Welcome to Secure60 Docs

Secure60 ingests, detects, investigates and reports across six capabilities on one data model — with an optional range of services and digital workers to take on the jobs you choose. These docs cover setup, day-to-day use and reference; the sections below point you to the right place.

Documentation Structure

Our documentation is organized into focused sections to help you find the information you need quickly:

Get Started

New to Secure60? Start here to understand the platform fundamentals:

• Architecture - Core platform components and how they work together
• Features and Capabilities - What Secure60 can do for your organization
• Data Model - How data flows and is structured in the platform

Solutions

Explore tailored solutions for different organizational needs:

• SIEM / SOC Operations - Complete security operations center solution
• Data Loss Detection - Data theft, leakage and destruction detected from log and audit streams
• Compliance & Log Archiving - Regulatory compliance and log retention
• Governance, Risk & Compliance - Framework-based compliance and audit readiness
• Enterprise & Service Provider - Large-scale and multi-tenant deployments
• Explore by capability - The six capabilities: Log Management, SIEM, Vulnerability Management, Governance, AI Security, and Digital Risk Protection

Collect & Ingest

Learn how to bring data into Secure60:

• Data Integration - Optimize storage and performance
• Event Enrichment - Enhance your data with context
• Data Privacy - Implement privacy controls and data masking
• Secure60 Collector - Lightweight agent for data collection
• Secure60 Netflow Processor - Network flow data processing
• Integration Technology - Connect with existing tools and services
• Secure60 Balancer - Load balancing and high availability

Detect & Investigate

Powerful capabilities for threat detection and investigation:

• Search - Advanced search interface and query capabilities
• Entity Analytics - User and entity behavior analytics (UEBA)
• Rules and Responses - Custom detection rules and automated responses
• Threat Intelligence - Threat intelligence integration and IOC matching
• Vulnerability Management - SBOM-based vulnerability scanning and lifecycle management

Manage & Administer

Platform administration and management:

• Deployment Types - Deployment options and architecture patterns
• Deployment Manager - Manage and monitor your deployments
• Multi Tenancy - Organisational hierarchies, projects, and structure
• User Management - Manage users and access
• RBAC - Role-based access control and permissions
• Audit Trail - Comprehensive audit logging and compliance

Digital Workers

AI-powered roles that operate inside the platform on your behalf:

• Worker Concepts & Configuration - How workers run, what they read, how to grant decision authority
• The Eight Named Roles - L1 Triage, SOC L2/L3, Threat Hunter, Detection Engineer, Vulnerability Manager, Governance Tracker, Incident Response, Risk Reporter
• Scoping a Custom Worker - Scoping call, spec, build, deploy — what to bring, what we need
• Audit Trail & Oversight - How every worker action is logged, sign-off workflows, drift detection

AI Security

Protect and govern AI workloads across your organisation:

• AI Activity - Every AI application in use, who uses it, where it goes, and the audit trail down to each prompt and reply
• Discover AI Applications - AI Protector seen list and the AI Traffic Detection parser template for proxy, DNS and firewall logs
• AI Application Lifecycle - Discovered, Under review, Sanctioned, Restricted, Prohibited, Retired — and the AI Governance rules
• Prompt-Attack Detection - Prompt-injection detection in the AI Protector, monitor or block, and the managed rules
• LLM Data Exfiltration - Personal data and secrets in prompts, tool results, replies and tool calls: detect, mask, block
• AI Audit Trail - Logging every prompt and model response, indexing, search, retention
• AI Governance Frameworks - ISO 42001, NIST AI RMF, EU AI Act — controls mapped, evidence collected

Digital Risk Protection

Watch the risks outside your perimeter — the exposure that never reaches your logs:

• Look-alike domains - Typosquats and homoglyphs registered to impersonate you, scored on mail capability, hosting, certificate and registration age
• Credential & breach exposure - Credentials tied to your monitored domains surfacing in breach data
• AI reputation - How AI models answer questions about your brand, monitored as a security and governance risk
• The threat lifecycle - How findings become managed threats, and how closed threats stay closed

Reporting & Export

Create dashboards, reports, and export data:

• Reports - Create and schedule various types of reports
• Export - Flexible data export for compliance and integration

Guides

Step-by-step implementation guides and tutorials for practical hands-on learning and specific integration scenarios.

Reference

Technical reference materials:

• Query Syntax - Complete search query language reference
• Key Concepts - Core platform concepts and terminology
• Common Information Model - Data schema and field mappings
• API Access - API documentation and integration examples

Need Help?

• Getting Started: Visit our Get Started section for platform fundamentals
• Implementation: Check our Guides for step-by-step tutorials
• Technical Questions: Browse our Reference documentation
• Support: Contact our team at support@secure60.io