> ## Documentation Index
> Fetch the complete documentation index at: https://devlookout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Lookout developer docs

> Build, integrate, and operate local-first security observability for private networks.

> For the complete documentation index, see [llms.txt](https://devlookout.com/llms.txt). Markdown versions are available by appending `.md` to page URLs.

Lookout discovers private-network systems, collects security evidence, evaluates detection coverage, and produces evidence-backed Alerts and Incidents. The local deployment remains authoritative, and raw events stay local unless an operator explicitly enables export.

<CardGroup cols={2}>
  <Card title="Open Lookout app" icon="right-to-bracket" href="https://app.devlookout.com">
    Sign in to your hosted dashboard, review security coverage, and manage your deployment.
  </Card>

  <Card title="Run Lookout locally" icon="terminal" href="/quickstart">
    Start the server from source and inspect your first security graph.
  </Card>

  <Card title="Integrate with the HTTP interface" icon="brackets-curly" href="/reference/overview">
    Authenticate, ingest events, query detection state, and manage Alerts.
  </Card>

  <Card title="Understand the architecture" icon="diagram-project" href="/technical-blog-lookout-architecture">
    Follow evidence from adapters and collectors through detection and correlation.
  </Card>

  <Card title="Operate a deployment" icon="server" href="/operations">
    Review host layout, security boundaries, backup, recovery, and upgrades.
  </Card>
</CardGroup>

## What you can build with Lookout

* Connect security telemetry through normalized events, raw-record normalizers, signed collectors, or survey adapters.
* Query a typed security graph and capability-aware detection plan.
* Import a supported Sigma subset and run deterministic or bounded behavioral analytics.
* Review Alerts and promote evidence into Incidents through a versioned HTTP interface.
* Keep raw evidence local while optionally synchronizing raw-log-free summaries to the hosted console.

<Info>
  Lookout is detection and observability infrastructure. It does not perform autonomous response or replace host and network hardening.
</Info>

## Choose a path

<Steps>
  <Step title="Evaluate from source">
    Follow the [quickstart](/quickstart) to start a loopback-only development server.
  </Step>

  <Step title="Learn the data model">
    Read the [architecture overview](/technical-blog-lookout-architecture) and [security architecture](/security-architecture).
  </Step>

  <Step title="Build an integration">
    Use the [HTTP reference](/reference/overview) or [CLI reference](/cli-reference).
  </Step>

  <Step title="Prepare for production">
    Review [installation](/installation), [authentication](/authentication), and [operations](/operations).
  </Step>
</Steps>