Vigil

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Vigil is ranked #3 of 23 in SIEM software on Inferse. It runs on API, Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

Compared on SIEM software

Free plan: Yesvigil-siem.com
Custom detection rules: Yesvigil-siem.com
Real-time alerting: Yesvigil-siem.com
Deployment: self-hostedvigil-siem.com
Query language: HQLvigil-siem.com

Facts

Product purpose: Vigil ingests endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents.vigil-siem.com · 2 Oct 2026
Deployment: Vigil is self-hosted, open source, deployable in five minutes, and requires no cloud account.vigil-siem.com · 2 Oct 2026
License: Vigil is released under the Apache 2.0 license.vigil-siem.com · 2 Oct 2026
Detection library: Vigil ships with 41 Sigma rules across 10 MITRE ATT&CK tactics.vigil-siem.com · 2 Oct 2026
Event hunting: HQL can query full event history with aggregations, timelines, endpoint filters, time ranges, and field values.vigil-siem.com · 2 Oct 2026
Human approval: Destructive actions require explicit human approval, with the CLI blocking and polling until a response.vigil-siem.com · 2 Oct 2026
Agent collection: The single binary collects Windows Event Logs or Linux journald and ships batches every five seconds.vigil-siem.com · 2 Oct 2026
Platforms: The agent is a dependency-free single binary for Windows, Linux, and macOS, and Vigil includes a web dashboard.vigil-siem.com · 2 Oct 2026
Security onboarding: Vigil supports secure agent onboarding through short-lived enrollment tokens.vigil-siem.com · 2 Oct 2026
SIEM integrations: Vigil Connect supports Wazuh and Elastic now, while Splunk and Microsoft Sentinel integrations are listed as coming soon.vigil-siem.com · 2 Oct 2026
Raw alert handling: Vigil Connect extracts only id, severity, source_siem, and the untouched raw alert JSON.vigil-siem.com · 2 Oct 2026
Claude Code: The Claude Code integration is deployed with npx @vigil/skill and requires no MCP server or running process.vigil-siem.com · 2 Oct 2026
Support: Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report.vigil-siem.com · 2 Oct 2026