- Home
- Alert Management Software
- SEC (Simple Event Correlator)
SEC (Simple Event Correlator)
What it is
SEC (Simple Event Correlator) is a free event-stream tool that detects and responds to combinations of events occurring within defined time windows. It reads lines from files, named pipes, or standard input, then matches patterns such as regular expressions or Perl subroutines. Rule files configure the correlation behavior; documented rule types include threshold, event group, suppression, calendar, and pair rules. For matched events, SEC can run external programs, write files, send data to TCP or UDP servers, or call precompiled Perl subroutines. It runs as one lightweight process, either as a daemon, in shell pipelines, or interactively in a terminal. Listed use cases include event log monitoring, network and security management, and fraud detection. SEC is written in Perl and recommends Perl 5.8 or newer; other dependencies are generally included with standard Perl installations. It is distributed under GPL-2.0. The software is listed for Linux, Windows, and self-hosted use, though some Unix-native functionality is disabled on Windows.
For and against
For
- Free and distributed under GPL-2.0
- Runs as a daemon, pipeline, or terminal process
- Supports suppression and threshold rules
- Can send data to TCP or UDP servers
Against
- Some Unix-native functionality is disabled on Windows
- Recommends Perl 5.8 or newer
- Support questions are directed to a mailing list
The verdict
SEC offers configurable event matching and multiple ways to act on matches, without a plan cost. Windows users should note that some Unix-native functionality is unavailable there.
Who it suits
SEC suits users who want to define event-matching rules and run their own event correlation process. It may fit monitoring, network and security management, or fraud detection workflows.
Plans and prices
SEC (GNU GPL-2.0)
Open-source software distributed under the GNU General Public License
Read 7 Oct 2026 · github.com
On the record
- Deployment limit
- On Windows, some functionality native to Unix is disabled.simple-evcorr.github.io · read 7 Oct 2026
- How it runs
- SEC is a lightweight, platform-independent correlator that runs as a single process and can run as a daemon, in shell pipelines, or interactively in a terminal.simple-evcorr.github.io · read 7 Oct 2026
- Inputs and matching
- SEC reads lines from files, named pipes, or standard input and matches events using patterns such as regular expressions or Perl subroutines.simple-evcorr.github.io · read 7 Oct 2026
- Integrations
- The documentation gives examples of invoking snmptrap and mail and shows an SSH failed-login rule that emails an alert.simple-evcorr.github.io · read 7 Oct 2026
- License
- The project repository states that SEC is distributed under the GNU General Public License and identifies the license as GPL-2.0.github.com · read 7 Oct 2026
- Outputs
- SEC can execute external programs, write to files, send data to TCP or UDP servers, and call precompiled Perl subroutines.simple-evcorr.github.io · read 7 Oct 2026
- Platform support
- SEC has primarily been tested on Linux and Solaris, is known to work on Windows with some Unix-native functionality disabled, and is expected to work on modern Unix platforms.simple-evcorr.github.io · read 7 Oct 2026
- Purpose
- SEC correlates event streams to detect and act on groups of events that occur within defined time windows.simple-evcorr.github.io · read 7 Oct 2026
- Release
- The site lists SEC 2.9.4 as a download dated February 12, 2026.simple-evcorr.github.io · read 7 Oct 2026
- Requirements
- SEC is written in Perl, recommends Perl 5.8 or newer, and otherwise depends only on modules included in standard Perl installations, with Sys::Syslog and JSON::PP optional.simple-evcorr.github.io · read 7 Oct 2026
- Rules
- Event correlation is configured with rule files, and the man page documents rule types including threshold, event group, suppression, calendar, and pair rules.simple-evcorr.github.io · read 7 Oct 2026
- Security capabilities
- The man page documents an option to drop root privileges by switching to a specified user and group when SEC starts with effective user ID 0.simple-evcorr.github.io · read 7 Oct 2026
- Support
- The maker directs usage questions to the SEC users mailing list and asks users not to contact the author with usage questions.simple-evcorr.github.io · read 7 Oct 2026
- Use cases
- The site identifies event log monitoring, network and security management, and fraud detection as use cases.simple-evcorr.github.io · read 7 Oct 2026
