# Environment model and Security Fabric

> How Vigilbase OS turns provider data into one evidence-backed model of your people, devices, resources and controls.

Source: https://docs.vigilbase.com/os/concepts/environment-model

Vigilbase OS keeps a model of your environment called the **Security Fabric**. It is built from the inventory, configuration and events that your connected providers report, and every part of it points back to the evidence it came from.

## What the model contains

The Security Fabric holds **entities** and the **relationships** between them.

- **Entities** include people, provider identities, service accounts, groups, roles, devices, applications, cloud resources, domains, networks, controls, policies and vulnerabilities.
- **Relationships** describe how entities connect, for example a person who owns a device, an identity that is a member of a group, or a resource that is protected by a control.

Each fact records which source reported it, how confident Vigilbase is, how it was resolved and the time range it was true for. Vigilbase separates when something was true from when it learned about it, so an investigation into last week looks at last week's relationships, not today's.

## One entity, many sources

The same laptop can appear in your endpoint tool, your device management tool and your identity provider. Vigilbase keeps each source's record and links them to one canonical entity.

- Matches on stable provider IDs and verified directory or device links are applied automatically.
- Weaker matches, such as a similar hostname, email or IP address, are shown as proposals for a person to confirm or reject.
- Merges and splits are versioned and audited, and can be reversed.

A low-confidence link can support a hypothesis in an investigation, but it can never on its own justify a containment action against that asset.

## Coverage is part of the model

Missing data is never treated as good news. Every connection and dataset reports its health, and query results carry completeness information. When a provider is disconnected, delayed or not licensed for a dataset, Vigilbase shows the gap instead of an empty, healthy-looking result.

## Where you see it

- [Security Fabric](https://docs.vigilbase.com/os/security-fabric) lets you browse entities, open their details and review match proposals.
- [Logs](https://docs.vigilbase.com/os/logs) shows the normalised events behind the model.
- [Posture](https://docs.vigilbase.com/os/posture) shows which detections can run on the data you have.