Vigil review
A self-hosted SIEM focused on endpoint events, Sigma detections, and HQL hunting.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Vigil is a self-hosted, open-source SIEM for security teams and AI agents focused on endpoint events. It ingests events over HTTP, evaluates Sigma rules in real time, and produces structured JSON alerts and command output. Windows, Linux, and macOS agents, multi-endpoint monitoring, a web dashboard, and forensic artifact collection support endpoint-focused detection and investigation. Short-lived enrollment tokens and human approval gates for destructive actions add controls around enrollment and response. Vigil suits teams that want an open-source system centered on endpoint telemetry and command-line workflows rather than a broad SIEM scope.
The Open Source edition is free and lists unlimited events, Sigma detection rules, HQL threat hunting, multi-endpoint support, Windows and Linux agents, and forensic collection. For teams that prefer managed hosting, the Cloud plan lists managed ClickHouse and Postgres, automatic updates, a web dashboard, email and Slack alerts, and a 99.9% uptime SLA; it is listed as coming soon. Enterprise adds dedicated infrastructure, SSO/SAML, a custom SLA, on-premise deployment, custom detection development, and custom integrations, with pricing handled through sales. The paid tiers therefore focus on hosting and enterprise deployment and support needs, rather than adding a different core detection approach.
Vigil lists integrations with Wazuh, Elastic, Splunk, Microsoft Sentinel, and Claude Code, and supports Windows, Linux, macOS, API, and self-hosted environments. That gives it options for teams connecting endpoint detections to existing security tools, though its stated focus remains narrower than a general-purpose SIEM. Choose Vigil if open-source endpoint monitoring, Sigma rules, HQL hunting, and forensic collection fit your workflow. Teams that need managed service availability now or a wider SIEM scope should consider alternatives; Cloud is not yet available, while Enterprise is aimed at custom requirements.
Vigil pros and cons
- Where it wins
- Ingests endpoint events over HTTP and evaluates Sigma rules in real time
- Supports HQL hunting, forensic collection, and multi-endpoint monitoring
- Open-source edition includes unlimited events and Windows and Linux agents
- Where it doesn't
- Its verified SIEM scope is narrower than broader SIEM options
- Cloud hosting is listed as coming soon
- Enterprise features require contacting sales
Vigil fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update