Run it, prove it,
and see when it breaks.
The unglamorous half of a platform decides whether you can actually operate it. Access control per module, single sign on, an audit trail, storage you tune yourself, and a pipeline view that says which stage lost an event.
Every administrative action, with actor, object and time in your timezone.
Permission per module, not one administrator flag.
An auditor needs to read the compliance views and nothing else. An analyst needs to work cases without being able to disable detection. Each module declares which roles get read, write and delete, and the same map guards the interface and the API.
- ▸Four roles. Administrator, SOC lead, analyst and auditor, each with a different reach.
- ▸Per module, per action. Write implies read, delete implies write, and an unknown role is denied rather than defaulted.
- ▸One rule set for both surfaces. The API and the interface consult the same map, so nothing is reachable by URL alone.
- ▸Single sign on. SAML and OIDC for identity providers, with local accounts still available.
Accounts and roles. Single sign on sits alongside local authentication.
Who changed the detection, and when.
In a security platform, the configuration is part of the attack surface. Every administrative action is recorded with the actor, the object, the action and the time, rendered in the administrator timezone rather than raw UTC.
- ▸Every change is recorded. Rules, decoders, users, settings, retention and integrations.
- ▸Searchable and paginated like every other list in the product, and exportable.
- ▸Timestamps in your timezone. One setting drives every displayed time. Only raw log content stays verbatim UTC.
- ▸Its own retention. The audit table has a retention window you set, independent of event data.
Actor, action, object, time. Retained on its own schedule.
Retention is a setting, not a support ticket.
Raw events, decoded events, findings, cases, runs and reports each have their own lifetime, because they have different value. You set each one in the interface and the change applies to the storage layer directly.
- ▸Per table windows. Keep findings for a year and raw events for a fortnight, or whatever your obligation is.
- ▸Applied to the database as a real expiry policy, not a nightly delete job that falls behind.
- ▸Nothing hardcoded. There is no retention constant compiled into the product for you to work around.
- ▸Sizes are visible. Row counts and disk usage per table, so a retention decision is an informed one.
Each table with rows, size and an editable retention window.
When a stage stops, it says so.
A pipeline that silently drops events is the worst failure a security platform can have, because everything still looks green. Pipeline Health counts what arrived, what decoded, what matched a rule and what became a finding, and raises the gaps.
- ▸Stage by stage counts. Raw, decoded, rule matched and findings, so a drop is attributable to a stage.
- ▸Errors and warnings surface. Rules that can never fire, dead parents and worker errors appear here rather than nowhere.
- ▸Agent and manager control. Enrol agents, manage groups, edit and validate the manager configuration, read its logs.
- ▸Active response. Run a containment command against an agent from the console, from a case, or from a playbook.
Ingest to findings, stage by stage, with the errors that would otherwise be silent.
Ask who changed a detection
rule last quarter.
Bring the access question your auditor asks. We will show you the role map, the audit entry and the retention policy behind the answer.
Powered by Codesecure Solutions. Self hosted, cloud or fully managed.