Deploy the platform.
Connect your infrastructure.

System overview

Tranzify Watch is a self-hosted platform for telemetry collection, event exploration, threat detection and incident response.

System requirements

The installer exits before making changes when the host does not meet the minimum requirements.

One-command installation

The installer validates compatibility, verifies the signed release and deploys isolated system components.

1. 1
   Validate the host

   Check OS, architecture, CPU, memory, disk, ports and package access.

2. 2
   Verify the release

   Validate SHA-256, the KMS manifest signature and installer compatibility.

3. 3
   Prepare services

   Create the system account, directories, PostgreSQL, ClickHouse, backend and frontend.

4. 4
   Complete setup

   Use a one-time token to create the first administrator in the setup wizard.

Verify the release without installing

Network and TLS

Use a public domain, a direct IP address or a closed network. The connection mode can be changed later in platform settings.

Connect a Linux agent

The agent enrolls once. A short-lived token is stored only as a hash and becomes invalid after successful use.

What a policy controls

• heartbeat, resource and inventory intervals;
• update, antivirus, firewall and listener checks;
• journald units and custom log file paths;
• queue size, batching and offline behavior;
• a dedicated dataset for every event stream.

Agentless data sources

Scheduled sources keep an independent cursor and do not reread successfully processed data.

Parsers and detection rules

A text line first matches a safe RE2 expression. Named groups become normalized fields before a versioned detection rule evaluates them.

192.0.2.10 - admin [27/Jul/2026:08:12:45 +0000] "GET /health HTTP/1.1" 200 42
                    ↓ RE2 named groups
source.ip · user.name · http.method · url.path · http.status_code

Raw preserves the original event for investigation. Normalized contains the stable output of a specific parser revision used by filters, dashboards and rules.

Incident response

Promote an alert to an incident with owners, statuses, comments, attachments, evidence, resolution notes and a complete activity timeline.

The workflow helps produce operational evidence, but does not by itself constitute ISO 27001 or PCI DSS certification.

Security model

• Least privilegeRoles separate visibility, alert handling and administration.
• Signed configurationThe agent applies only a valid Ed25519 policy and does so atomically.
• Protected secretsSource credentials are encrypted and never returned by the API after saving.
• Immutable auditSign-ins, reads, changes, errors and access denials enter the activity log.
• No arbitrary codeCustom parsers and rules use a constrained DSL without code execution.

Updates and rollback

Every release is immutable. The client verifies the manifest signature before download and every artifact hash before installation.