Vigil

Vigil is a self-hosted, open-source system that ingests endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs without a cloud account and uses the Apache 2.0 license. Its detection library includes 41 Sigma rules across 10 MITRE ATT&CK tactics. HQL can search event history with aggregations, timelines, endpoint filters, time ranges, and field values. A single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil Connect supports Wazuh and Elastic, while Splunk and Microsoft Sentinel are listed as coming soon. When a destructive action is requested, the CLI blocks and polls until a person approves. A Claude Code integration is deployed with npx @vigil/skill and does not require an MCP server or running process. The free Open Source plan lists unlimited events, multi-endpoint support, forensic collection, and JSON output. Cloud is listed as coming soon; Enterprise details require contacting the provider.

Vigil combines endpoint collection, Sigma detections, event hunting, and JSON output in a self-hosted package. The free Open Source plan is listed, while Cloud is not yet available and Enterprise details require contacting the provider.

Vigil suits teams seeking self-hosted endpoint-event detection and structured output for AI agents. It may also suit users who need HQL event hunting or explicit human approval for destructive actions.

Vigil is an open-source security event platform for teams that want endpoint telemetry, Sigma detections, and AI-ready output on infrastructure they control. It best suits developers and security operators who are comfortable running a self-hosted service. The trade-off is clear: the core is unusually capable at no software cost, while managed hosting and its operational convenience are not yet part of the product.

Overview

Vigil ingests Windows Event Logs and Linux journald, evaluates Sigma rules as events arrive, and produces structured JSON for AI agents. Its single-binary collector sends batches every five seconds, so it is designed for continuous collection rather than occasional exports. Short-lived enrollment tokens make onboarding safer than handing agents permanent credentials.

Deployment is self-hosted, open source, and Apache 2.0 licensed. It can be deployed in five minutes and does not require a cloud account, which favors organizations that need control over placement and data. That control also means the operator owns availability, upgrades, and infrastructure work.

Key features

Detection and investigation

The included library contains 41 Sigma rules covering 10 MITRE ATT&CK tactics. This gives a new installation meaningful baseline coverage, but it is not a complete program for every environment; custom detection rules are available when teams need organization-specific logic. Real-time alerting helps surface matching activity promptly.

HQL searches the full event history with aggregations, timelines, endpoint filters, time ranges, and field values. Analysts can move from an alert to broader historical investigation without changing tools. HQL is a strength for teams willing to learn a query language and a less suitable approach for readers seeking only point-and-click investigation.

Agent safety and integrations

Destructive actions require explicit human approval. The command-line interface blocks and polls until someone responds, putting a deliberate human checkpoint around potentially damaging automation. That is valuable for AI-assisted operations, although it also prevents fully autonomous response.

Vigil Connect currently works with Wazuh and Elastic. Its raw-alert handling extracts only the alert ID, severity, source SIEM, and untouched raw-alert JSON, preserving source context while keeping the integration payload narrow. Splunk and Microsoft Sentinel connections are coming soon. The Claude Code integration installs with npx @vigil/skill and needs neither an MCP server nor a separate running process, which lowers the setup burden for that workflow.

Pricing

The free Open Source plan is the practical choice for individuals and teams able to operate their own stack; its event allowance is unlimited, but it does not provide managed hosting or the Cloud plan’s service commitments. Cloud is aimed at organizations that want operations, updates, dashboarding, and identity features handled for them once it launches. Enterprise is for buyers needing contractual customization, compliance material, or dedicated support, with pricing determined case by case.

Platforms

Vigil supports API, Linux, macOS, self-hosted, web, and Windows environments. Collection itself targets Windows Event Logs and Linux journald, while the API, web, and cross-platform availability support surrounding workflows and administration.

Who it's for

Choose Vigil if your team needs endpoint collection and Sigma-based detection without opening a cloud account, or if structured JSON is central to an AI-agent workflow. It is particularly well matched to developers and security teams that can maintain self-hosted infrastructure and write HQL or custom rules.

It is a weaker fit for organizations that require a currently available managed service, turnkey dashboards, or hands-off maintenance. Those needs depend on the forthcoming Cloud plan or on another SIEM.

Pros and cons

Pros

• Free, unlimited-event core: The Open Source plan includes ClickHouse event capacity without a metered event cap.
• Useful investigation depth: HQL offers history-wide aggregations, timelines, filters, ranges, and field values.
• AI-conscious safeguards: Structured JSON output and mandatory approval for destructive actions support automation without removing human control.
• Controlled deployment: Apache 2.0 licensing, self-hosting, and short-lived enrollment tokens suit data-sensitive environments.

Cons

• Operations remain your responsibility: Self-hosting avoids a cloud account but requires your team to run and maintain the service.
• Baseline coverage is finite: Forty-one rules across ten tactics are a starting point, not comprehensive detection coverage.
• Managed features are not available yet: Cloud is coming soon, so its SLA, dashboard, alerts, and managed databases cannot currently be used.
• Integration coverage is still growing: Wazuh and Elastic work now, while Splunk and Microsoft Sentinel are future integrations.

Alternatives

For a broader directory of security information and event-management products, see SIEM Software.

Kaspersky Research Sandbox is the better choice when you need paid cloud or on-premise deployment, including air-gapped environments, rather than Vigil’s free self-hosted model.

Blumira suits buyers who prefer a paid SIEM with a free trial and a $12.00-per-month Detect plan offering cloud and local-network visibility, pre-tuned detections, and one-year log retention.

Elastic Security is an alternative freemium platform for teams already standardizing on Elastic’s API, Linux, self-hosted, or web stack.

Wazuh is worth choosing when you want another free, open-source self-hosted option, with paid Small deployments starting at $571.00 per month.

Sumo Logic fits teams wanting a web service with a free tier of 20 daily credits, seven-day log retention, and up to three users.

Devo Analytics Cloud is a paid web alternative centered on interactive visualizations, multitenancy, advanced analytics, and open APIs.

nano SIEM offers an AGPL-3.0 open-source engine that can be self-hosted without an account, with a Hobby plan at $26.00 per month.

Panther is another paid SIEM option with a free trial.

Verdict

Vigil is a strong recommendation for technically capable teams that want a no-cost, self-hosted detector with HQL hunting and structured output for AI agents. Choose it for control, unlimited Open Source event capacity, and human-gated response. Look elsewhere if you need a managed service today, broad turnkey integrations, or an operational SLA that does not depend on your own infrastructure.