{"name":"Tailpipe: An Open Source SIEM for Instant Log Insights with DuckDB","description":"Tailpipe is an open source SIEM designed for instant log insights, powered by DuckDB. It allows users to analyze millions of events in seconds directly from their terminal using SQL queries. This tool is ideal for developers and security professionals seeking a lightweight, efficient, and flexible solution for log analysis across various cloud and application sources.","github":"https://github.com/turbot/tailpipe","url":"https://osrepos.com/repo/turbot-tailpipe","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/turbot-tailpipe","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/turbot-tailpipe.md","json":"https://osrepos.com/repo/turbot-tailpipe.json","topics":["SIEM","Log Analysis","DuckDB","Go","Open Source","Threat Detection","Cloud Security","Incident Response"],"keywords":["SIEM","Log Analysis","DuckDB","Go","Open Source","Threat Detection","Cloud Security","Incident Response"],"stars":null,"summary":"Tailpipe is an open source SIEM designed for instant log insights, powered by DuckDB. It allows users to analyze millions of events in seconds directly from their terminal using SQL queries. This tool is ideal for developers and security professionals seeking a lightweight, efficient, and flexible solution for log analysis across various cloud and application sources.","content":"## Introduction\nTailpipe is an open source Security Information and Event Management (SIEM) tool that provides instant log insights. Powered by DuckDB, it enables users to query and analyze millions of events in seconds, directly from their terminal. Tailpipe is designed to be lightweight and developer-friendly, offering SQL-based analysis for logs collected from cloud, container, and application sources. It leverages DuckDB's in-memory analytics and Parquet's optimized storage for fast, local, and efficient operations.\n\n## Installation\nGetting started with Tailpipe is straightforward. You can install it using Homebrew on macOS or a shell script for Linux and Windows (WSL).\n\nsh\n# MacOS\nbrew install turbot/tap/tailpipe\n\n\nsh\n# Linux or Windows (WSL)\nsudo /bin/sh -c \"$(curl -fsSL https://tailpipe.io/install/tailpipe.sh)\"\n\n\nAfter installation, you can install plugins for your favorite services, such as AWS, Azure, or GCP, from the [Tailpipe Hub](https://hub.tailpipe.io). For example, to install the AWS plugin:\n\nsh\ntailpipe plugin install aws\n\n\n## Examples\nTailpipe allows you to define connections and partitions to collect logs from various sources. Here is an example configuration for AWS CloudTrail logs:\n\nhcl\nconnection \"aws\" \"logging_account\" {\n  profile = \"my-logging-account\"\n}\n\npartition \"aws_cloudtrail_log\" \"my_logs\" {\n  source \"aws_s3_bucket\" {\n    connection = connection.aws.logging_account\n    bucket     = \"aws-cloudtrail-logs-bucket\"\n  }\n}\n\n\nAfter configuring, you can collect logs and then enter interactive query mode to run SQL queries:\n\nsh\ntailpipe collect aws_cloudtrail_log\ntailpipe query\n\n\nA sample SQL query to analyze CloudTrail logs:\n\nsql\nselect\n  event_source,\n  event_name,\n  count(*) as event_count\nfrom\n  aws_cloudtrail_log\nwhere\n  not read_only\ngroup by\n  event_source,\n  event_name\norder by\n  event_count desc;\n\n\n## Why Use Tailpipe?\nTailpipe offers several compelling advantages for log analysis and security:\n*   **SQL-Powered Insights**: Query and analyze logs instantly using familiar SQL syntax.\n*   **Fast and Local**: Leverages DuckDB and Parquet for high-performance, in-memory analytics directly on your machine.\n*   **Extensible Ecosystem**: Benefit from an ecosystem of prebuilt intelligence, including MITRE ATT&CK-aligned queries, detections, and dashboards.\n*   **Detections as Code**: Define security detections as code, integrate with Powerpipe for advanced monitoring, and extend functionality with plugins.\n*   **Multi-Cloud Support**: Collects logs from AWS, Azure, GCP, and other sources.\n\n## Links\n*   [Official Website](https://tailpipe.io)\n*   [GitHub Repository](https://github.com/turbot/tailpipe)\n*   [Documentation](https://tailpipe.io/docs)\n*   [Demo Video](https://www.youtube.com/watch?v=IR9MK1DMvW4)\n*   [Tailpipe Hub (Plugins & Queries)](https://hub.tailpipe.io)\n*   [Join the Community on Slack](https://turbot.com/community/join)","metrics":{"detailViews":4,"githubClicks":13},"dates":{"published":null,"modified":"2026-03-31T00:49:15.000Z"}}