Vigil

Overview

Vigil collects Windows Event Logs or Linux journald with a single binary that sends batches every five seconds. Short-lived enrollment tokens support secure agent onboarding, and deployment requires no cloud account. Apache 2.0 licensing gives teams room to operate and adapt the software, but self-hosting also means taking responsibility for its infrastructure.

The shipped detection library contains 41 Sigma rules across 10 MITRE ATT&CK tactics. This is a useful starting set, not comprehensive coverage for every environment; custom detection rules let teams extend it. Vigil also supports real-time alerting.

Key features

Hunting and response

HQL can search full event history using aggregations, timelines, endpoint filters, time ranges, and field values. That makes it useful for investigating patterns beyond an initial alert, though it favors analysts comfortable querying events rather than relying solely on a dashboard.

Vigil returns structured JSON for AI agents. Destructive actions require explicit human approval: the CLI blocks and polls until someone responds. That safeguard is valuable for teams automating response, but it also means destructive workflows cannot proceed unattended.

SIEM connections and AI workflow

Vigil Connect currently supports Wazuh and Elastic. It extracts four fields—id, severity, source_siem, and the untouched raw alert JSON—so teams can preserve the original alert while passing a defined set of metadata onward. Splunk and Microsoft Sentinel connections are coming soon, not current options.

The Claude Code integration is deployed with npx @vigil/skill and requires neither an MCP server nor a running process. This keeps that setup lightweight for Claude Code users, but does not replace the need to operate Vigil itself.

Pricing

Open Source: 0.00 USD per free. It includes unlimited events (ClickHouse), Sigma detection rules, HQL threat hunting, multi-endpoint support, Windows and Linux agents, forensic collection, and JSON output for AI agents. This is the natural fit for teams able to self-host; the trade-off is that they run the service themselves.

Cloud: custom pricing; billed Coming soon. The planned managed ClickHouse and Postgres service adds automatic updates, a 99.9% uptime SLA, web dashboard, email and Slack alerts, API key management, SSO / SAML, and dedicated infrastructure. It is aimed at teams wanting managed operations, but is not yet an option.

Enterprise: custom pricing; billed Contact us. It includes dedicated infrastructure, SSO / SAML, custom SLA, on-premise deployment, custom detection development, a dedicated Slack channel, annual invoicing, a SOC 2 report, and custom integrations. This fits organizations needing tailored deployment or support; the price requires direct contact.

Platforms

Vigil supports API, Linux, macOS, self-hosted, web, and Windows. The collection details specifically cover Windows Event Logs and Linux journald.

Who it's for

Vigil is best for security teams and developers who want Sigma-based endpoint detection, historical event hunting, and AI-agent output while retaining control of deployment. It is less suitable for teams that need a managed service today, broad SIEM integrations beyond Wazuh and Elastic, or destructive response without a human approval step.

Pros and cons

• Pros: The free core combines unlimited events, HQL hunting, multi-endpoint support, and AI-ready JSON without a cloud account.
• Pros: Human approval gates destructive actions, a practical control for AI-assisted response workflows.
• Cons: Self-hosting puts infrastructure operation on the user, and the managed Cloud plan is still coming soon.
• Cons: Current Vigil Connect integrations are limited to Wazuh and Elastic; Splunk and Microsoft Sentinel are not ready yet.

Alternatives

Consider Wazuh if you want a free, self-hosted open-source option with a paid Small plan starting at 571.00 USD per month. Elastic Security is another freemium option with a free plan and paid Security Analytics Essentials pricing at 0.09 USD per m.

Sumo Logic may suit readers seeking a hosted web option with a free tier capped at 20 daily credits and 7-day log retention for up to 3 users. nano SIEM is another freemium, self-hostable option; its nano engine is open source under AGPL-3.0 and can run without an account or bill.

Seceon Open Threat Management is an alternative with freemium pricing and self-hosted and web platforms. Devo Analytics Cloud is a paid, web-based alternative. CrowdStrike Falcon Surface is paid, has no free plan, and offers a free trial. FortiSIEM is a paid web-based alternative. Browse more options in SIEM Software.

Verdict

Choose Vigil if you want a free, self-hosted foundation for real-time Sigma detection, HQL event hunting, and AI-agent workflows with human approval for destructive actions. Its strongest reason to choose is the breadth of that open-source core; its main reason to look elsewhere is the need for managed service or SIEM connections beyond Wazuh and Elastic today.