# Vigilbase OS

> A multi-tenant security operating system where Vigil models your environment, investigates and changes things only after a person approves.

Source: https://docs.vigilbase.com/os

Vigilbase OS is a security operating system for your organisation. It connects to the security and IT tools you already use, keeps an evidence-backed model of your environment, investigates what it finds, proposes exact fixes, runs them only after a person approves, and then checks that each fix worked.

> [!IMPORTANT]
> Vigilbase OS is in preview. See [Preview status](#preview-status) before you rely on it.

## How it works

1. **Connect.** You connect providers such as Cloudflare, Microsoft Entra ID or CrowdStrike Falcon. You can always connect read-only. Write access for response actions is something you grant explicitly, and it never authorises an action on its own.
2. **Model.** Vigilbase normalises events and inventory into one model of your organisation: people, identities, devices, applications, cloud resources, controls and how they relate. This is the [Security Fabric](https://docs.vigilbase.com/os/concepts/environment-model).
3. **Detect and investigate.** Detections and posture checks run over that model. Findings open [investigations](https://docs.vigilbase.com/os/concepts/investigations) that collect evidence, hypotheses and notes in one place.
4. **Propose.** A fix is an action plan: the exact steps, targets and changes, with the evidence, blast radius and how it will be verified.
5. **Approve.** Nothing changes in your providers until an authorised person approves that exact plan. Your [policy](https://docs.vigilbase.com/os/concepts/approvals-and-policy) decides who may approve what.
6. **Verify.** After execution, Vigilbase checks that the change persisted, that it had the intended security effect and that it did no harm. See [Verification](https://docs.vigilbase.com/os/concepts/verification).

```mermaid caption="From a provider signal to a verified fix"
flowchart LR
  A[Connected providers] --> B[Security Fabric]
  B --> C[Detections and posture]
  C --> D[Investigation]
  D --> E[Action plan]
  E --> F{Approved by a person?}
  F -- yes --> G[Execute]
  F -- no --> H[No change]
  G --> I[Verify]
```

Vigil, the Vigilbase agent, has no write tools. It can read evidence and help investigate, but only the action runtime can change a provider, and only for an approved plan.

## How OS relates to Vigilbase One

Vigilbase OS is a separate product from [Vigilbase One](https://docs.vigilbase.com/one). It runs at `https://os.vigilbase.com` with its own data, connections and navigation. It does not share a database with One: connections you add in OS do not appear in One, and One data does not appear in OS.

You sign in to OS with your Vigilbase account through **Vigilbase Identity**, which also owns your organisations, invitations and account security. Vigil, the Vigilbase assistant, is the same agent you may know from One.

## Preview status

Vigilbase OS runs in production at `https://os.vigilbase.com`, but it is pre-release:

- **Connectors are being validated against real customer tenants.** Every connector is tested against recorded provider data. Validation against live tenants is still in progress, so some datasets may be incomplete or behave differently from what is described here. The [integrations catalogue](https://docs.vigilbase.com/os/integrations) shows each connector's maturity.
- **Vigil chat in OS is coming soon.** Asking Vigil questions from inside OS is not switched on yet.
- **Features and labels may change** before general availability.

Missing or delayed data is shown as incomplete, never as healthy. If a page says coverage is unknown or degraded, treat it that way.

## Where to start

:::cards
- [Get started](https://docs.vigilbase.com/os/getting-started) Sign in, choose your organisation, invite members and connect your first provider.
- [Concepts](https://docs.vigilbase.com/os/concepts) The environment model, investigations, approvals and verification.
- [Integrations](https://docs.vigilbase.com/os/integrations) Every connector, what it reads and which actions it supports.
- [Approvals](https://docs.vigilbase.com/os/approvals) Review and approve action plans.
:::