v0.30.1

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.30.1 in .env.

Fixed

• A custom JSON parser no longer does unbounded work on a hostile log line. Very large, wide or deeply nested lines are limited, and the same fields are kept on every run (before, which 50 fields were kept changed from run to run).
• A line with many extra keys can no longer push the fields a parser maps (user, source address, severity, app) out of the event. A line that lost fields is marked fields_truncated.
• When a line carries several names for the same field (user, username, account), the real name now wins on every line instead of whichever happened to be applied last. The same holds for the app name.

v0.30

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.30 in .env.

New

• System page: Keep original lines sets how long the line as it arrived is kept (the parsed event stays for the whole retention period). Choose a number of hours up to the maximum, or keep them as long as their events. The default stays 24 hours. Shortening it removes older lines straight away, and the page asks you to confirm first.

Improved

• A JSON log line now keeps every value it carries, not just the ones SIEMLite maps. The rest are stored as extra fields on the event, so nothing is lost when the original line is removed. Nested values become dotted names (for example "deal.stage"), and very large or deeply nested lines are limited.
• The message shown when you open a log whose original line has been removed now says where to change how long lines are kept.

v0.29

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.29 in .env.

Improved

• Event details show a person by their display name only (for example "Jane Doe"), with the account name as a tooltip, the same as the log table. Before, one person could appear as "Jane Doe (jane@example.com)" for one source and "Jane Doe" for another.

v0.28.2

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.28.2 in .env.

Fixed

• If SIEMLite can't look up its own audit source for a moment (a database error), alert rules now wait and look again, instead of counting its alert audit events for that check.
• Counting an alert's events for the group "no value" (events without the source address, user or host the rule groups by) now counts only that group, not every group.
• The one-off alert correction from v0.28.1 skips the built-in rule if an admin has edited its search, so it can't close genuine alerts.

v0.28.1

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.28.1 in .env.

Fixed

• Managing an alert (acknowledging, closing or reopening it) raised new alerts. Each of those actions is written to the audit log with a message that names the alert, and the built-in rule "Mass ingestion of late logs" matched that name, so one real late-logs event led to alert 2, then 3, with every close raising the next.
• No rule, built in or custom, now counts SIEMLite's own audit events about alerts (alert.* actions from the INTERNAL source), however its search is worded. The same holds for a "more than" rule on the INTERNAL source. An outside log whose action starts with alert. still counts.
• The two built-in rules that read the audit log match what the event is, not words in its message: "Mass ingestion of late logs" is action=ingest.late and "Failed sign-ins to SIEMLite" is action=signin.failed. An alert rule's search takes the same field terms as the Database search box (action=..., src_ip=a,b, source=...). On update, those two rules are re-worded only if they are still as shipped; edited and custom rules are left alone.

Improved

• On the first start after updating, the alerts of "Mass ingestion of late logs" that the audit events had raised or inflated are corrected once: an alert with no event of its own is closed (by SIEMLite) and an inflated count is lowered. It is noted in the audit log.
• Database schema v18.

v0.28

Install this version

docker pull ghcr.io/justwaters/siemlite:v0.28

Prebuilt binaries are attached to this release.

New

• A Reset button next to Add rule in the parser editor puts the default keyword severity rules back. Choosing "from a field" on a parser with no rules fills them in for you.

Improved

• A new parser's events are now rated by keyword: for example delete is Medium, admin is High, breach is Critical and fail is Low. A failed login now rates Low.
• The default keyword list is available to admins at GET /api/v1/parsers/severity-defaults.
• Fatal is no longer offered as a parser severity. Parsers that already use it keep it.

Fixed

• On the Integrations page the word beside a switch always said "On", so Email read "On" with its switch off. It now follows the switch, including the sign-in switches on the Users page.
• An integration that isn't set up, such as AI agents (MCP) before the first token, showed its switch on. It now shows Off.

v0.27

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.27 in .env.

New

• Search the Database by field, beside the words: src_ip=192.168.48.20,192.168.48.21 (a comma means any of these), ip= (either address), dst_ip, user="Jonathan Martinez", host, program, source=Firewall, severity=high,critical, category, country, asn, threat=true, and any field a parser picked out, like action=login. Terms are separated by spaces and all apply. It works in the API and the MCP search tool too.
• The Database loads 100 events at a time. Scroll to the end, or choose Show more events, for the next 100. The Newer and Older buttons and Results per page are gone.

Fixed

• Searching a word also found events that merely had a field named after it (such as failed in a log's meta.failed). The search now indexes the values of those fields, not their names.
• A user limited to some sources can't use source= to find out which other sources exist.

Improved

• The first start after updating rebuilds each day's search index, which can take a while on a large database.

v0.26

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.26 in .env.

New

• Everyone is signed out when SIEMLite starts on a different version, however it was updated (the System page's Update and restart, docker compose pull, a new binary, or a rollback). Password and Microsoft sign-ins alike; restarting the same version keeps sessions. The audit log records it, and after Update and restart the sign-in page says why.
• Upgrading to this version signs everyone out once.

v0.25

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.25 in .env.

New

• AI agents (MCP) on the Integrations page. SIEMLite serves the Model Context Protocol at /mcp, so Claude Code, the Gemini CLI, OpenCode and other MCP clients can search logs, read alerts and make changes.
• Make a token for each agent with a level: Read-only (search events, stats, alerts, rules, sources), Analyst (also acknowledge and close alerts) or Admin (also manage sources and parsers). A new token is shown once with copy-ready setup for Claude Code, Gemini CLI, OpenCode and other clients. Removing a token cuts the agent off at once, and the card's switch keeps all agents out.
• Everything an agent changes is recorded in the audit log under the token's name. Users, passwords, sign-in, certificates, email, backups, retention and alert rules can't be changed by an agent.

Improved

• Database schema v17.

v0.24.1

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.24.1 in .env.

Fixed

• The User column in the Database shows a Microsoft account's display name (with the account name as its tooltip and in the event's details) instead of only the account name. Older events show it too, and searching or filtering by user still uses the account name.