Where Signal fits
Signal does not replace your EDR, SIEM or antivirus. It answers a different question, at a different moment: what does this host itself say, right now?
The category: a DFIR survey
Signal is an automated triage tool for Windows hosts. It sits between two kinds of incident response tool:
Investigation platforms collect a host's artifacts, score them and help you investigate. Signal does the triage part of that work.
Task-specific tools each do one job well: a collector, a log hunter, a registry parser, an IOC scanner. Signal is just as small and easy to run, a single executable.
What makes it different: it runs on the host, in about a minute, reads only what Windows recorded, and reports its own blind spots beside its findings.
Beside the tools you already have
Tool | What it does well | The gap Signal fills |
|---|---|---|
EDR | Watches processes, files and connections continuously; blocks and isolates. | Many hosts have no EDR, or it was installed after the breach, or it was tampered with. An EDR sees only what happened after it was installed. Signal reads the history Windows already kept: logs, Prefetch, tasks, services, PowerShell history. |
SIEM | Searches and correlates the logs forwarded to it, across the fleet. | A SIEM holds only what was forwarded. It does not see the host's state: persistence entries, browser extensions, antivirus exclusions, recovery settings. And it rarely tells you that the host's auditing was off. |
Antivirus | Judges files and behaviour against known malware. | Antivirus judges files, not activity or configuration. Signal also reads what the antivirus itself recorded: detections, what became of each, exclusions, and who turned protection off. |
Collectors | Copy artifacts off the host for later analysis. | A collection still has to be parsed and analysed. Signal gives you the conclusions first, so you know what to collect and where to look. |
Log hunters | Run detection rules over event logs. | Event logs are only part of the picture. Signal joins logs to the host's state (a scheduled task now, and the log record of its creation) and tells you when the log cannot be trusted. |
When to run Signal
At the start of an incident, on the first host you hear about.
On every host in scope, with the incident's pivot points in a profile, to find where else they appear.
During a compromise assessment, across a fleet, to find the hosts worth a deeper look.
After cleanup, to check that persistence and remote access tools are gone.
Next
Read how to use these docs, then start with the requirements.