Docs for v0.28 to v0.28.2
Docs for v0.26 and v0.27
Docs for v0.25: AI agents (MCP)
Docs for v0.24.1
Docs for v0.24
Docs for v0.23.2
Docs for v0.23.1
Docs for v0.23
Update for v0.22: keep events two years, late-log alert regenerated from the README: Backups and updates opens with Keeping events (two years by default, set on the System page, late events stored under their dates, and the Mass ingestion of late logs alert); Alerts lists the new built-in rule; Configuration, the API reference, Installation and Web UI updated to match; Troubleshooting adds events refused as too old and the late-log alert.
Update for v0.21: Draft a parser, JSON logs as apps print them Parsers describes Draft a parser (SIEMLite builds a parser from samples with no AI model) and pasting JSON as it comes; Sending logs says a body that is all JSON is read one object at a time; the API reference adds /api/v1/parsers/draft.
Update for v0.20: ./update.sh, display names, more AI services regenerated from the README: Installation starts and updates Docker installs with ./update.sh; Backups and updates points to it; Sign in with Microsoft says accounts show their display name and when one isn't shown; Parsers lists the AI services (OpenRouter, Anthropic, Google Gemini, OpenAI, NVIDIA) and what each does with what is sent; the API reference adds api_key, key_for and the cloud-models changes; Troubleshooting adds "./update.sh doesn't finish".
Update for v0.18 and v0.19: sign-in page, AI Parsers regenerated from the README: Parsers describes the AI Parsers integration (a model on this server with Ollama, chosen by hardware, or in the cloud with OpenRouter, and how addresses and host names are replaced and checked before anything is sent); the API reference adds /api/v1/integrations/ai; Configuration updates -ai-url and -ai-model; Installation and the sign-in pages describe the new sign-in page; Home links AI Parsers; Troubleshooting adds "AI Parsers doesn't suggest anything".
Update for v0.16.1 and v0.17: sign-in restrictions Regenerated from the README: Users and security adds Sign-in restrictions (keeping the admin account to the server's local port, Microsoft-only sign-in, the local port, and `siemlite signin reset`) and the separate limit for password-change guesses; Configuration adds -local-addr; Installation notes the local port 8444 published on 127.0.0.1; the API reference adds /api/v1/system/signin and the 403 for refused sign-ins; Sign in with Microsoft links the new option; Troubleshooting adds "The admin account can't sign in" and "The sign-in page has no password form".
Update for v0.15 and v0.16: built-in Let's Encrypt, Account page regenerated from the README: Run on the internet now describes SIEMLite's built-in Let's Encrypt (Caddy is gone); Configuration lists -tls-mode, -domain, -acme-directory and -acme-ca-root; the Web UI and Users and security pages describe the Account page and changing your own password; the API reference adds /api/v1/system/tls and /api/v1/me/password; Troubleshooting replaces the Caddy section with Let's Encrypt causes and adds password changes.
Update for v0.14: Integrations, Microsoft sign-in, running on the internet The pages are now regenerated from the README's sections, so they match it: new pages for Integrations, Sign in with Microsoft and Run on the internet (Caddy, Let's Encrypt, the System page's Web address); Installation, Web UI, API reference, Configuration (new flags), Users and security, Backups and updates updated; Troubleshooting gains Caddy certificate and Microsoft sign-in sections; Home and the sidebar list the new pages.
Update for v0.10: Email page, updating under Docker, image version New Email page documenting the System page's mail server settings, security modes, password handling, test email, and troubleshooting. Backups and updates now describes updating a Docker install from the System page (saved in the data volume, safety net). Installation and Web UI mention them. The API reference gains the system/email endpoints. Troubleshooting gains the test-email causes. Home and sidebar link the Email page. Docker image example is v0.10.
Add the SIEMLite documentation