/init.d/easysiem-openwrt-agent start
logread and Suricata's
eve.json (if configured) both need it. The static binary is
roughly 6.5–7.9 MB depending on architecture — fine for most current routers
(128 MB+ flash is common), worth checking df -h / first on
anything older/smaller.
Installs ingest-api as a Windows service and the detect-engine as a
Scheduled Task, with optional OpenSearch, Grafana, and Sysmon components. Requires
Administrator.
Deploy the agent to other Windows endpoints — asks for the server hostname, API key, and certificate right in the wizard. See Windows Agent above. Requires Administrator.
⬇ Download installer
ingest-api + the detect-engine as systemd services (not OpenSearch/Grafana
— see Linux Server above). Runs as a dedicated
unprivileged account.
The Linux agent as a systemd service — ships journald and auditd events to an EasySIEM server. See Linux Agent above for setup.
⬇ Download .debThe OPNsense agent as a FreeBSD package — ships pf firewall filter log and Suricata alerts. See OPNsense Agent above for setup.
⬇ Download .txz
The OpenWRT agent as an opkg package — ships the system log
(logread) and Suricata alerts. Pick the architecture matching
your router (check opkg print-architecture if unsure). See
OpenWRT Agent above for setup.
Agents, ingest-api, the detect-engine, install scripts, and full docs
(SETUP.md, DEFENDER.md, SECURITY.md) — for
building agents yourself or customizing the server.