What is Signal?
On this page
Signal is a one-minute, read-only survey of a Windows host. It tells you where to look first and, just as clearly, what it could not see.
Signal DFIR Survey: The First Minute of Every Investigation.
Where to Look & What You Can't See!
The problem it solves
An alert fires, or a call comes in: "this machine is acting strange". You now have a host and very little else.
The first hour of an investigation is usually spent the same way: pulling event logs, listing services and scheduled tasks, checking Run keys, reading PowerShell history, looking at who signed in. Most of that data is normal. The few lines that matter are buried in it.
Signal does that first pass for you. It reads what Windows already recorded, runs more than 200 high-fidelity rules over it, and hands you a short list of signals: the things worth your attention, each with what happened, why it matters and what to do next.
What Signal is
It is
A survey: it looks at the whole host quickly and points at what stands out.
Read-only: it changes nothing on the host. It installs nothing, starts no service and writes no file except its own run.
Fast: about one minute or less on a typical host.
One file:
signal.exe, no installer, no runtime, no dependency.Honest about its blind spots: every source it could not read, every audit setting that was off and every rule it could not run is in the output.
It is not
Not an EDR. It does not watch the host continuously or block anything.
Not a collector. It does not copy logs or disk images for later analysis.
Not a scanner. It does not scan files or memory for malware.
Not a full forensic analysis. It tells you where to start; the analysis is still yours.
What you get from a run
One run produces one JSON document about one host. Inside it:
Part | What it tells you |
|---|---|
Signals | What the rules matched, graded critical, high, medium or low, each with its evidence and next steps. |
Entities | The things the signals are about (a program, an account, a service, an address), each merged from every source that names it. |
Telemetry | The state of the sources: which logs were read, which audit settings were off, what could not be seen. |
Small tables | Short, capped summaries (logon sources, persistence entries, installed applications) for comparing hosts. |
You can read the JSON yourself, but most analysts load it into Signal Console, which shows many hosts at once and keeps your triage decisions.
Who it is for
Incident responders who need to know, fast, whether a host is involved and where to dig.
SOC analysts who want host context behind an alert.
Threat hunters who sweep many hosts for the same pivot points.
Detection engineers who write their own rules over what Windows records.
Next
See how Signal works, from Windows' records to a signal, in one picture.