// the find
utmstack/UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
UTMStack is a self-hosted SIEM/XDR platform combining a Go-based agent and collector layer, a JHipster/Spring Boot backend, and a TypeScript frontend, aimed at MSPs and security teams who want an on-prem alternative to Elastic-based SIEM stacks. It's for someone with a homelab or small security team willing to run real infrastructure, not for a quick Docker Compose evaluation.
The correlation engine runs before ingestion rather than being a query layer bolted onto Elasticsearch or Grafana, which cuts storage and query load compared to the typical 'ELK plus dashboards' SIEM pattern. Data source coverage is genuinely broad and already implemented, not just roadmap items: netflow v1/v5/v6/v7/v9 and IPFIX parsers, auditd, syslog framing, Windows event channels, and even an AS/400 collector. Agent-to-server auth uses per-connection TLS plus a 24+ character unique key, and services are split into isolated containers rather than one monolith.
It's open-core: the README states AI-powered analysis, faster correlation, and frequent threat intel updates are enterprise-only, so the OSS version you're evaluating isn't the full product being marketed. Minimum sizing starts at 4 cores/16GB RAM for just 50 data sources, so this isn't something you spin up on a spare VM to try out. Installation is a single opaque `installer` binary run as root rather than an inspectable docker-compose or Terraform setup, which is a lot of trust to extend to a security product. AGPL-3.0 licensing will be a hard no for companies that want to fork or embed it without reciprocal disclosure, and the active v10-to-v11 migration notice signals the kind of breaking-change churn you should expect before committing production log sources to it.