Your SIEM bill shouldn't grow with every log line.
ExSIEM is a free, open-source SIEM that keeps years of searchable logs for dollars, not licenses. Be among the first teams to run it in a real environment and decide what ships next.
GPLv2 · self-hosted · no license key · no ingest pricing
- events/sec sustained on a 4-vCPU VM, zero loss
- 19,025events/sec sustained on a 4-vCPU VM, zero loss
- to retain 1 billion events for a month on S3
- $0.95to retain 1 billion events for a month on S3
- p50 recent-window search (4-vCPU test VM)
- 4 msp50 recent-window search (4-vCPU test VM)
- cold-tier compression (41 bytes/event)
- 17.6×cold-tier compression (41 bytes/event)
Platform
Everything a SOC needs, in the box, on day one.
3,888 log parsers
Firewalls, endpoints, cloud, identity and SaaS out of the box, normalized into ExNorm so ip_src, SourceAddress and sourceIp all mean source.ip.
1,300+ detection rules, MITRE-mapped
Correlation rules ready on day one, with Sigma import and export so your rule library can live in git.
Tiered storage, flat cost
Hot search in PostgreSQL, a ClickHouse long-range tier and encrypted Parquet on S3-compatible storage. Years of logs, searchable.
52 SOAR playbooks
Automate containment and enrichment with a visual playbook builder instead of glue scripts.
UEBA and AI triage
Statistical self and peer-group baselines, plus agentic triage with your own model, including local LLMs.
Enterprise identity built in
Per-tenant SAML and OIDC SSO, passkeys, enforced MFA and SCIM provisioning from Okta or Entra ID.
ExQL
One query across ninety days of logs.
Hot, long-range and cold storage answer through a single search language. The query plan tells you which tiers served the result, so retention stops being a licensing decision.
# search the last 90 days for one address
logs last 90d sourceIp:203.0.113.44 | tail 100
served by hot clickhouse s3 parquet
Why join the beta
Help build the SIEM you wish you had, with the person building it.
Direct line to the maintainer
Issues from beta members jump the queue. The track record is same-week, root-caused fixes.
Your roadmap, not ours
Early members tell us what to build next: detection content, integrations and deployment targets.
Founding-member standing
ExSIEM is open source and free to run. Beta members get public credit if they want it. Paid support and other commercial services are planned for later.
Private repository access
Approved members are invited to the private beta repository, with Docker and Ubuntu installers so you are running in minutes.
What we ask of you
Not money. A little of your time and honest feedback.
- Run it. In a lab, a non-critical segment, or in shadow mode next to your current SIEM.
- Break it and say so. File issues. Be blunt. Fixes are root-caused and public.
- Shape it. A short call each month on what a SIEM should do that yours doesn't.
How it works
From application to first alert in three steps.
- 01
Apply with GitHub
Sign in with GitHub and tell us about your environment. It takes about two minutes.
- 02
Get approved
Every application is read by a person. Approved applicants get a GitHub invitation to the private beta repository.
- 03
Install and ship feedback
Deploy with Docker in about five minutes, then tell us what breaks and what you need next.
FAQ
Straight answers.
What does it cost?+
Nothing. ExSIEM is GPLv2 with no feature gates, no ingest pricing and no license key.
Do my logs leave my network?+
No. ExSIEM is self-hosted. You run it on your own Docker host or Ubuntu server, and your data stays there.
Is it production ready?+
Not yet, and we say so. ExSIEM is pre-1.0 with deep engineering and published benchmarks, but no production deployments so far. Run it in shadow mode next to your current SIEM and judge it on behavior. That is exactly what the beta is for.
What do I need to run it?+
A Docker host, or Ubuntu 24.04 LTS or newer for the one-line installer, plus a GitHub account to apply and receive access.
Who decides who gets in?+
The maintainer reads every application. Tell us about your environment and what you want to test, and we will get back to you.
Ready to run a SIEM that scales with your ambitions, not your invoice?
Applying takes about two minutes with your GitHub account.
Apply for the beta