wtf is sigwood?

sigwood is a command-line tool for threat hunting through logs you already have, built for people who self-host and want to check their own systems for signs of compromise. You point it at a folder of logs from Zeek, Pi-hole, syslog, or CloudTrail, and it profiles what is in them, then runs a set of detectors looking for things like periodic network callbacks, suspicious DNS lookups, port scans, rare syslog events, unusually long connections, and unusual CloudTrail activity. The project is explicit about what it is not: not a SIEM, not an agent, not a magic black box. There is nothing to deploy, no database, no background service, and no account to create. You install it, point it at a directory of logs sitting on disk, and read the output, and your logs never leave your machine. Each finding names the specific technique behind it, such as an FFT analysis of connection timing or clustering over DNS query behavior, so you can understand why something was flagged rather than just trusting a score. Before running the full set of detectors, you can use a digest command to get a quick factual summary of a log file, like its time span and top talkers, so you know where to focus. There is also a graph command that turns activity into a visual HTML report. The tool ships with a small synthetic set of example logs, including one simulated compromised host, so you can try it out before pointing it at real data. It filters out known-harmless infrastructure by default before analysis, and reports how much noise it removed. Output can be produced as readable text, HTML, or PDF reports, as JSON for scripting, as CSV for triage lists, or as an animated graph. It requires Python 3.11 or newer and can be installed with pipx or pip. The project describes itself as early and pre-1.0, though its six detectors are covered by tests. It is released under the MIT license.