# Security

Detect threats with SigmaHQ rules tested in shadow mode, match the software you run against OSV advisories, and respond through actions a person approves.

Detect, investigate and respond to threats on the telemetry your collectors already send, in the same workspace as your monitoring. In the console, everything on this tab lives under **Security**.

* **Detections** run as queries over your logs and endpoint events. Rules come from the SigmaHQ pack, your own repositories or rules you write, and each one can run in shadow mode before it alerts anyone.
* **Software inventory** lists the components inside the applications running on your Linux hosts, with evidence of what each process actually loads. Tracix matches them against OSV vulnerability advisories, shows the matches on each service and under **Findings**, and exports the inventory as an SBOM with VEX.
* **Response actions** turn what agents, playbooks and Brain propose into actions, and nothing in the catalog runs until a person approves it.

## Security guides

- [Detection rules and shadow mode](https://tracix.io/docs/security/detections): Install the SigmaHQ pack, backtest rules and promote them safely

- [Software inventory and SBOM export](https://tracix.io/docs/security/software-inventory): Inventory running software, match it against OSV advisories and export CycloneDX, SPDX or OpenVEX

- [Response actions](https://tracix.io/docs/security/response): Approve, bind and audit the 25 response actions

## Before you start

Detections need data. [Install the collector](https://tracix.io/docs/collect/collector/install) on the hosts you want to protect and send their logs; see [Syslog](https://tracix.io/docs/collect/network-data/syslog) for network and security devices. For an overview of every security product, see [Security](https://tracix.io/platform/security).

Detection rules come from the SigmaHQ project under the Detection Rule License 1.1. MITRE ATT\&CK® is a registered trademark of The MITRE Corporation.