🍋 LemonSees v2.0.0

🍋 LemonSees v2.0.0

Agentless SOC platform for L1/L2/L3 analysts — SIEM/XDR · EDR · NDR · CTI · SOAR · GRC over SSH. Each host is a managed endpoint where the SSH session is the agent — nothing is installed on your servers.

Design

• BetterStack-inspired UI — deep-charcoal surfaces with soft depth, tabular metrics, subtle brand glow. Clean light + dark themes. Design system documented in DESIGN.md.
• Cloudflare-style navigation — sections → nested sub-tabs, one compact page header per screen, centered content.

Modules

• EDR — live process table (CPU/MEM/uptime) and persistence view (cron, systemd services, timers, startup).
• NDR — full connections view (established + listening + owning process) alongside live traffic.
• CTI — threat intel with attack geo-map, and IP investigation (geo · rDNS · WHOIS · attacker cross-check).
• SOAR — incident register + playbooks incl. the auto-incident brute-force rule.
• Uptime — HTTP monitors, status board, and desktop downtime notifications.
• Metrics — per-host CPU/mem/disk/net/connections history charts.
• SIEM — remote log viewer with severity summary + event histogram.
• GRC — CIS/NIST/ISO compliance, standards reports, audit log.
• Databases — 39 engines (query · browse · REST console).

Install

1. Download LemonSees-v2.0.0-win.zip below.
2. Extract and run LemonSees.exe. Close the window — everything stops, no background services.

The engine binds to 127.0.0.1 only. Optional geo-IP sends only attacker/peer public IPs to a geolocation service; everything else stays local.