What is Seagull?

Seagull is an open security operations platform evolving toward SIEM/XDR use cases. It brings endpoint observations into a durable event backbone, evaluates security rules, and preserves the resulting evidence separately from the work an operator performs on it.

V2 is a re-architecture with independently built components. It is under active development: a working backend does not imply a finished endpoint product or a deployed user interface.

What you can do today

Run the backend development stack; submit authenticated test telemetry; hunt events and detections; publish and activate rulesets; manage alerts and incidents; register agents and issue certificates; project inventory; and ingest distribution vulnerability advisories. The agent executable currently provides local runtime, configuration, identity, and key foundations. It does not yet collect or upload observations. The V2 frontend repository is a placeholder.

Start with your task

Your task	Start here	Then read
Evaluate V2	Quickstart	Implementation status
Understand the system	Architecture	Data ownership
Operate a deployment	Deployment	Operations
Integrate an endpoint	Agent	Contracts
Review security	Trust boundaries	Threat model
Contribute code	Developer onboarding	Testing

Read status precisely

Implemented means present in the reviewed source, with the stated boundaries. It is not a production certification. In progress means some parts exist and others remain. Planned identifies a documented requirement with no completed implementation. Target architecture describes the intended relationship between those parts. Experimental identifies a deliberately limited interface or workflow. Deprecated is reserved for explicitly superseded behavior.

Each guide links to evidence. Generated references are pinned snapshots; see the review baseline before comparing them with a newer checkout.

Source evidence

Reviewed against the source baseline. Seagull-backend-v2/README.md · Seagull-agent-v2/README.md · Seagull-frontend-v2/README.md.