> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/setup-and-access.md).

# Setup & Access

Sec1 SIEM + EDR/XDR is live. This page covers how to reach the console, how login works and how the platform gateway sits in front of the backend.

## Reach the console

The SIEM console is at [**siem.sec1.ai**](https://siem.sec1.ai). It is a static single-page app served over HTTPS, so there is nothing to install to use it — open it in a browser and sign in.

## Log in

SIEM has its own sign-in form — enter your email and password. These are the **same credentials as the rest of the Sec1 platform**: SIEM, EDR, XDR and Patch Armor are products in one unified platform and share a single identity, so an account that works for the platform works here.

What happens behind the form:

* You submit your email and password to the SIEM backend over HTTPS.
* The backend exchanges them with the platform's identity provider (Keycloak) and, on success, returns a session token to your browser.
* The exchange happens **server-side** — the client secret never reaches the browser.
* Because all products share the same identity, signing in here is the same account you use everywhere else on the platform.

If your credentials are rejected, confirm them against the unified platform login — they are the same account.

## The platform gateway

All of the console's backend calls go through the platform gateway at **api.sec1.io**. The gateway:

* **Authenticates every request** using OpenID Connect, and passes your verified identity to the upstream service.
* **Routes by service.** Requests are addressed as `api.sec1.io/siem/<service>/*` — `query`, `sources`, `control`, `ingest` and `detections` — and the gateway forwards each to the matching SIEM service.
* **Shields the backend.** The SIEM services and their datastores run on a private network and are not reachable from the internet. Only the gateway and the console are exposed, and the gateway reaches the services over the internal network.

You don't configure any of this — it is how the hosted platform is wired. Your browser talks to siem.sec1.ai and api.sec1.io over HTTPS, the gateway handles auth and routing and the agent on your hosts talks outbound to the platform.

## Where to go next

* [**Install the agent**](/user-docs/10-siem-edr-xdr/install-the-agent.md) — get a host reporting in under a minute.
* [**Architecture**](/user-docs/10-siem-edr-xdr/architecture.md) — the end-to-end picture, agents through response.