Bifract is an open source SIEM you run on your own infrastructure. Logs are stored and searched in ClickHouse and archived to your object storage as Parquet. On top of that it adds what generic log tools leave out: process provenance graphs, behavioral baselines, and collaborative investigation, all driven by a pipe-based query language built for analysts. There are no license keys or feature gates.

Try It

Run Bifract in your browser with Lab 001, a recorded intrusion, already loaded, nothing to install:

See Try Bifract in Codespaces for what is loaded and what to try.

Quick Start

The setup wizard installs Bifract on a single Linux host, handling SSL, passwords, Docker Compose, and database initialization:

curl -sfL https://docs.bifract.io/install.sh | sh

Read the script first if you’d rather. Upgrade an existing install with sudo bifract --upgrade.

It needs Linux (amd64 or arm64) with Docker Compose. 4 cores and 8 GB of RAM handle about 10 GB of logs a day; see [hardware by ingest…