> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/overview.md).

# Overview

Sec1 SIEM + EDR/XDR is a unified detection and response platform. A lightweight agent collects logs and endpoint telemetry from your fleet; the platform analyses it, raises alerts, correlates them into incidents and lets your SOC respond — all from one console.

The console is live at [**siem.sec1.ai**](https://siem.sec1.ai). SIEM, EDR, XDR and Patch Armor are products in the unified Sec1 platform and share one login, so the credentials you use across the platform sign you in here too. See [Setup & Access](/user-docs/10-siem-edr-xdr/setup-and-access.md).

## What it does

* **Log collection (SIEM)** — the SIEM agent tails log files (and receives syslog) from your hosts and forwards them to the platform, where they are parsed, searched and used for detection.
* **Endpoint telemetry (EDR)** — the EDR/XDR agent streams real activity from each host: running processes, network connections, file changes, installed software and connected peripherals.
* **Vulnerability scanning** — installed software is automatically matched against the CVE database, surfacing vulnerable packages per host and across the fleet.
* **Device control** — inventory connected USB/peripheral devices and approve or block them; the agent enforces a block by disabling the device on the host.
* **Application control** — define rules that allow or deny software by name, path or hash. Run in monitor mode (alert only) or enforce mode.
* **AI triage & investigation** — incidents come with an AI-generated investigation that summarises what happened, builds an attack timeline and maps activity to MITRE ATT\&CK.
* **Response actions** — act on a host directly from an incident: isolate it from the network, collect forensic artifacts, quarantine a file or block a malicious destination.

## How the pieces fit together

```
 Hosts (agents)  →  Telemetry & logs  →  Detection rules  →  Alerts  →  Incidents  →  Response
```

1. Agents collect logs and endpoint telemetry and send them to the platform.
2. Detection rules evaluate the incoming data and raise **alerts**.
3. Related alerts are correlated into **incidents** with AI investigation and a MITRE mapping.
4. Analysts review the incident and run **response actions** — or push the incident to Jira.

## Where to go next

* [**Data collection**](/user-docs/10-siem-edr-xdr/data-collection.md) — the two ways to get data in and how one agent serves SIEM, EDR and XDR.
* [**Setup & access**](/user-docs/10-siem-edr-xdr/setup-and-access.md) — reach the console and sign in.
* [**Install the agent**](/user-docs/10-siem-edr-xdr/install-the-agent.md) — get a host reporting in under a minute.
* [**Endpoints & telemetry**](/user-docs/10-siem-edr-xdr/endpoints-and-telemetry.md) — read the per-host detail view.
* [**Vulnerability management**](/user-docs/10-siem-edr-xdr/vulnerability-management.md) — find and triage vulnerable software.
* [**Device control**](/user-docs/10-siem-edr-xdr/device-control.md) — inventory and block peripherals.
* [**Application control**](/user-docs/10-siem-edr-xdr/application-control.md) — allow/deny software execution.
* [**Detections, alerts & incidents**](/user-docs/10-siem-edr-xdr/detections-alerts-incidents.md) — the detection-to-incident flow.
* [**Response actions**](/user-docs/10-siem-edr-xdr/response-actions.md) — the live-response toolkit.