# cisagov/LME

Logging Made Easy (LME) is a no cost, open source platform that centralizes log collection, enhances threat detection, and enables real-time alerting, helping small to medium-sized organizations secure their infrastructure. LME Docs can be found at https://cisagov.github.io/lme-docs/docs/

Repository: https://github.com/cisagov/LME
Canonical: https://ross.abutalabs.com/products/lme
Homepage: https://www.cisa.gov/resources-tools/services/logging-made-easy
Language: Shell
License: NOASSERTION
License Family: other
Topics: cybersecurity, elastic, elasticsearch, elk, elk-stack, log, logging, network-analysis, security, security-tools, zeek
Archived: true
Last push: 2026-05-22T17:05:59+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 83, release rhythm 72, longevity 75
- inputs: {"age_days": 1062, "days_push": 103, "days_rel": 110, "gap_med": 65.5, "n_releases_24m": 9}
- flags: archived, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1441, forks 159 (observed 2026-08-28T04:04:44.262146+00:00)

## What it is
CISA's Logging Made Easy (LME) is a free, open-source log management and threat detection platform that bundles Elasticsearch, Kibana, Wazuh, and ElastAlert to centralize log collection and provide real-time alerting. It is designed for small to medium-sized organizations without an existing SOC or SIEM, deployed via Ansible and Podman containers.

## Use cases
- set up a free siem for a small business
- centralize windows sysmon and network logs
- get real-time alerts for malicious activity on my network
- deploy log management without a security operations center
- monitor endpoints for threats on a limited budget
- build custom security dashboards with kibana
- replace paid siem with open source logging

## When to choose
- you are a small or medium organization with no existing SIEM or SOC
- you need a no-cost, self-hosted log management and threat detection stack
- you want pre-integrated Elasticsearch, Wazuh, and ElastAlert with automated Ansible deployment
- you need locally run logging where no third party can access your data

## When to avoid
- you need actively maintained software - CISA retired support effective May 22, 2026
- you already run a full SIEM or SOC with mature tooling
- you need large-enterprise scale log ingestion beyond a small/medium deployment
- you require vendor support or SLAs

## Facets
- artifact type: application
- maturity: maintenance
- function: logging, monitoring, alerting, security, data-visualization, deployment
- domain: security, monitoring, self-hosted
- platform: self-hosted, cli
- tags: siem, elk-stack, wazuh, elastalert, kibana, zeek, sysmon, threat-detection, log-management, cisa, podman, ansible, small-business-security, devops, linux, docker

## Member repositories
- cisagov/LME (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:44.262146+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:36:27.578118+00:00, confidence not recorded.
  - readme: https://github.com/cisagov/LME (fetched 2026-08-28T04:04:44.262146+00:00, sha 3e54be08e623)
  - homepage: https://www.cisa.gov/resources-tools/services/logging-made-easy (fetched 2026-08-29T11:46:46.023757+00:00, sha 6abe16686403)
  - site_page: https://www.cisa.gov/about (fetched 2026-08-29T11:46:46.034166+00:00, sha 46b39cd497d8)
  - site_page: https://www.cisa.gov/about/divisions-offices (fetched 2026-08-29T11:46:46.036417+00:00, sha e90d4b26e2a4)
  - site_page: https://www.cisa.gov/about/regions (fetched 2026-08-29T11:46:46.038386+00:00, sha b5723310e002)
  - site_page: https://www.cisa.gov/about/leadership (fetched 2026-08-29T11:46:46.040534+00:00, sha ae28fd113963)
  - site_page: https://www.cisa.gov/about/doing-business-cisa (fetched 2026-08-29T11:46:46.042527+00:00, sha 582c57d633b2)
  - site_page: https://www.cisa.gov/about/cisa-central (fetched 2026-08-29T11:46:46.044688+00:00, sha 167294190ec7)
  - site_page: https://www.cisa.gov/about/contact-us (fetched 2026-08-29T11:46:46.046468+00:00, sha cc8295ea668a)
  - site_page: https://www.cisa.gov/about/contact-us/subscribe-updates-cisa (fetched 2026-08-29T11:46:46.048155+00:00, sha 44890ece1e2d)
- Data as of 2026-08-30T08:39:29.467469+00:00.