Assembly Line

Sigwood

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.

Sigwood is an open-source network ad blocking project on GitHub under the MIT license (permissive), with 348 stars. It is built with CPython. Its last push was 5 days ago.

Stars
348
License
MIT
Activity
Active
Latest release
v1.2.0

Code on GitHub Website

Judgement

What it is
Developer tool
What it does
A Python command-line tool that runs named threat-hunting detectors over existing logs from Zeek, Pi-hole, syslog, journald and CloudTrail, with no agent or daemon.
Adopt it when
You want to look for suspicious activity in logs you already collect without standing up a SIEM.
Watch out
Created in July 2026, so it is new and its detectors are unproven against real incidents.
Ready for
Experimental
Runs as
Command line
Built with
Python
How established
New: started 3 months ago, latest release v1.2.0.
What the license allows
You can build it into a product you sell, as long as you keep its copyright notice.

Judged on 2026-11-03 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

CPython

Follow it down: Sigwood → CPython → GCC → LLVM project → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Sigwood

  1. 1
    AdGuardHome AdguardTeam

    Network-wide ads & trackers blocking DNS server

    Complete system Production-ready You want Pi-hole-style blocking with built-in DoH, DoT and DoQ in a single binary.

    ★ 38k GPL-3.0 TypeScript Active, pushed today
  2. 2
    DnsServer TechnitiumSoftware

    Technitium DNS Server

    Complete system Production-ready You want a full DNS server for your home or office, including authoritative zones, not just a blocker.

    ★ 10k GPL-3.0 C# Active, pushed 9 days ago
  3. 3
    Blocky 0xERR0R

    Fast and lightweight DNS proxy as ad-blocker for local network with many features

    Complete system Production-ready You want Pi-hole-style network ad blocking as a single stateless binary configured in code, without a built-in web UI.

    ★ 7.1k Apache-2.0 Go Active, pushed yesterday
  4. 4
    Esp32-c3-adblock M-Abozaid

    Pi-hole-class DNS ad-blocker on a $2 ESP32-C3 (no PSRAM): 537k domains as 40-bit FNV-1a hashes in flash, binary-searched. UDP DNS sinkhole + web dashboard. https://youtube.com/shorts/RaxszOUMi8E?feature=share

    Complete system Experimental You want network ad blocking on a tiny, very low-cost device and enjoy flashing microcontrollers.

    ★ 3.5k MIT C++ Active, pushed 27 days ago
  5. 5
    Blockads-android pass-with-high-score

    Block ads system-wide on Android using local VPN-based DNS filtering. No root needed. No data collection.

    Complete system Usable You want system-wide ad and tracker blocking on an unrooted Android phone from a free open-source app.

    ★ 2.6k GPL-3.0 Kotlin Active, pushed today
  6. 6
    A-dove-is-dumb ignaciocastro

    Easily block Adobe telemetry checking domains. Continuously Updated. Useful for HostsMan / SwitchHosts / Pi-hole users ✨

    List, course or other material Usable You want to stop Adobe apps calling home from a machine or network you control.

    ★ 1.9k BSD-2-Clause Active, pushed 5 days ago
  7. 7
    Pihole-updatelists jacklul

    Update Pi-hole's lists from remote sources easily

    Developer tool Usable You manage Pi-hole lists from curated remote collections such as Firebog and want them kept in step automatically.

    ★ 1.7k MIT PHP Active, pushed 11 days ago
  8. 8
    Nebula-sync lovelaze

    Synchronize configuration of multiple Pi-hole v6.x instances.

    Developer tool Usable You run two or more Pi-hole v6 servers for redundancy and want their settings kept identical.

    ★ 1.7k MIT Go Active, pushed 2 days ago

Commercial network ad blockers and DNS filters

  1. 1
    Cisco Umbrella Cisco

    Cisco's enterprise network security provides advanced protection on a unified, cloud-delivered solution designed for the modern workplace.

    Complete system Production-ready A business or school wants a simple first layer of web filtering and threat blocking across all sites and devices.

    Commercial
  2. 2
    NextDNS NextDNS

    NextDNS protects you from all kinds of security threats, blocks ads and trackers on websites and in apps and provides a safe and supervised Internet for kids — on all devices and on all networks.

    Complete system Production-ready You want network-wide blocking on phones and laptops wherever they go without running a Pi-hole.

    Commercial

Stars, license and activity come from GitHub and refresh on a rolling hourly schedule. The project's own description is quoted as written.