Glossary of Tracix terms

Terms are in alphabetical order. Each heading is a link you can share.

API key

A workspace credential that starts with txk_, for scripts, CI pipelines and webhook senders. Each API key has one type: ingest, with write: permissions for alert webhooks, or CI, with security.read or security.manage for detection content. Send it in the X-API-Key header. See Authenticate with API keys.

Apply

The step that publishes content managed as code. Apply plans again and must reproduce the plan hash you reviewed; if anything changed since, it is refused and you plan again. See Monitors, dashboards and detections as code.

Auto-Fix

Turns a production error into a proposed fix, opened as a pull request on your repository for you to review. Auto-Fix never merges. See AI and automation.

Brain

Tracix's AI assistant in your workspace. Anything Brain would change needs your confirmation first. See AI and automation.

Bundle

A tracix.io/v1 JSON file that describes monitors, visualizations, dashboards and APM service groups as code, under one package.

Collector

The Tracix Collector, an OpenTelemetry Collector distribution you install on Linux, macOS or Windows hosts, in Docker or on Kubernetes. It enrolls with your workspace, runs the configuration of its policy and sends telemetry. See Install the collector.

Conflict

A plan row for a repository rule whose rule ID matches a rule created in the UI or installed from the Sigma pack. Apply refuses a plan with conflicts until you confirm the replacement; the older rule is then disabled and linked to the new one, never taken over silently.

Control plane

The service in your workspace that collectors connect to at agents-<workspace>.app.tracix.io. It enrolls collectors, renders each policy into collector configuration, receives heartbeats and schedules updates. Changes to collectors and policies go through it.

Detection rule

A rule that looks for threats in your logs: a Sigma rule, or a native SQL, sequence, new terms, cardinality or watchlist rule. Each enabled rule runs as a monitor at its stage. See Detections.

Enrollment token

The secret a collector presents once to join a policy. Each policy can have several, created on the policy's page under Collectors › Policies; a token works until it is revoked or expires. After enrolling, a collector switches to its own credential, so revoking the token stops new enrollments but leaves enrolled collectors running.

Ingest key

The key, starting with apm_, that OpenTelemetry SDKs and agents send in the x-tracix-ingest-key header with traces, metrics and logs. Create, pause and resume ingest keys under Applications › APM & Traces › Setup in your workspace. It is a different credential from an API key of the ingest type, which authenticates alert webhooks. See API keys and ingest keys.

Integration

A package from the Tracix catalog that tells collectors, or Tracix itself for agentless sources, what to collect from a technology, and adds the dashboards and log pipelines that go with it. See the integrations catalog.

Managed as code

An object whose definition comes from Git or from an integration package. You can't edit or delete its definition in the workspace, even as an admin; duplicate it to get a copy you own. Operational controls stay editable: enabling, disabling and snoozing monitors, their notification destinations, and enabling or disabling detection rules.

Managed update

An upgrade the control plane schedules for a collector, to the stable release. You start one with Upgrade on the Collectors page, or let a policy update its collectors automatically, which new policies do by default. See Upgrade collectors.

Monitor

A definition that evaluates your telemetry on a schedule and opens an alert when a threshold is crossed or expected data stops arriving. See Monitors.

NCM

Network configuration management: configuration backups, change requests and compliance rules for network devices, with configuration changes on the platforms Tracix supports. See Network.

OBI

OpenTelemetry eBPF Instrumentation. The collector uses it on Linux to trace applications without code changes or restarts.

Organization

Your company's account in Tracix Cloud at cloud.tracix.io. It holds your users, roles, single sign-on, billing and workspaces. See Users and roles.

OTLP

The OpenTelemetry Protocol, which SDKs, agents and collectors use to send traces, metrics and logs. Tracix accepts it over gRPC and HTTP. See Endpoints and ports.

Package

The unit that content managed as code is published under. A detection repository's manifest or a bundle names its package, and the package owns its objects, whose IDs take the form code:<package>:<kind>:<uid>.

Plan

A read-only comparison between content in Git and what your workspace runs. It lists each object with its action: create, update, delete, unchanged or conflict.

Plan hash

The fingerprint of a reviewed plan. It covers each object's action, definition and live version, not the commit, so a plan reviewed on a pull request still applies after the merge when nothing else changed.

Policy

A named configuration for a group of collectors: the integrations they collect and where they send it. Every change makes a numbered revision. The control plane turns a policy into signed collector configuration and pushes it over a WebSocket, and collectors poll when the WebSocket can't connect. See Policies.

RUM app key

The public key browsers and mobile apps send in the x-tracix-app-key header with real user monitoring data. A browser app key works only from the web origins its app allows. Find it under Applications › Real User Monitoring › Setup.

Shadow mode

The test stage of a detection rule. Its monitor runs and records alerts, but nobody is notified or paged and no case is opened.

Signal

A kind of telemetry: traces, metrics and logs, plus CPU profiles from continuous profiling.

SNMP profile

The mapping from a device's SNMP data to Tracix metrics and attributes. Tracix matches each device to a profile from its library by what the device answers. See SNMP.

Source IP allowlist

The networks allowed to reach a workspace's hostnames, set on the workspace's Access tab in the Tracix Cloud console. Empty, it allows every network. See Endpoints and ports.

Stable release

The Tracix Collector release Tracix promotes for installs and upgrades. The console's install commands use it, and the Collectors page compares every collector with it. See Release notes.

Stage

How a detection rule runs: draft (off, with no monitor), test (shadow mode) or production (alerts and notifies as usual).

Value list

A named list of values, such as service accounts, that detection rules use in exceptions and watchlists. Rules refer to it as list:<name>.

Workspace

An isolated Tracix environment in your organization, with its own Kubernetes namespace, its own ClickHouse database and its own address, such as production-a7k3p2q9.app.tracix.io. Collectors, data and most settings belong to one workspace. Some screens and API paths call a workspace a deployment.

YARA ruleset

A set of YARA rules that collectors run in on-demand scans of files on their own host, published from the UI or a detection repository.