Quickstart
Clone, install, and run your first investigation.
Open Quickstart →Find the right depth.
Keep moving.
Use the first-party Quickstart for a five-minute path, then go to the repository documents for complete reference and operating detail.
GUIDES & REFERENCES
From first run to production evaluation.
Formats & Queries
Recognize common logs and start with documented investigation recipes.
Open Formats & Queries →Usage Guide
Recipes for search, dashboards, alerts, review, and export.
Open Usage Guide →User Manual
The complete interface and command reference.
Open User Manual →Beacon deployment
Run and operate the durable ClickHouse-backed platform.
Open Beacon deployment →Benchmarks
Reproducible throughput, latency, environment, and caveats.
Open Benchmarks →Architecture decision
Why Beacon uses ClickHouse, Go, and a Python sidecar.
Open Architecture decision →STIG module
Review DISA STIG checklists inside the TUI.
Open STIG module →Changelog
Follow shipped behavior and platform milestones.
Open Changelog →GitHub issues
Report a problem or inspect known work.
Open GitHub issues →FAQ
Facts that should not drift.
- Does local mode send or persist my data?
- No. The local TUI reads logs into memory and has no storage server. Use Beacon when you need a durable, shared system.
- Which formats can Lantern read?
- JSON Lines, logfmt, syslog, nginx, CEF, plain text. Lantern also recognizes nginx/Apache combined logs as the documented web-server format.
- What is Beacon?
- Beacon is Lantern's optional ClickHouse-backed platform for network ingest, durable storage, tenant isolation, alert delivery, retention, and remote query.
- Which Python version is required?
- Python 3.9+.
- How is Lantern licensed?
- Lantern is open source under the MIT license.
- Where should I report a problem?
- Open an issue in the Lantern GitHub issue tracker.