SIEM + EDR/XDR

Sec1 SIEM + EDR/XDR is unified detection and response. A lightweight agent collects logs and endpoint telemetry from your fleet; the platform detects threats, correlates them into incidents and lets your SOC respond — from one console.

Overview

Understand what the platform does and how the pieces fit together:

• Overview

Architecture

A simple end-to-end picture — agents, ingest, pipeline, detection, correlation, AI and response:

• Architecture

Data collection

Two ways to get data in — the Sec1 agent or an existing log collector — and how one agent serves SIEM, EDR and XDR:

• Data Collection

Setup & access

Reach the live console, sign in with your platform credentials and understand the gateway:

• Setup & Access

Install the agent

Prerequisites, the network allowlist and single vs bulk install on Windows, Linux or macOS:

• Install the Agent

Endpoints & telemetry

Read the per-host detail view — the telemetry collected from each endpoint:

• Endpoints & Telemetry

Vulnerability management

Find and triage vulnerable software across the fleet and per host:

• Vulnerability Management

Device control

Inventory connected peripherals and approve or block them:

• Device Control

Application control

Allow or deny software execution and installation by rule:

• Application Control

Detections, alerts & incidents

Follow the detection-to-incident flow and investigate cases:

• Detections, Alerts & Incidents

Response actions

The live-response toolkit for acting on a host:

• Response Actions