Accounts
A changed role reaches open sessions at once
Suspending someone ends their sessions, terminals and live connections, and their API keys stop. Windows agent 1.1.6 runs only commands signed for your organisation.
Detect, investigate and respond — without the internet
SIEM, XDR and SOAR with an AI analyst, running entirely on your own servers. These docs take you from installation to your first investigation.
In our cloud, or on your own server
Create an account and you are the administrator of your organisation at once, with nothing to install. Or have Legit AI install the whole platform — the AI model included — on a server in your network, remotely or on site, with or without internet. Either way you receive the running platform and start in the console.
Four layers on every event
Each event passes rule matching, fileless-malware heuristics, a per-host behavioural baseline and kill-chain correlation — the same four layers whichever way it arrived. The AI explains what was found; it does not decide what is an attack.
Nothing destructive on one person’s say-so
Isolating a host, ending a process, quarantining a file or blocking USB storage waits for a second person’s approval — the one who asked can never approve it. An isolation carries an end time, and the agent lifts it on its own when that time comes.
Events from anything that speaks HTTP
Firewalls and switches send syslog to port 514; log shippers and your own code send JSON, syslog or CEF to the ingest API with an API key. The console's Data sources page shows what to set up for each, with your platform's address filled in.
curl -X POST https://soc.example.com/api/ingest/event -H "X-API-Key: legit_…" -H "Content-Type: application/json" -d '{"event_type":"auth_failure","hostname":"web-01","src_ip":"203.0.113.7"}'The AI analyst runs on your server
It explains an alert from its evidence: which events, which rule, what to check next. On your own server the model runs beside the platform — on the GPU if there is one — so nothing leaves your network, and an alert's analysis is marked LIVE when the model wrote it.
How the AI analyst worksEvery capability on one page
DirectoryWhat’s new
Recent changes to the platform.
Network
Scan a network from a server you monitor
Private ranges only, with nothing installed, and a router read with its owner's login. Every fact is marked confirmed or estimated.
Response
A secure terminal beside the alert
A two-minute certificate, the whole screen recorded and sealed, destructive lines held. Each organisation chooses solo or four eyes.
Install
Legit AI installs it on your own server
Remotely or on site, the AI model included: the server is checked, every secret and a certificate are generated, the model is chosen for the server, and the whole platform is backed up every night. What arrives is the running platform, with no source code.