13 months of security history
Alerts, sign-ins, admin and configuration changes, and evidence, on every paid plan.
Vigilbase OSIn preview
Only the alerts that need a person reach your team.
Vigil, our AI agent, reviews every alert from the security tools you already pay for. Nothing changes in your environment until your team approves the fix.
14 days of OS 25 with no card, then OS Free for as long as you use it.
os.vigilbase.com/contosoSample data
Overview
Needs you
Approval queue1 awaiting your decision
Priority cases3 open
Signals · last 24 hours
High/critical findings22 1 still open
Less noise for your team. A clear answer on every alert.
Hear only what needs you
Vigil looks at every alert and sorts it. The ones that need a person are escalated with one clear question to answer. The rest are summarised for you to read when it suits you.
See why, not just what
Every verdict cites the sign-ins, changes and events Vigil read in your own tools. If Vigil can't back a verdict with evidence, the case goes to a person.
Fix it, then know it worked
Vigil proposes the fix with the exact change it will make. Someone on your team approves it and signs in again, the fix runs, and we check the result.
From a signal to a checked fix, on one page
This is how a case reads in Vigilbase OS. Every step is recorded, from the first signal to the check after the fix.
A signal arrives
A detection fires on logs from one of your connected tools.
Vigil investigates
It pulls related sign-ins, changes and events from your other tools.
A verdict with evidence
Benign, keep an eye on it, known exposure, or needs a person. Each one cites what it read.
You approve the fix
See the exact change first. Approving asks you to sign in again.
The result is checked
After the fix runs, we check it worked and keep the record.
HighResolved
Inbox rule forwards mail outside the company
Evidence
- Microsoft Entra IDRisky sign-in from an unfamiliar network
- Microsoft 365New inbox rule: forward all mail to an outside address
- Microsoft 365No earlier forwarding rules on this mailbox
Vigil's verdict
Needs a person
A rule forwarding all mail to an outside address was created on Dana's mailbox shortly after a sign-in from an unfamiliar network.
Vigil needs you to answer
Did Dana set up forwarding to a personal address?
Proposed fix
- Remove the forwarding rule
- Revoke Dana's sessions
Checked after the fix
The rule is gone and Dana's sessions are revoked.
Works with the tools you already pay for
Link each account once, with a sign-in or an API key. OS reads the security logs and settings it needs, and every tool you link counts the same way on your plan.
- Microsoft Entra ID
- Okta
- 1Password
- Google Cloud
- Cloudflare
- Palo Alto Networks
- CrowdStrike Falcon
- Microsoft Defender
- Intune
- NinjaOne
- Mimecast
- GitHub
- Stripe
- HiBob
- Deel
- Splunk
- Qualys
- Google Workspace
- Cisco Duo
- AWS
- Azure
- FortiGate
- UniFi
- SentinelOne
- Sophos Central
- Jamf Pro
- Microsoft 365
- Proofpoint
- Slack
- BambooHR
- Personio
- Microsoft Sentinel
- Tenable
Vigilbase OSMore tools added daily- Microsoft Entra IDSign-ins, MFA and admin changes
- Google WorkspaceSign-ins, MFA and admin changes
- OktaSign-ins, MFA and admin changes
- Cisco DuoSign-ins, MFA and admin changes
- 1PasswordSign-ins, MFA and admin changes
- AWSAudit trails, keys and exposure
- Google CloudAudit trails, keys and exposure
- AzureAudit trails, keys and exposure
- CloudflareBlocked traffic and rule changes
- FortiGateBlocked traffic and rule changes
- Palo Alto NetworksBlocked traffic and rule changes
- UniFiBlocked traffic and rule changes
- CrowdStrike FalconDevice alerts and protection gaps
- SentinelOneDevice alerts and protection gaps
- Microsoft DefenderDevice alerts and protection gaps
And more being added daily. Don't see your tool? Tell us what you use. Talk to us
Detections that know how attacks look in your tools
Detections and hunts run on the logs from every tool you connect, mapped to MITRE ATT&CK. Anything they flag becomes a case for Vigil.
