Signalith 0.1.0

Install

System	Download
Debian, Ubuntu	signalith_0.1.0-1_amd64.deb or _arm64.deb, then sudo apt install ./signalith_0.1.0-1_amd64.deb
Red Hat, Rocky, Alma, Fedora, SUSE	signalith-0.1.0-1.x86_64.rpm or .aarch64.rpm, then sudo dnf install ./signalith-0.1.0-1.x86_64.rpm
Windows	signalith-0.1.0-x64.msi, double-click it
Docker	docker pull ghcr.io/jrsamsanchez/signalith:0.1.0

Then sudo signalith initial-password (on Windows, signalith initial-password in PowerShell as Administrator) shows the first admin password. Signalith needs OpenSearch 2.x; see Install from packages.

Check your download

gh attestation verify <file> --repo jrsamsanchez/Signalith

or check SHA256SUMS against SHA256SUMS.sigstore.json (Sigstore) or SHA256SUMS.asc (GPG, key signalith-release-key.asc), as the docs show. The SBOM is in signalith-0.1.0.spdx.json (SPDX) and signalith-0.1.0.cdx.json (CycloneDX).

What's Changed

• Phase 1: search foundation (ingest, query language, builder, UI) by @jrsamsanchez in #1
• Phase 2: detections, findings queue, Sigma import and ATT&CK coverage by @jrsamsanchez in #2
• Phase 3: risk-based alerting and asset and identity context by @jrsamsanchez in #3
• Phase 3: ask in plain English by @jrsamsanchez in #4
• Phase 3: posture dashboards by @jrsamsanchez in #5
• Phase 3: threat intel feeds by @jrsamsanchez in #6
• Investigation cases by @jrsamsanchez in #7
• New look: sign-in page, logo and redesigned UI by @jrsamsanchez in #9
• Rebuild Signalith on every docker compose up by @jrsamsanchez in #10
• Let agents on other machines find the server by @jrsamsanchez in #11
• Start the Docker quick start again after a reboot by @jrsamsanchez in #12
• Add a trademark notice by @jrsamsanchez in #13
• Receive syslog from other systems by @jrsamsanchez in #14
• Set up syslog senders from Add data and see them on Health by @jrsamsanchez in #15
• Build with Go 1.26.9 and check for known vulnerabilities in CI by @jrsamsanchez in #16
• Threat intel feeds you can add from the web page by @jrsamsanchez in #17
• Users, roles and Active Directory / LDAP sign-in by @jrsamsanchez in #18
• Data retention policies, disk guard, archives and restore by @jrsamsanchez in #19
• Security batch 1: ingest, search and web server limits, secret redaction, OpenSearch TLS by @jrsamsanchez in #20
• Server Settings page with checked saves and restart in place by @jrsamsanchez in #21
• Encrypt stored passwords and keys at rest, and harden the server process by @jrsamsanchez in #22
• About window crediting Samuel Sanchez Jr., with a link to the GitHub repository by @jrsamsanchez in #24
• HTTPS by default, and a Docker quick start with a secured OpenSearch and no default passwords by @jrsamsanchez in #23
• docs: trust the CA per user, and state what a stolen CA key could do by @jrsamsanchez in #25
• Servers that share one OpenSearch: identity, job lease with automatic takeover, and a Servers page by @jrsamsanchez in #26
• Sample data: a week of activity with attacks to try Signalith on, removable in one click by @jrsamsanchez in #27
• Security page: checks how Signalith is set up and what to fix first, plus a strict certificate authority option by @jrsamsanchez in #28
• Website: a project site published to GitHub Pages by @jrsamsanchez in #29
• Website: LinkedIn link on the creator credit, uncropped logo by @jrsamsanchez in #30
• CI: fix flaky cluster, Docker health and Windows asset-reload checks by @jrsamsanchez in #31
• Security: tie IP-address agents to this server, and limit Signalith's CA to websites by @jrsamsanchez in #32
• Security hardening: idle sign-out, static files, ingest retries, Windows install, repo basics by @jrsamsanchez in #34
• OpenTelemetry log intake (OTLP/HTTP) and a Collector option on Add data by @jrsamsanchez in #35
• Security batch 6: bound slow searches, cap uploads, close detection gaps by @jrsamsanchez in #33
• Fix the build on main: OTLP intake and the new write signature by @jrsamsanchez in #37
• Security re-audit: sample data, event and users-file integrity by @jrsamsanchez in #38
• Security re-audit: Docker quick start refuses the public agent token on new installs by @jrsamsanchez in #39
• Security re-audit: sign-in lockout that proxies and NATs cannot turn against users by @jrsamsanchez in #40
• Data models for file, registry, DNS, DLL, script, inventory, configuration check and alert events by @jrsamsanchez in #42
• Docker start loads OpenSearch's security settings itself, and Signalith explains when they're missing by @jrsamsanchez in #41
• Response actions: block an IP, disable an AD user or isolate a host from a finding or case by @jrsamsanchez in #46
• Notifications: send findings to Slack, Teams, email or a webhook by @jrsamsanchez in #49
• Update Go dependencies to their latest releases by @jrsamsanchez in #43
• Antivirus logs: Microsoft Defender, ClamAV and syslog antivirus products, with malware detections and a dashboard by @jrsamsanchez in #48
• Fix flaky cluster tests, and a lease taken back when moving to another OpenSearch by @jrsamsanchez in #50
• Manage hosts with osquery: file changes, inventory and configuration checks by @jrsamsanchez in #47
• Wazuh alerts: Fluent Bit on the manager, or its syslog JSON output by @jrsamsanchez in #52
• Releases: signed .deb, .rpm and .msi packages, SBOM, GHCR image, docs site by @jrsamsanchez in #44
• Detection content: 1,055 tested SigmaHQ rules, off by default by @jrsamsanchez in #45
• Website: Docs links open signalith.io/docs by @jrsamsanchez in #54
• Endpoint model: call_trace and remote thread start fields by @jrsamsanchez in #59
• Playbooks: run steps automatically when a detection fires, with analyst approval for disruptive ones by @jrsamsanchez in #51
• Release: dry runs build a version above the latest release by @jrsamsanchez in #61
• Registry model: registry_new_path for renamed keys by @jrsamsanchez in #63
• Detection content: Sysmon file, registry, DNS, DLL and process access rules by @jrsamsanchez in #62
• Tuning: detection exceptions, maintenance windows and "don't alert on this again" by @jrsamsanchez in #66
• Per-agent tokens: named, revocable tokens, and every event records who sent it by @jrsamsanchez in #64
• Cluster: fix a fence-timer race that made lease tests time out by @jrsamsanchez in #67
• Demo tour fixes: clean detection names, time picker follows the query, sign-in lands on Dashboards by @jrsamsanchez in #65
• Detection content: PowerShell script block rules by @jrsamsanchez in #68

Full Changelog: https://github.com/jrsamsanchez/Signalith/commits/v0.1.0

Content updates

Signed content pack updates that Signalith servers download (Detections page, or detections.content_updates: daily). Not a Signalith release: see the other releases for the program. docs/detections.md explains content updates.