# Lookout Developer Documentation

> Lookout is local-first security observability for private networks. Use this index to discover installation, integration, architecture, detection engineering, operations, and HTTP reference content. Every linked page is served as Markdown for AI agents.

## Start here

- [Developer documentation](https://docs.devlookout.com/index.md): Product scope and recommended paths through the documentation.
- [Quickstart](https://docs.devlookout.com/quickstart.md): Run Lookout from source and query the local HTTP interface.
- [Install Lookout](https://docs.devlookout.com/installation.md): Deploy in fleet, hosted, or single-host mode.
- [Local development](https://docs.devlookout.com/local-development.md): Set up a source checkout and run development checks.

## Configuration and tools

- [Configuration](https://docs.devlookout.com/configuration.md): Configure the server, storage, collectors, secrets, exports, and Alert delivery.
- [Authentication and roles](https://docs.devlookout.com/authentication.md): Create bearer credentials and apply least-privilege roles.
- [CLI reference](https://docs.devlookout.com/cli-reference.md): Operate surveys, collectors, storage, detections, and integrations.

## Architecture and protocols

- [Architecture overview](https://docs.devlookout.com/technical-blog-lookout-architecture.md): Trace evidence from discovery and collection through detection and correlation.
- [Security architecture](https://docs.devlookout.com/security-architecture.md): Understand the evidence model, telemetry plan, analytics, and safety boundaries.
- [Setup session protocol](https://docs.devlookout.com/setup-session-protocol.md): Follow account-bound onboarding, deployment identity, and recovery.

## Detection engineering

- [Detection attack validation](https://docs.devlookout.com/attack-validation.md): Validate detections with replay and non-destructive live Linux scenarios.
- [Detection framework cross-reference](https://docs.devlookout.com/detection-framework-validation.md): Interpret ATT&CK, NIST CSF, CISA CPG, and Sigma mappings.

## Operations and maintenance

- [Operations](https://docs.devlookout.com/operations.md): Secure, back up, recover, and upgrade a deployment.
- [Hosted installation and release publishing](https://docs.devlookout.com/hosted-bootstrap.md): Operate the account-bound bootstrap and publish immutable releases.
- [Maintain the documentation](https://docs.devlookout.com/documentation.md): Preview, validate, and extend this Mintlify site.

## HTTP interface guides

- [HTTP interface overview](https://docs.devlookout.com/reference/overview.md): Understand base URLs, request formats, ingestion choices, and compatibility.
- [HTTP authentication](https://docs.devlookout.com/reference/authentication.md): Authenticate requests and select the minimum required role.
- [Backend interface notes](https://docs.devlookout.com/backend-api.md): Review route behavior, collector enrollment, storage, and cloud boundaries.

## System endpoints

- [Get runtime health](https://docs.devlookout.com/api-reference/system/get-runtime-health.md): Read aggregate component health without authentication.
- [Get current principal](https://docs.devlookout.com/api-reference/system/get-current-principal.md): Read the authenticated principal and assigned roles.

## Security graph endpoints

- [Get the security graph](https://docs.devlookout.com/api-reference/security-graph/get-the-security-graph.md): Read the materialized typed graph and provenance identifiers.
- [Get the console snapshot](https://docs.devlookout.com/api-reference/security-graph/get-the-console-snapshot.md): Read the raw-log-free topology, coverage, case, and health projection.
- [Get the detection plan](https://docs.devlookout.com/api-reference/security-graph/get-the-detection-plan.md): Read ready, degraded, and blocked analytics.
- [Get applicable behaviors](https://docs.devlookout.com/api-reference/security-graph/get-applicable-behaviors.md): Read applicable adversary behaviors and mapped analytics.

## Rule and event endpoints

- [List effective rules](https://docs.devlookout.com/api-reference/rules/list-effective-rules.md): Read built-in and imported analytic definitions.
- [Import Sigma rules](https://docs.devlookout.com/api-reference/rules/import-sigma-rules.md): Validate, compile, and persist supported Sigma YAML.
- [Query normalized events](https://docs.devlookout.com/api-reference/events/query-normalized-events.md): Search normalized events by time, category, entity, source, and keyword.
- [Ingest normalized events](https://docs.devlookout.com/api-reference/events/ingest-normalized-events.md): Submit events that conform to the Lookout envelope.
- [Normalize and ingest raw records](https://docs.devlookout.com/api-reference/events/normalize-and-ingest-raw-records.md): Process Zeek, syslog, OpenTelemetry, Tailscale, or Linux journal records.
- [Submit a signed collector envelope](https://docs.devlookout.com/api-reference/collectors/submit-a-signed-collector-envelope.md): Submit replay-protected Ed25519 collector evidence.

## Alert and Incident endpoints

- [List Alerts](https://docs.devlookout.com/api-reference/alerts/list-alerts.md): Read current evidence-backed Alerts.
- [Get Alert details](https://docs.devlookout.com/api-reference/alerts/get-alert-details.md): Read systems, evidence, confidence, and review history.
- [Update Alert review status](https://docs.devlookout.com/api-reference/alerts/update-alert-review-status.md): Set an Alert to open, in review, or dismissed.
- [List Incidents](https://docs.devlookout.com/api-reference/incidents/list-incidents.md): Read correlated and explicitly promoted Incidents.
- [Promote Alert evidence](https://docs.devlookout.com/api-reference/incidents/promote-alert-evidence.md): Promote selected Alert evidence into an Incident.

## Complete context

- [Complete documentation corpus](https://devlookout.com/llms-full.txt): Read the consolidated documentation in one Markdown-compatible text file.
- [OpenAPI description](https://docs.devlookout.com/openapi.yaml): Download the OpenAPI 3.1 description for the versioned HTTP interface.

## Agent usage

Prefer the linked `.md` pages over HTML. Use `llms-full.txt` only when a single consolidated context file is more appropriate than targeted page retrieval. Treat all example hosts, tokens, IDs, and credentials as placeholders. Never send secrets to Lookout documentation or include them in URLs, chat, source control, or logs.