Overview
Sec1 SIEM + EDR/XDR is a unified detection and response platform. A lightweight agent collects logs and endpoint telemetry from your fleet; the platform analyses it, raises alerts, correlates them into incidents and lets your SOC respond — all from one console.
The console is live at siem.sec1.ai. SIEM, EDR, XDR and Patch Armor are products in the unified Sec1 platform and share one login, so the credentials you use across the platform sign you in here too. See Setup & Access.
What it does
Log collection (SIEM) — the SIEM agent tails log files (and receives syslog) from your hosts and forwards them to the platform, where they are parsed, searched and used for detection.
Endpoint telemetry (EDR) — the EDR/XDR agent streams real activity from each host: running processes, network connections, file changes, installed software and connected peripherals.
Vulnerability scanning — installed software is automatically matched against the CVE database, surfacing vulnerable packages per host and across the fleet.
Device control — inventory connected USB/peripheral devices and approve or block them; the agent enforces a block by disabling the device on the host.
Application control — define rules that allow or deny software by name, path or hash. Run in monitor mode (alert only) or enforce mode.
AI triage & investigation — incidents come with an AI-generated investigation that summarises what happened, builds an attack timeline and maps activity to MITRE ATT&CK.
Response actions — act on a host directly from an incident: isolate it from the network, collect forensic artifacts, quarantine a file or block a malicious destination.
How the pieces fit together
Hosts (agents) → Telemetry & logs → Detection rules → Alerts → Incidents → ResponseAgents collect logs and endpoint telemetry and send them to the platform.
Detection rules evaluate the incoming data and raise alerts.
Related alerts are correlated into incidents with AI investigation and a MITRE mapping.
Analysts review the incident and run response actions — or push the incident to Jira.
Where to go next
Data collection — the two ways to get data in and how one agent serves SIEM, EDR and XDR.
Setup & access — reach the console and sign in.
Install the agent — get a host reporting in under a minute.
Endpoints & telemetry — read the per-host detail view.
Vulnerability management — find and triage vulnerable software.
Device control — inventory and block peripherals.
Application control — allow/deny software execution.
Detections, alerts & incidents — the detection-to-incident flow.
Response actions — the live-response toolkit.
Last updated