Skip to content

Releases: nizartuanku/loglight

Release list

v0.2.0 — Network Traffic Map

v0.2.0 — Network Traffic Map Latest
Latest

Choose a tag to compare

View all tags
@nizartuanku nizartuanku released this 24 Aug 04:06
v0.2.0
26f4484
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Loglight now sees the network, not just the logs.

New in this release:

• NetFlow v5 / v9 / IPFIX ingest — add a netflow source, point your router or firewall's flow export at it (MikroTik, pfSense, FortiGate, Cisco, Ubiquiti). No agent, no packet capture; flow metadata only.
• 3D Network Map — a live, rotatable WebGL map of who talks to whom: node size = traffic, links = conversations, hosts with active detections glow by severity. Fully offline (vendored renderer, no CDN).
• Two new detections: Beaconing (regular-interval calls to one external endpoint — the C2 heartbeat) and New service (a host starts accepting connections on a never-seen port).
• The existing scan and exfiltration detectors now also fire from flow telemetry, and flow events feed the kill-chain correlator.

Upgrading: stop the binary, swap it, start again — the database migrates automatically, licenses unchanged.

Download: loglight-free-0.2.0-linux-amd64.tar.gz. Verify with SHA256SUMS (sha256sum -c SHA256SUMS). Apache-2.0.

Free edition: 1 source, 3-day retention. Pro/Team at whop.com/nizar-tuanku/loglight — 14-day trial.

Assets 4
Loading

v0.1.0

v0.1.0

Choose a tag to compare

View all tags
@nizartuanku nizartuanku released this 21 Aug 23:34
v0.1.0
62bacbc

Loglight v0.1.0

Self-hosted SIEM-lite: syslog (UDP/TCP, RFC 3164/5424), file tail, journald/docker ingest; curated detections (brute force, credential stuffing, port scan, exfil volume, new admin) plus cross-source kill-chain correlation (scan → brute → success = one incident).

This is the free edition, built from this repository with an empty license issuer key — it has no license activation. Free-tier limits: 1 source, 3-day retention. Pro and Team tiers (higher limits, delivered binaries) are available at whop.com/nizar-tuanku/loglight.

Install

tar -xzf loglight-free-0.1.0-linux-amd64.tar.gz
./loglight

Dashboard: http://127.0.0.1:8427 — single binary, SQLite storage in the working directory, no telemetry, nothing leaves your network.

Or build from source (Go 1.24+, CGO required for the SQLite driver):

go build ./cmd/loglight

Integrity

Verify the download:

sha256sum -c SHA256SUMS

SHA-256: 71810713abf5e2c4fa15f91683d3cbed1f12efa3e71fdb4d301ac390a719254d

Feedback

Run it in a lab first. Bug reports and lab feedback via GitHub Issues are very welcome.

Loading