Fits the stack you already run.
Tracehold signs people in through your identity provider, sends detections to the security tools you already watch, routes alerts to the channels people already read, and deploys with the device management you already use. The browser extension needs no proxy.
Sign your team in with the identity you already have
People log in through your identity provider, so there is no separate password to manage.
OpenID Connect single sign-on
Use any OpenID Connect (OIDC) identity provider as your single sign-on.
LDAP and Active Directory
Sign in with your directory credentials and sync users from LDAP or Active Directory, so who is in scope stays in step with the directory you already maintain.
Stream detections into your security stack
Detections from the browser extension go to your SIEM over HTTPS, so AI data-loss events sit next to the rest of your telemetry. What is sent is event metadata (rule, severity, category, destination, action), not the matched value. An administrator can also escalate an incident to your SIEM by hand.
Splunk HEC
Send detections to the Splunk HTTP Event Collector with your HEC token. You correlate, alert and report where your team already works.
CEF over HTTPS
Tracehold sends detections formatted as CEF over HTTPS to the collector URL you configure, authenticated with a key you set. By default only high-severity findings are sent, and without the matched value.
Route findings to the right channel
An alert carries the severity, the destination and the names of the findings, not the content. Alerts come from findings in the browser extension and can go to Slack, Microsoft Teams or a webhook URL of your own.
Slack
Post notable detections into a Slack channel through an incoming webhook, so the right people notice without opening another tool.
Microsoft Teams
Route findings to a Teams channel through a webhook, so security and compliance stay in the loop.
You set the threshold
Alerts fire for high and critical findings. You choose whether to raise the floor to critical, and how many findings within a time window trigger an alert, so the ones that arrive get read.
Pull data out and automate
For your own tooling and reporting: a read API with scoped keys, and custom dashboards sent by email on a schedule.
Public API
Read events, stats and policies with an API key, for your own dashboards or data warehouse. Each key is limited to the read scopes it needs.
Scheduled dashboards
Custom dashboards can be emailed on a schedule, as PDF or CSV.
Push the extension fleet-wide, no proxy required
Rolling Tracehold out is a managed-extension push, not a network project. The console generates the managed-policy files (.reg, .ps1, .json) and the installer, and your device management does the deployment.
Microsoft Intune
Deploy the browser extension through Intune. There is a step-by-step guide for it.
GPO and other MDM
Group Policy for Active Directory and other device management tools can push the same managed-policy files. There are guides for both.
No proxy, no network changes
The extension needs no inline proxy and no traffic to re-route, because the detection engine runs in the browser.
Tell us what's in your stack
Walk through how Tracehold plugs into your identity provider, SIEM, chat tools and device management with our team, then start in observe-only mode and see what it would catch.