What the console is
On this page
Signal Console is a small web app that brings many hosts' runs together: one list of what to look at across the fleet, one page for each thing, and your team's triage decisions kept beside them.
What it does
Brings runs together
Runs arrive by upload or by push straight from Signal.
Each investigation is a case, with its own database and its own push key.
A host collected again keeps its history; signals new since the last collection are marked.
Helps you decide
Signals: one row per entity on a host, with every signal about it.
Triage: mark each entity new, reviewed, benign or escalated, with a note.
Reports: a compromise assessment report in Word or PDF.
How it fits with Signal
-
Signal surveys each host
On the host,
signal livewrites one run. -
The run reaches the console
Uploaded on the Import page, or pushed with the case's push key (Pro).
-
The console checks it
Every run is checked against Signal's output format; a run from a Signal before 1.0.0 or in a newer format is refused, an older format is upgraded and marked.
-
You triage
Overview, Signals, Timeline, Graph and the data pages show the fleet; your decisions are kept per entity.
Designed for restricted networks
Runs on Node.js, with no front-end dependency and no CDN: it works in a network with no Internet access.
Local accounts with roles: admin, analyst, viewer (read-only).
HTTPS by its own certificate or behind a reverse proxy; every sign-in, account change and push key change in an audit log.