For the complete documentation index, see llms.txt. Markdown versions are available by appending .md to page URLs.
Lookout discovers private-network systems, collects security evidence, evaluates detection coverage, and produces evidence-backed Alerts and Incidents. The local deployment remains authoritative, and raw events stay local unless an operator explicitly enables export.
Open Lookout app
Sign in to your hosted dashboard, review security coverage, and manage your deployment.
Run Lookout locally
Start the server from source and inspect your first security graph.
Integrate with the HTTP interface
Authenticate, ingest events, query detection state, and manage Alerts.
Understand the architecture
Follow evidence from adapters and collectors through detection and correlation.
Operate a deployment
Review host layout, security boundaries, backup, recovery, and upgrades.
What you can build with Lookout
- Connect security telemetry through normalized events, raw-record normalizers, signed collectors, or survey adapters.
- Query a typed security graph and capability-aware detection plan.
- Import a supported Sigma subset and run deterministic or bounded behavioral analytics.
- Review Alerts and promote evidence into Incidents through a versioned HTTP interface.
- Keep raw evidence local while optionally synchronizing raw-log-free summaries to the hosted console.
Lookout is detection and observability infrastructure. It does not perform autonomous response or replace host and network hardening.
Choose a path
1
Evaluate from source
Follow the quickstart to start a loopback-only development server.
2
Learn the data model
Read the architecture overview and security architecture.
3
Build an integration
Use the HTTP reference or CLI reference.
4
Prepare for production
Review installation, authentication, and operations.