Security
2 min read · Updated View as Markdown
Detect, investigate and respond to threats on the telemetry your collectors already send, in the same workspace as your monitoring. In the console, everything on this tab lives under Security.
- Detections run as queries over your logs and endpoint events. Rules come from the SigmaHQ pack, your own repositories or rules you write, and each one can run in shadow mode before it alerts anyone.
- Software inventory lists the components inside the applications running on your Linux hosts, with evidence of what each process actually loads. Tracix matches them against OSV vulnerability advisories, shows the matches on each service and under Findings, and exports the inventory as an SBOM with VEX.
- Response actions turn what agents, playbooks and Brain propose into actions, and nothing in the catalog runs until a person approves it.
Security guides
Detection rules and shadow modeInstall the SigmaHQ pack, backtest rules and promote them safelySoftware inventory and SBOM exportInventory running software, match it against OSV advisories and export CycloneDX, SPDX or OpenVEXResponse actionsApprove, bind and audit the 25 response actions
Before you start
Detections need data. Install the collector on the hosts you want to protect and send their logs; see Syslog for network and security devices. For an overview of every security product, see Security.
Detection rules come from the SigmaHQ project under the Detection Rule License 1.1. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.