For the complete documentation index, see llms.txt. This page is also available as Markdown.

Overview

Sec1 SIEM + EDR/XDR is a unified detection and response platform. A lightweight agent collects logs and endpoint telemetry from your fleet; the platform analyses it, raises alerts, correlates them into incidents and lets your SOC respond — all from one console.

The console is live at siem.sec1.ai. SIEM, EDR, XDR and Patch Armor are products in the unified Sec1 platform and share one login, so the credentials you use across the platform sign you in here too. See Setup & Access.

What it does

  • Log collection (SIEM) — the SIEM agent tails log files (and receives syslog) from your hosts and forwards them to the platform, where they are parsed, searched and used for detection.

  • Endpoint telemetry (EDR) — the EDR/XDR agent streams real activity from each host: running processes, network connections, file changes, installed software and connected peripherals.

  • Vulnerability scanning — installed software is automatically matched against the CVE database, surfacing vulnerable packages per host and across the fleet.

  • Device control — inventory connected USB/peripheral devices and approve or block them; the agent enforces a block by disabling the device on the host.

  • Application control — define rules that allow or deny software by name, path or hash. Run in monitor mode (alert only) or enforce mode.

  • AI triage & investigation — incidents come with an AI-generated investigation that summarises what happened, builds an attack timeline and maps activity to MITRE ATT&CK.

  • Response actions — act on a host directly from an incident: isolate it from the network, collect forensic artifacts, quarantine a file or block a malicious destination.

How the pieces fit together

 Hosts (agents)  →  Telemetry & logs  →  Detection rules  →  Alerts  →  Incidents  →  Response
  1. Agents collect logs and endpoint telemetry and send them to the platform.

  2. Detection rules evaluate the incoming data and raise alerts.

  3. Related alerts are correlated into incidents with AI investigation and a MITRE mapping.

  4. Analysts review the incident and run response actions — or push the incident to Jira.

Where to go next

Last updated