# Glossary of Tracix terms Short definitions of the terms used across the Tracix docs and console, from organizations, workspaces and policies to enrollment tokens, plans and shadow mode. Terms are in alphabetical order. Each heading is a link you can share. ## API key A workspace credential that starts with `txk_`, for scripts, CI pipelines and webhook senders. Each API key has one type: ingest, with `write:` permissions for alert webhooks, or CI, with `security.read` or `security.manage` for detection content. Send it in the `X-API-Key` header. See [Authenticate with API keys](https://tracix.io/docs/api/authentication). ## Apply The step that publishes content managed as code. Apply plans again and must reproduce the [plan hash](#plan-hash) you reviewed; if anything changed since, it is refused and you plan again. See [Monitors, dashboards and detections as code](https://tracix.io/docs/api/as-code). ## Auto-Fix Turns a production error into a proposed fix, opened as a pull request on your repository for you to review. Auto-Fix never merges. See [AI and automation](https://tracix.io/docs/ai). ## Brain Tracix's AI assistant in your workspace. Anything Brain would change needs your confirmation first. See [AI and automation](https://tracix.io/docs/ai). ## Bundle A `tracix.io/v1` JSON file that describes monitors, visualizations, dashboards and APM service groups as code, under one [package](#package). ## Collector The Tracix Collector, an OpenTelemetry Collector distribution you install on Linux, macOS or Windows hosts, in Docker or on Kubernetes. It enrolls with your workspace, runs the configuration of its [policy](#policy) and sends telemetry. See [Install the collector](https://tracix.io/docs/collect/collector/install). ## Conflict A plan row for a repository rule whose rule ID matches a rule created in the UI or installed from the Sigma pack. Apply refuses a plan with conflicts until you confirm the replacement; the older rule is then disabled and linked to the new one, never taken over silently. ## Control plane The service in your workspace that collectors connect to at `agents-.app.tracix.io`. It enrolls collectors, renders each policy into collector configuration, receives heartbeats and schedules updates. Changes to collectors and policies go through it. ## Detection rule A rule that looks for threats in your logs: a Sigma rule, or a native SQL, sequence, new terms, cardinality or watchlist rule. Each enabled rule runs as a monitor at its [stage](#stage). See [Detections](https://tracix.io/docs/security/detections). ## Enrollment token The secret a collector presents once to join a policy. Each policy can have several, created on the policy's page under **Collectors › Policies**; a token works until it is revoked or expires. After enrolling, a collector switches to its own credential, so revoking the token stops new enrollments but leaves enrolled collectors running. ## Ingest key The key, starting with `apm_`, that OpenTelemetry SDKs and agents send in the `x-tracix-ingest-key` header with traces, metrics and logs. Create, pause and resume ingest keys under **Applications › APM & Traces › Setup** in your workspace. It is a different credential from an [API key](#api-key) of the ingest type, which authenticates alert webhooks. See [API keys and ingest keys](https://tracix.io/docs/admin/api-keys). ## Integration A package from the Tracix catalog that tells collectors, or Tracix itself for agentless sources, what to collect from a technology, and adds the dashboards and log pipelines that go with it. See the [integrations catalog](https://tracix.io/integrations). ## Managed as code An object whose definition comes from Git or from an integration package. You can't edit or delete its definition in the workspace, even as an admin; duplicate it to get a copy you own. Operational controls stay editable: enabling, disabling and snoozing monitors, their notification destinations, and enabling or disabling detection rules. ## Managed update An upgrade the control plane schedules for a collector, to the [stable release](#stable-release). You start one with **Upgrade** on the **Collectors** page, or let a policy update its collectors automatically, which new policies do by default. See [Upgrade collectors](https://tracix.io/docs/collect/collector/upgrade). ## Monitor A definition that evaluates your telemetry on a schedule and opens an alert when a threshold is crossed or expected data stops arriving. See [Monitors](https://tracix.io/docs/alerting/monitors). ## NCM Network configuration management: configuration backups, change requests and compliance rules for network devices, with configuration changes on the platforms Tracix supports. See [Network](https://tracix.io/docs/network). ## OBI OpenTelemetry eBPF Instrumentation. The collector uses it on Linux to trace applications without code changes or restarts. ## Organization Your company's account in Tracix Cloud at `cloud.tracix.io`. It holds your users, roles, single sign-on, billing and [workspaces](#workspace). See [Users and roles](https://tracix.io/docs/admin/users-and-roles). ## OTLP The OpenTelemetry Protocol, which SDKs, agents and collectors use to send traces, metrics and logs. Tracix accepts it over gRPC and HTTP. See [Endpoints and ports](https://tracix.io/docs/reference/endpoints-and-ports). ## Package The unit that content managed as code is published under. A detection repository's manifest or a bundle names its package, and the package owns its objects, whose IDs take the form `code:::`. ## Plan A read-only comparison between content in Git and what your workspace runs. It lists each object with its action: create, update, delete, unchanged or conflict. ## Plan hash The fingerprint of a reviewed [plan](#plan). It covers each object's action, definition and live version, not the commit, so a plan reviewed on a pull request still applies after the merge when nothing else changed. ## Policy A named configuration for a group of collectors: the integrations they collect and where they send it. Every change makes a numbered revision. The control plane turns a policy into signed collector configuration and pushes it over a WebSocket, and collectors poll when the WebSocket can't connect. See [Policies](https://tracix.io/docs/collect/collector/policies). ## RUM app key The public key browsers and mobile apps send in the `x-tracix-app-key` header with real user monitoring data. A browser app key works only from the web origins its app allows. Find it under **Applications › Real User Monitoring › Setup**. ## Shadow mode The `test` [stage](#stage) of a detection rule. Its monitor runs and records alerts, but nobody is notified or paged and no case is opened. ## Signal A kind of telemetry: traces, metrics and logs, plus CPU profiles from continuous profiling. ## SNMP profile The mapping from a device's SNMP data to Tracix metrics and attributes. Tracix matches each device to a profile from its library by what the device answers. See [SNMP](https://tracix.io/docs/collect/network-data/snmp). ## Source IP allowlist The networks allowed to reach a workspace's hostnames, set on the workspace's **Access** tab in the Tracix Cloud console. Empty, it allows every network. See [Endpoints and ports](https://tracix.io/docs/reference/endpoints-and-ports#restrict-source-networks). ## Stable release The Tracix Collector release Tracix promotes for installs and upgrades. The console's install commands use it, and the **Collectors** page compares every collector with it. See [Release notes](https://tracix.io/docs/reference/release-notes). ## Stage How a detection rule runs: `draft` (off, with no monitor), `test` ([shadow mode](#shadow-mode)) or `production` (alerts and notifies as usual). ## Value list A named list of values, such as service accounts, that detection rules use in exceptions and watchlists. Rules refer to it as `list:`. ## Workspace An isolated Tracix environment in your [organization](#organization), with its own Kubernetes namespace, its own ClickHouse database and its own address, such as `production-a7k3p2q9.app.tracix.io`. Collectors, data and most settings belong to one workspace. Some screens and API paths call a workspace a deployment. ## YARA ruleset A set of YARA rules that collectors run in on-demand scans of files on their own host, published from the UI or a detection repository.