Made in 🇧🇷 | GitHub Repo stars

Clickdetect

clickdetect running

Clickdetect is a generic alerting and detection engine that supports any data source and integrates with any webhook. It is vendor-agnostic, with no lock-in, and enables powerful, flexible detection workflows.

Follow the doc: https://clickdetect.souzo.me

Core Concepts

Runner.yml: The file where you configure everything
Detector: Component that runs rules based on thresholds
Rule: File with structured format to define datasource analysis
Datasource: Where rule queries are executed, like a database or another SIEM engine
Webhooks: Where alerts are sent
Plugin: Script that can intercept Clickdetect actions like "on_rule_triggered"

Supported Integrations

Datasources

Clickhouse
Loki
VictoriaLogs
PostgreSQL
Elastic
Opensearch
Opensearch PPL
Databricks
Duckdb

Webhooks

Generic
DFIR Iris
Forgejo
Email
Microsoft Teams
Slack
Telegram
Discord
TheHive
Opsgenie

Plugins

clickagentic: LLM AI Agent that analyzes your alerts

Quick Start

Start by creating a runner.yml file — see the full reference in the documentation.

uv

Follow uv installation in https://docs.astral.sh/uv

uv sync --no-dev
uv run clickdetect --api

Docker/Podman

Local

podman build -t clickdetect .
podman run -v ./runner.yml:/app/runner.yml -p 8080:8080 clickdetect --api -p 8080

GitHub Packages

podman run -v ./runner.yml:/app/runner.yml -p 8080:8080 ghcr.io/clicksiem/clickdetect:latest --api -p 8080

Options

Flag	Default	Description
`--api`	off	Start the REST API server
`-p`, `--port`	`8080`	Port for the API server
`-r`, `--runner`	`runner.yml`	Path to the runner configuration file
`--stdin`	off	Read the runner configuration from stdin
`--verbose`	off	Verbose mode
`--reload`	off	Hot reload rules
`--no-start`	off	Do not start detectors on start
`--list-webhooks`	off	List webhooks
`--list-datasources`	off	List datasources
`--list-plugins`	off	List all plugins
`--sigma`	off	Treat all rules as Sigma rule
`--version`	off	Print version and exit

Runner Configuration

datasource:
    type: clickhouse
    host: localhost
    port: 8123
    verify: false
    username: default
    password: default
    database: siem

webhooks:
    generic_webhook:
        type: generic
        url: <webhook_url>
        headers:
          X-Type: test

detectors:
    5m_detector:
        name: "5m interval"
        for: "5m"
        tenant: 'all' 
        description: "detect rules with 5 min interval"
        rules:
            - "<your rule path>"
        sigma: true # threat all rules for this detector as sigma rule
        webhooks:
            - generic_webhook
        data:
          var1: '<var>' # variables to send
plugins:
  clickagentic: # plugin id
    provider: 'openai' # provider: openai, anthropic, google, huggingface, ollama, openrouter, deepseek
    model: 'gpt-5.2' # get model from your provider
    token: 'xxx'
    from_level: 10 # only run for alerts with alert level >= 10
    ids:
      - "id1"

More example of runner in example_rules

Rule Configuration

id: "00000000-0000-0000-0000-000000000000"
name: "Base rule for help"
level: 1
size: ">0"
active: false
author: 
    - Vinicius Morais <me@souzo.me>
group: < group >
tags: 
    - <tags>
data: # variables sent to rules by jinja
    max_match_time: 5
rule: |-
    < rule >

Release

See the latest releases and changelog

Contact

E-mail: me@souzo.me
Matrix: @souzo:matrix.org
Linkedin: https://www.linkedin.com/in/vinicius-m-a76ba51b5/
Twitter/X: https://x.com/souzomain
Reddit: https://www.reddit.com/user/_souzo/

Metadata

Release files for clickdetect 1.17.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for clickdetect 1.17.0
File	Size	Uploaded
clickdetect-1.17.0.tar.gz	29.6 kB	Jul 19, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for clickdetect 1.17.0
File	Interpreter	ABI	Platform	Reset
clickdetect-1.17.0-py3-none-any.whl 53.9 kB Jul 19, 2026	Python 3	none	any	Details

Total release size: 83.4 kB

Release files / clickdetect-1.17.0.tar.gz

Download URL	clickdetect-1.17.0.tar.gz
Size	29.6 kB
Tags	Source
SHA-256 checksum How to use checksums	`6702c31846e107ecbf135f1e7bcb12b45084ba7df6e91b2fcf28144470753c66`
BLAKE2b-256 checksum How to use checksums	`e7f65142463d429731c8842f4979a49f8a71c6b10cb43265fbbb8ddaf4ce10b0`
Upload date	Jul 19, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`uv/0.11.29 {"installer":{"name":"uv","version":"0.11.29","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}`

Release files / clickdetect-1.17.0-py3-none-any.whl

Download URL	clickdetect-1.17.0-py3-none-any.whl
Size	53.9 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`c66e05879865d2fe4446fb175b65ac46939d3ae42c219e888d4a9e3ec6e5b97b`
BLAKE2b-256 checksum How to use checksums	`920f3e00f68e3a5ffb7a367568180db39cac55f1f22d55acc1a1dbb44d8077af`
Upload date	Jul 19, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`uv/0.11.29 {"installer":{"name":"uv","version":"0.11.29","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}`