Accounts and sign-ins
- Impossible travel
- Failed sign-ins, then a success
- MFA removed
- Privileged account without MFA
- Leaver access not removed
- Mail forwarded outside the company
- Inbox rule hides or forwards mail
- Mailbox delegate granted
- Suspicious OAuth grant
Cloud and code
- Root account used
- Audit logging turned off
- Storage made public
- Repository made public
- Branch protection weakened
Edge and devices
- Spike in blocked requests
- Abusive IP allowed through
- Endpoint protection gap
- Compromised device
Search a year of security history in one place
Your tools keep their logs in different places, for different lengths of time. OS keeps them together, so an investigation never stops at one tool's edge.
Search every log line
Full logs stay searchable for 30 days on paid plans, with a live tail and saved searches.
Ask Vigil about your data
Ask in plain language from any sign-in, device or event, and Vigil answers with sources.
Dashboards for each tool
Built-in dashboards for every tool you connect, and your own when you need them.
Priced by the tools you connect, not seats
Every plan has unlimited users. Paid plans run approved fixes and keep 13 months of security history.
- OS Free$0per month2 tools5 GB of logs a month
- 10 deep investigations by Vigil a month
- Full logs for 7 days, security history for 90 days
- See the full fix for every issue
- OS 5$500per month5 tools15 GB of logs a month
- 100 deep investigations by Vigil a month
- Full logs for 30 days, security history for 13 months
- Run approved fixes and check they worked
- OS 10Recommended$1,500per month10 tools50 GB of logs a month
- 300 deep investigations by Vigil a month
- Full logs for 30 days, security history for 13 months
- Run approved fixes and check they worked
- OS 25$4,000per month25 tools300 GB of logs a month
- 1,000 deep investigations by Vigil a month
- Full logs for 30 days, security history for 13 months
- Run approved fixes and check they worked
- OS EnterpriseTalk to usMore than 25 toolsScope set by contract
- Vigilbase analysts on request
- 24/7 SLA options: Core, Priority or Critical
- Order Form, invoicing and custom security terms
Annual billing is two months free. Above your plan, each extra GB of log data is $5 and each extra tool is $200 a month.
Your environment, your decisions
Nothing runs without approval
Vigil proposes. A person on your team approves every fix and signs in again before it runs.
Every action on the record
An activity log keeps what Vigil and each user did, and why.
ISO 27001 and SOC 2 Type 2
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant.
Enterprise, partners and managed services
For more than 25 tools, our analysts alongside Vigil, or buying through a partner, we agree the scope with you.
Questions about Vigilbase OS
What does Vigilbase OS replace?
It sits on top of the security tools you already have. You don't need to replace them, and you don't need a SIEM first: OS collects the security logs from each tool you link, runs detections on them and gives every alert to Vigil.
How much does Vigilbase OS cost?
OS Free is $0 a month for 2 tools. OS 5 is $500 a month, OS 10 is $1,500 and OS 25 is $4,000, for 5, 10 and 25 tools. Every plan has unlimited users, annual billing gives you two months free, and OS Enterprise is priced by contract.
Which tools does Vigilbase OS work with?
Identity providers such as Microsoft Entra ID, Google Workspace and Okta; cloud accounts on AWS, Google Cloud and Azure; Cloudflare and firewalls; endpoint tools such as CrowdStrike, SentinelOne and Microsoft Defender; email security; GitHub, Slack and HR systems; and SIEMs such as Splunk and Microsoft Sentinel.
Does Vigil change anything on its own?
No. Vigil investigates and proposes a fix with the exact change it will make. A person on your team approves it and signs in again before it runs. On OS Free you see the full fix and carry it out yourself.
Who responds when Vigil escalates?
Your team. Vigil escalates the alerts that need a person, with the evidence and one clear question to answer. On OS Enterprise our analysts can respond alongside Vigil.
How do we get started?
Create a workspace and link your first tool. Every new workspace gets 14 days of OS 25 with no card, and we measure your usage during the trial so you can see which plan fits.
Is Vigilbase OS ready for production?
Vigilbase OS is in preview. It runs in production today, and we are still adding tools and widening what Vigil can do. Tell us what you need and we'll say what's ready for you.
See your own alerts sorted by Vigil
Start free and link your first tool. Every new workspace gets 14 days of OS 25, no card needed.