Exposures, threats and response
Security on the data your operators already use
Detections run on the logs you already send, software inventory comes from the same collector, and the security graph is built from the Kubernetes, trace, flow and cloud data your other teams use. Response actions wait for a person to approve them.
- SigmaHQ · MITRE ATT&CK®
- CycloneDX · SPDX · OpenVEX
- Hash-chained audit
6 products
From exposure to audit evidence
Each product reads the workspace and the collectors your operators already run, instead of a separate agent and inventory.
Threat detection
Tracix ships SigmaHQ detection rules that run as queries over the logs you already send. Rules install switched off, so you can backtest each one and run it in a quiet test stage before it alerts, and an ATT&CK matrix shows which techniques your enabled rules cover.
- SigmaHQ rules
- MITRE ATT&CK® coverage
- Backtest and shadow mode
Software inventory and SBOM
The collector inventories the software inside running Linux applications, containers and pods, and records which components each process mapped, opened or executed. Tracix matches every release against OSV advisories. Export a service's inventory as CycloneDX or SPDX, with OpenVEX statements your team writes.
- CycloneDX · SPDX · OpenVEX
- Linux
Attack paths
Tracix builds a security graph from your Kubernetes objects, service traces, observed network flows and cloud inventory, and marks what the internet can reach through ingresses, load balancers, public IPs and open security groups. The attack-path view traces those paths hop by hop and shows what a compromised workload could reach next.
- Kubernetes · traces · flows · cloud
Cloud security posture
Connect an AWS account, Azure subscription, Google Cloud project or Kubernetes cluster, and Tracix runs Prowler's read-only checks on a schedule. Each account gets a score, its failing checks with remediation guidance, what changed since the last scan, and exceptions with an owner and an optional expiry.
- AWS · Azure · GCP · Kubernetes
- Prowler
Response and playbooks
Agents and playbooks propose actions such as blocking an indicator, disabling a user or containing a host, and nothing in the response catalog runs until a person approves it, with containment needing an admin. Every proposal, approval and result is written to a hash-chained audit ledger you can verify.
- Approval before action
- Hash-chained ledger
Compliance and audit
Tracix maps data it already holds, such as log retention, detection coverage, alert handling and access reviews, to selected PCI DSS v4.0, SOC 2 and ISO 27001:2022 controls. It builds evidence packs for your auditors on a schedule, hash-chained so a changed or missing pack shows up when you verify them.
- PCI DSS v4.0
- SOC 2 common criteria
- ISO 27001:2022
Detection rules come from the SigmaHQ project under the Detection Rule License 1.1. Cloud posture checks run Prowler, licensed under Apache 2.0. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.
One platform
Connected to the other areas
Security works on the same data and approval flows as the rest of the platform.
- ApplicationsSoftware inventory comes from the same collector that traces your services, and shows on each service's Components tab.
- InfrastructureDetections run on the system and endpoint logs your hosts already send, and approved host actions run through the collector on that host.
- NetworkAttack paths follow observed network flows, and an approved IP block can go out as an ACL change through configuration management.
- Operations & AIEach detection runs as a monitor, so its alerts become problems and cases, and security events can start workflows.
Put security on the data you already collect
Turn on detections for the logs you send today, and connect a cloud account for posture checks.