The web UI

Sign in at your SIEMLite address. Admins see every page; standard users see the Dashboard, Database and (unless limited to some sources) Alerts.

• Dashboard: a search field and the last 24 hours, 7 days or 30 days at a glance: events, threat intel matches, high-severity events, events over time, severity, busiest sources and the IPs on threat lists. Type a search and press Enter to open the results in the Database.
• Database: every event, newest first, with full-text search, a From mm/dd/yy to mm/dd/yy date range and filters for source, severity, category, IPs, user, program, country and threat matches. Open an event for its details. It loads 100 events at a time: scroll to the end, or choose Show more events, for the next 100. The address bar keeps the search, so it can be bookmarked or shared.
• Alerts: alerts raised by the rules, by severity, with how many events and when. Open the events behind an alert, acknowledge it while you look into it, then close it. The Rules tab lists the rules; admins add, edit and switch them off. Users limited to some sources don't see alerts, since a rule looks at every source.
• Users (admins): add people, set their role, limit what they can see, change passwords, and keep the built-in admin account to the server itself.
• Sources (admins): add sources (each gets an access token and ready-to-paste code), see when each source last sent logs, choose how each source's lines are read (Automatic, None or a parser), add logs by hand, and enable, disable or delete a token (Manage).
• Parsers (admins): build, upload, export and edit parsers.
• Integrations (admins): connect SIEMLite to other services. Each integration is a card you set up and then turn on or off: email, sign-in with Microsoft Entra ID, and AI Parsers.
• System (admins): the version and whether a newer release is out (with an update button), the HTTPS certificate (self-signed or Let's Encrypt), how long events are kept, database size and uptime, and backups: create, schedule, download, upload, restore and delete.
• Security audit (admins): checks SIEMLite's setup and the server it runs on, and tracks each finding until it is fixed. See Security audit.
• Account (everyone; select your name at the bottom of the sidebar): your role and what it lets you see, the theme (System, Light or Dark), signing out, and how you sign in: a local password, which you can change here, or Microsoft Entra ID.

The light and dark themes can follow your system or be set from the menu. Fonts are bundled in the binary, so the UI never contacts a font service.