Welcome to Bifract

Bifract is a self-hosted, open source SIEM built on ClickHouse. It adds process provenance graphs, behavioral baselines and collaborative investigation to fast log search, on your own infrastructure.

Where to start

• New to Bifract? Install it, then read Navigating Bifract.
• Deploying on Kubernetes? See Kubernetes and the Sizing Guide.
• Sending logs? See Ingestion.
• Writing queries? Learn BQL basics.
• Setting up alerts? Read Alerting.
• Integrating over the API? Go to the API Reference.

---

Bifract is licensed under the GNU Affero General Public License v3.0.