How to use these docs
On this page
These docs are written as a course. Read them in order the first time; come back to the reference pages whenever you need them.
The path
-
Start here (15 minutes)
What Signal is, how it works and where it fits. No commands yet.
-
Getting started (30 minutes)
Requirements, installation, your first run and how to read it. Ends with a lab on your own machine.
-
Core concepts (30 minutes)
Signals and severities, entities, telemetry, time and scoping profiles: the five ideas you need to read any run correctly.
-
Modules (as you need them)
One page per module, all with the same headings. Read the ones your case needs, or all of them once.
-
Using Signal and Signal Console
Running Signal across many hosts, reading shadow copies, and triaging in the console.
-
Writing rules
How rules work, your first rule, the full syntax and every field Signal sees. For detection engineers.
-
Limits and gaps
What Signal reads, what it does not, and when you can rely on it. Read this before you trust a clean run.
How each page is built
Every page starts with one line saying what it answers.
Callouts mark what matters most:
Every command is in a code block with a copy button.
Severities always use the same colours: critical, high, medium, low.
Many pages end with Try it yourself: a safe exercise on your own machine. None of them is harmful; none needs an attack tool.
What you need
A Windows 10, Windows 11 or Windows Server machine where you are an administrator. A virtual machine is ideal.
Basic Windows knowledge: what an event log, a service and a scheduled task are.
For the console pages: a machine that can run Node.js.
Next
Check the requirements.