Vigil
Vigil: A self-hosted SIEM focused on endpoint events, Sigma detections, and HQL hunting. Ranked #25 of 28 in SIEM Software by our editors (6.5/10); pricing: Free plan; best for teams seeking open-source endpoint event detection.
At a glance
- Editor score6.5 / 10
- PricingFree plan
- Best forTeams seeking open-source endpoint event detection
- Free planYes
- Paid fromFree
- Custom detection rulesYes
- Facts checked19 Sep 2026
Where it wins
- Ingests endpoint events over HTTP and evaluates Sigma rules in real time
- Supports HQL hunting, forensic collection, and multi-endpoint monitoring
- Open-source edition includes unlimited events and Windows and Linux agents
Where it doesn't
- Its verified SIEM scope is narrower than broader SIEM options
- Cloud hosting is listed as coming soon
- Enterprise features require contacting sales
Our verdict on Vigil
Vigil is a self-hosted, open-source SIEM for security teams and AI agents focused on endpoint events. It ingests events over HTTP, evaluates Sigma rules in real time, and produces structured JSON alerts and command output. Windows, Linux, and macOS agents, multi-endpoint monitoring, a web dashboard, and forensic artifact collection support endpoint-focused detection and investigation. Short-lived enrollment tokens and human approval gates for destructive actions add controls around enrollment and response. Vigil suits teams that want an open-source system centered on endpoint telemetry and command-line workflows rather than a broad SIEM scope.
The Open Source edition is free and lists unlimited events, Sigma detection rules, HQL threat hunting, multi-endpoint support, Windows and Linux agents, and forensic collection. For teams that prefer managed hosting, the Cloud plan lists managed ClickHouse and Postgres, automatic updates, a web dashboard, email and Slack alerts, and a 99.9% uptime SLA; it is listed as coming soon. Enterprise adds dedicated infrastructure, SSO/SAML, a custom SLA, on-premise deployment, custom detection development, and custom integrations, with pricing handled through sales. The paid tiers therefore focus on hosting and enterprise deployment and support needs, rather than adding a different core detection approach.
Vigil lists integrations with Wazuh, Elastic, Splunk, Microsoft Sentinel, and Claude Code, and supports Windows, Linux, macOS, API, and self-hosted environments. That gives it options for teams connecting endpoint detections to existing security tools, though its stated focus remains narrower than a general-purpose SIEM. Choose Vigil if open-source endpoint monitoring, Sigma rules, HQL hunting, and forensic collection fit your workflow. Teams that need managed service availability now or a wider SIEM scope should consider alternatives; Cloud is not yet available, while Enterprise is aimed at custom requirements.
Your product? Our editors can test Vigil in depth and publish a review, labelled as paid · from $149/mo →
Vigil pricing
All 3 Vigil plans and prices →
Vigil fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Free ingestion limit | Not verified |
| Data retention | Not verified |
| Custom detection rules | Yes |
| Real-time alerting | Yes |
| Deployment | Self-hosted |
| Query language | HQL |
| Deployment | Desktop, Self-hosted |
| Platforms | Windows, Linux, macOS |
| Integrations | 5 integrations: Wazuh, Elastic, Splunk, Microsoft Sentinel, Claude Code |
| Pricing | Free plan (source) |
| Website | vigil-siem.com |
| Facts checked | 19 Sep 2026 |
Vigil integrations
Vigil lists 5 integrations on its own site.
- Wazuh
- Elastic
- Splunk
- Microsoft Sentinel
- Claude Code
Alternatives to Vigil
- Elastic SecurityFlexible SIEM coverage with detection, threat hunting, and response workflows.9.4
- CrowdStrike Falcon Next-Gen SIEMA cloud-only SIEM combining cross-domain search, CQL detections, and automated response.9.2
- FortiSIEMA broad IT/OT SIEM with multivendor collection, analytics, case management, and SOAR.9.0
Used Vigil? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Vigil for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Vigil is listed in our SIEM Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/vigil/"><img src="https://www.itechguides.com/best/badge/vigil.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update