TinySocs
A self-hosted SIEM for small Windows networks.
TinySocs collects Windows Security, Sysmon, and Defender events from the machines on your network, runs detection rules against them, and shows the results in a web dashboard. A single installer sets up the agent, the detection engine, a bundled OpenSearch instance, and the dashboard on one Windows host. All data is stored locally.
Features
- 19 detection rules enabled by default, 39 included, mapped to MITRE ATT&CK. Rules are YAML files, reloaded on change; a rule builder in the dashboard supports custom KQL rules.
- Automatic Sysmon deployment with a tuned configuration.
- File integrity monitoring for critical system paths.
- Alert notifications via Slack, Microsoft Teams, or email.
- Threat intelligence enrichment (AbuseIPDB, AlienVault OTX, GreyNoise).
- Coverage-mapping reports for NIST CSF, HIPAA, and PCI DSS.
- Optional assistant for querying and summarising alerts, using Claude, OpenAI, or a local Ollama model.
Requirements
| Server | Windows 10 / Server 2019 or later, 64-bit, 8 GB RAM minimum |
| Endpoints | Windows only; approximately 100 per node |
| Network | None required after install; the assistant can run fully offline with Ollama |
Validation
Each enabled rule has an Atomic Red Team test case and unit-test coverage. Results of live attack validation, including rules that could not be exercised, are published in the repository: docs/pilot-ruleset.md.
Support and licensing
TinySocs is a single-developer project provided as-is, without support or a release schedule. Read SUPPORT.md and KNOWN-LIMITATIONS.md before deploying it anywhere that matters.
Licensed under the Business Source License 1.1. Production use is free. Offering TinySocs itself to third parties as a commercial product or service is not permitted. Each released version converts to Apache 2.0 four years after its release. BSL is source-available, not an OSI-approved open source license.