Events per hour
By severity
Busiest sources
IPs on threat lists
| Time | Severity | Source | Source IP | Destination IP | User | Event |
|---|
Alerts
When a rule matches enough events, an alert opens here. Acknowledge it while you look into it, and close it when you’re done.
| Severity | Alert | Events | First seen | Last seen | Status | Actions |
|---|
| Rule | Fires when | Severity | On | Actions |
|---|
Users
Admins can do everything. Standard users can search, and can be limited to the logs from chosen sources.
| Username | Role | Can see | Added | Actions |
|---|
Keep the admin account to this server
Checking…
Sources
Everywhere logs come from. Applications send logs with an access token; choose a parser to make a source’s logs readable.
| Name | Type | Parser | Last used | Created | Actions |
|---|
Parsers
A parser reads a source’s log lines and picks out the time, IPs, user, severity and anything else worth keeping. Sources without one are parsed automatically.
| Name | Reads | Used by | Updated | Actions |
|---|
New parser
Paste a few log lines, describe their layout, and check the preview.
How to read the lines
Write one line out and put {name} where values change. {} skips text,
and {name:regex} sets exactly what to match, like {status:\d+}.
Fields
Fields appear here as the preview finds them.
| Field | Use as |
|---|
Sample lines
Preview
Add sample lines to see how they’re read.
Integrations
Connect SIEMLite to other services. Set one up, then turn it on.
Send email through your own mail server, for the features that notify people.
Microsoft Entra ID
…Let the people in an Entra group sign in to SIEMLite with their Microsoft account.
Only allow sign-in with Microsoft
Checking…
Account
Role
Theme
Follow your system's light or dark setting, or choose one. It's remembered on this browser.
Sign-in
System
Keep the database safe: back it up, restore it, or move it to another server.
Software update
Checking for updates…
| Created | Type | Size | Actions |
|---|