sigwood
Local-first command-line threat hunting for Zeek, Pi-hole, syslog, and CloudTrail.
Between grep and a SIEM for Zeek, Pi-hole, syslog, and CloudTrail logs.
sigwood is a command-line threat-hunting tool designed for self-hosters and defenders who want log analysis without deploying a full SIEM. You point it at local log files, and it profiles them using ten distinct detectors like beaconing, DGA lookups, and port scans.
What it is
It runs locally over logs at rest without requiring a database, daemon, or network connection, ensuring your logs never leave your machine. Every finding names the exact technique behind the detector and explains why it surfaced using a evidence ledger.
Who it's for
It suits homelabbers, blue teamers, and engineers who manage their own infrastructure logs and want fast, agentless analysis. It does not suit teams looking for a real-time alerting SIEM, managed collectors, or a graphical dashboard out of the box.
Key features
Agentless Log Hunting
Points directly at existing directories or files like Zeek, Pi-hole, syslog, or CloudTrail.
Periodic C2 Detection
Uses Fast Fourier Transform over connection timing to surface outbound beaconing.
DGA and Tunneling Lookup
Clusters DNS queries using HDBSCAN to find machine-generated domain names.
CloudTrail Z-Scores
Computes statistical anomalies for per-principal CloudTrail JSON activity logs.
Self-Contained Graphs
Replays network flows into a single standalone HTML artifact using the graph command.
Up and running in 3 steps
Our honest verdict
What's great
- Runs completely offline without agents, databases, or daemons
- Includes a synthetic corpus generator to test functionality without real logs
- Every finding includes a verbose explanation of the underlying evidence
- Supports a wide array of raw formats including compressed CloudTrail gzip logs
Where it falls short
- Requires Python 3.11+ and manual CLI invocation rather than continuous real-time streaming
- Some detectors like dnsblock, auth, protocol, and ssl must be opted-in manually
- Relies entirely on having pre-existing log files generated by external tools
Pricing & license
Free to use under its MIT license, with no paid hosted options. The only cost is running it yourself on your own hardware.
Open remote AI-training roles
873 open remote AI-training roles, updated November 15, 2026; most pay $20–$170 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Is sigwood a SIEM?
No, it sits between grep and a SIEM. It requires no database, daemon, or network, running strictly on logs at rest.
What log formats does it support?
It supports Zeek logs, Pi-hole and dnsmasq logs, systemd journals, flat syslog, and AWS CloudTrail JSON logs.
