Practical overview
When it fits
Use it when you want to combine security-data monitoring with retrieval-augmented context and LLM-based validation in a self-hosted environment.
Who it is for
- Security teams building self-hosted SOC monitoring workflows
- Developers working with OpenSearch or Elasticsearch security data
- Engineers evaluating modular, skill-based AI agent infrastructure
Documented uses
- Monitor OpenSearch or Elasticsearch data for anomalies
- Retrieve historical behavioral context during investigations
- Validate real-time security findings with an LLM
- Run scheduled monitoring and memory-building workflows
- Investigate threats through a web or terminal chat interface
Requirements & limits
The repository is public and open source under the MIT license. The documented deployment targets Linux, Docker, self-hosted and server environments, with Bash and native Windows PowerShell launchers described.
- Requires a configured OpenSearch or Elasticsearch service, or mock testing for setup work.
- The documented quick start uses Python 3.11+, Ollama and local model and embedding configuration.
- The web service combines a React UI, FastAPI API and background scheduler; CLI-only operation is also documented.
- Working memory is checkpointed in SQLite, while vector embeddings are stored in OpenSearch.
- The documentation says context is compacted and that live token-usage telemetry is not yet available in the chat router.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Set up Securityclaw with its onboarding wizard
Prepare a local Securityclaw installation and save database, LLM and skill configuration.
Before you start
- Python 3.11+
- Git
- OpenSearch 2.x or Elasticsearch 8.x, or mock testing
- Ollama
- A cloned Securityclaw repository
Steps
Clone the repository and enter its directory.
Create and activate a Python virtual environment.
Install dependencies from requirements.txt or with Pipenv.
Run the onboarding wizard to configure the database and Ollama, test both connections, save configuration, and provide any requested skill variables.
Expected outcome
Securityclaw has its Python dependencies installed and onboarding configuration saved to config.yaml and .env.
Guide limitations
- The documented setup does not specify the required security-index schema, credentials format or deployment configuration.
- The guide covers onboarding and configuration, not a complete production deployment.
Start Securityclaw services with the documented launcher
Launch the local application or Docker Compose services after configuration.
Before you start
- A configured Securityclaw installation
- A POSIX-compatible shell or native Windows PowerShell
- Docker for the Docker Compose option
Steps
Use the Bash launcher on Linux, macOS, WSL or another POSIX-compatible shell, or use the PowerShell launcher on native Windows.
Run the launcher help command to review available options.
Run the start command for the local virtual-environment application or the docker command for Docker Compose.
Use status to inspect managed services and stop to shut them down when required.
Expected outcome
The selected local or Docker Compose application is started, with launcher commands available for status and shutdown.
Guide limitations
- The launcher verifies configuration, Ollama, Docker and OpenSearch, but the evidence does not document outcomes for a particular environment.
- The Bash launcher on Windows requires WSL or Git Bash; native Windows uses PowerShell.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 30 September 2026
- Original website title
- SecurityClaw/SecurityClaw · Official homepage title · retained in its source language