🍋 LemonSees

Agentless SOC platform for L1 / L2 / L3 analysts — SIEM/XDR, EDR, NDR, CTI, SOAR & GRC over SSH

⬇️ Download v2.0.0 · 🐛 Report a bug · 📖 Quick start

LemonSees turns your SSH keychain into a full Security Operations Center on the desktop. You sit in one bold, tabbed console and monitor your fleet; each host is treated as a managed endpoint where the SSH session is the agent — nothing is installed on the server. Built for the day-to-day of L1 / L2 / L3 analysts: triage, investigate, respond, report.

• 🍋 Brand — LemonSees — minimal new logo and a polished, BetterStack-inspired UI: deep-charcoal surfaces with soft depth, tabular metrics, a subtle brand glow, and clean light + dark themes. Design system documented in DESIGN.md.
• 🧭 SOC information architecture — reorganised into analyst domains with sections → sub-tabs (Cloudflare-style): Console/SIEM, Endpoints/EDR, Network/NDR, Intel/CTI, Response/SOAR, Governance/GRC, Infrastructure, Utilities.
• 🖥️ EDR — live process table (CPU/MEM/uptime) and persistence view (cron, systemd services, timers, startup) collected over SSH.
• 🔌 NDR — full connections view (established + listening + owning process) alongside live traffic.
• 🔎 CTI — IP investigation (geo, reverse DNS, WHOIS, cross-check against your attacker list) run from the host.
• 🧰 Utilities — analyst network toolkit (dig, reverse DNS, whois, ping, traceroute, HTTP check, TCP port check) executed on the remote host.
• 🗒️ SIEM events — remote log viewer (auth.log/syslog/nginx/…) + the app event journal in one place.
• ⚙️ SOAR — playbooks view + the auto-incident brute-force rule.

Every module runs on real data over SSH — no agents deployed, nothing installed on your servers. Deployable EDR agents and malware sandboxing are intentionally out of scope for the agentless model.

Full support (query + browse): PostgreSQL · TimescaleDB · CockroachDB · YugabyteDB · QuestDB · Redshift · MySQL · MariaDB · Redis · KeyDB · Valkey · Dragonfly · MongoDB · SQLite (WASM over SSH) REST console: Elasticsearch · OpenSearch · CouchDB · ClickHouse · Meilisearch · Typesense · Qdrant · Weaviate · Chroma · ArangoDB · InfluxDB · Prometheus Planned (needs driver): MS SQL · Oracle · Cassandra · ScyllaDB · Neo4j · Memgraph · Memcached · Milvus Cloud (API keys, not via SSH): DynamoDB · BigQuery · Snowflake · Firebase · Firestore · Pinecone · Neptune

1. Download LemonSees-v2.0.0-win.zip from Releases
2. Extract and run LemonSees.exe

Close the window — everything stops. No background services.

git clone https://github.com/kiurakku/LemonSees.git
cd LemonSees
npm install
npm run build
npm run dist:win    # → release/win-unpacked/LemonSees.exe

1. Launch LemonSees
2. Infrastructure → Hosts → Add host — enter IP + SSH key (recommended) or password → Test connection → Add
3. Within seconds the host appears as an endpoint. Then:
   • Endpoints → Processes / Persistence — see what's running and what persists
   • Network → Traffic / Connections — who's talking to the box
   • Intel → Threats / IP intel — who's attacking, and investigate any IP
   • Governance → Compliance / Reports — CIS/NIST checks and a downloadable report

┌──────────────────────────────────────────────────┐
│            Electron (LemonSees.exe)              │
│  ┌──────────────┐      ┌──────────────────────┐  │
│  │   React UI   │◄────►│   Node.js Engine     │  │
│  │  (sections   │  WS  │   (127.0.0.1)        │  │
│  │   → tabs)    │      └──────────┬───────────┘  │
│  └──────────────┘                 │              │
└───────────────────────────────────┼──────────────┘
                                    │ SSH (port 22)  ← the session IS the agent
                         ┌──────────┴──────────────┐
                         │      Linux Server(s)     │
                         │ /proc · docker · db      │
                         │ auth.log · ss · ps · cron│
                         └──────────────────────────┘

• One persistent SSH connection per host (multiplexing), separate channels per task
• Metrics/traffic: single script per poll (/proc/stat, /proc/net/dev, free, df, docker); deltas in one round-trip
• EDR/NDR/CTI: ps, ss, cron/systemctl, auth.log, dig/whois — parsed server-side, enriched with batch geo-IP
• Databases: SSH port-forward to native drivers or HTTP proxy for REST engines; SQLite streamed and opened locally with sql.js

Requirements: Windows 10/11 (pre-built exe needs nothing else) · Node.js 18+ (dev) · Linux servers with SSH.

The engine binds to 127.0.0.1 only. Geo-IP enrichment (togglable in Settings) sends only public IPs of attackers/peers to a geolocation service; everything else stays on your machine.

LemonSees/
├── electron/            # Electron main process (frameless window, config migration)
├── server/              # Node.js SSH engine
│   ├── collector.js     # Host metrics + traffic
│   ├── security.js      # Posture · vulns.js — vulnerability scan
│   ├── threats.js       # CTI — auth.log · geoip.js — geo lookup
│   ├── edr.js           # EDR — processes + persistence
│   ├── netops.js        # NDR/CTI — connections, tools, IP intel
│   ├── compliance.js    # GRC — CIS/NIST controls
│   ├── db.js            # 39 DB engines, engines.js — registry
│   └── config.js        # Hosts, DBs, incidents, audit, SOC config
├── src/
│   ├── pages/           # Dashboard, Events, Endpoints, Processes, Persistence,
│   │                    #   Security, Vulnerabilities, Traffic, Connections,
│   │                    #   Threats, Investigate, Incidents, Playbooks,
│   │                    #   Compliance, Reports, Audit, Toolkit, …
│   ├── components/ui.tsx # Design system (Tabs, KPIs, rings, badges)
│   └── lib/             # api, engines, i18n (5 langs), settings
├── buildResources/      # App icon
└── .github/assets/      # Banner, logo

Issues and PRs welcome. For large changes, open an issue first.