Directory
Every capability these docs cover — what it does, and where to read about it.
By group
Alert queue
Triage from the keyboard. Every dismissal needs a reason; severe alerts carry a deadline.
AnalysisInvestigations
One board per case: evidence, hypotheses, pivots and snapshots with a SHA-256.
AnalysisAttack path
Alerts that share a host, user, address or hash within 24 hours, joined into one attack.
AnalysisFile scanner
Twelve engines; more than 40 formats known by their bytes, not their names.
AnalysisThreat intelligence
An offline lookup across your IOCs, malware families and APT groups; feeds and brand watch only with permission.
AnalysisAI analyst
A local model explains alerts from their evidence; each analysis is marked LIVE or FALLBACK.
DetectionDetection layers
Rules, fileless heuristics, behavioural baselines and kill-chain correlation on every event.
DetectionDetection rules
62 production rules mapped to MITRE ATT&CK; switch off, edit or add your own per tenant.
ResponsePlaybooks
Response as a graph of steps, with a test run that shows what each step would do.
ResponseIsolation and kill
Isolate a host, end a process, quarantine a file — alone with a fresh code, or on a second person’s approval.
ResponseSecure terminal
A shell on a monitored server from the console — fresh code, two-minute certificate, recorded and guarded.
ResponseUSB control
Alerts on unapproved storage devices; approve by serial; switch USB storage off per machine.
InstallFacts and evidence
Every figure with how it was measured, how to check it yourself, and what is not claimed.
SensorsNetwork map and scan
What each server reports, a scan run from that server, and a router read with its owner's login.
DetectionRansomware and traps
One threat level from the signals before and during encryption, canary files and decoy credentials.
AnalysisCompliance evidence
Evidence packages for ISO 27001, SOC 2, PCI DSS v4 and the CBU, exported for your auditor. Not a certificate.
AdministrationAccounts and sign-in
Roles, the second factor, what happens when someone leaves, and what Legit AI staff can see.
AdministrationPlans and limits
What each plan allows, what happens at a limit, and what happens when a licence ends.
InstallDesktop app
The console in its own window: one edition for the cloud, one for your own server with no internet.
SensorsWindows agent
Security, System and Sysmon logs; carries out approved response commands.
SensorsSSH servers
Linux servers watched every 30 seconds over SSH, with nothing installed.
InstallOn your own server
Legit AI installs the whole platform, the AI model included, in your network — remotely or on site, with or without internet.
InstallLooking after the platform
Nightly backups, your data export, rule updates in the console; new versions and settings by Legit AI.
SensorsData sources
Every way events arrive: the Windows agent, SSH, syslog on port 514, Fluent Bit, Vector and the API.
InstallOffline updates
Signed bundles of rules and threat intelligence, checked before anything is applied.
APISend events
JSON, syslog, CEF, cloud audit records and log files, through one pipeline.
APIAPI keys
Tenant-scoped keys with a role, scopes and an expiry of at most a year.
APIFindings API
List, read and triage alerts from a script, under the same rules as the console.
No capability matches. Clear a filter or the search.