v0.1.0
Loglight v0.1.0
Self-hosted SIEM-lite: syslog (UDP/TCP, RFC 3164/5424), file tail, journald/docker ingest; curated detections (brute force, credential stuffing, port scan, exfil volume, new admin) plus cross-source kill-chain correlation (scan → brute → success = one incident).
This is the free edition, built from this repository with an empty license issuer key — it has no license activation. Free-tier limits: 1 source, 3-day retention. Pro and Team tiers (higher limits, delivered binaries) are available at whop.com/nizar-tuanku/loglight.
Install
tar -xzf loglight-free-0.1.0-linux-amd64.tar.gz
./loglight
Dashboard: http://127.0.0.1:8427 — single binary, SQLite storage in the working directory, no telemetry, nothing leaves your network.
Or build from source (Go 1.24+, CGO required for the SQLite driver):
go build ./cmd/loglight
Integrity
Verify the download:
sha256sum -c SHA256SUMS
SHA-256: 71810713abf5e2c4fa15f91683d3cbed1f12efa3e71fdb4d301ac390a719254d
Feedback
Run it in a lab first. Bug reports and lab feedback via GitHub Issues are very welcome.