Server Features — a guided tour
Everything your self-hosted Tripwires deployment can do, shown the way an administrator sees it — no terminal required. Each feature points to exactly where it lives in the admin console, with a short video you can play.
Creating & managing tripwires
Plant decoys (database logins, documents, API keys, cloud credentials and more), then watch the whole estate from one console. Search, filter and drill into any decoy and its detections.
Create a tripwire
Pick a technology — PostgreSQL, a Word document, an AWS key, a kubeconfig — name it, tag it, choose a namespace, and the server mints the decoy and its artifact for you.
Dashboard → New Tripwire
Search, filter & organise
Server-side search, category and status filters, tag filters and pagination keep a large estate manageable.
Dashboard
Tripwire detail & history
Open any decoy to see its configuration, the artifact to plant, and the full timeline of trips against it.
Dashboard → any tripwire
Identity & single sign-on
Let staff sign in with your existing identity provider instead of local passwords. The server is an OIDC client, a SAML 2.0 service provider, and an LDAP/Active Directory client — pick whichever your organisation already runs.
OpenID Connect (OIDC) SSO
Federate with Keycloak, Okta, Entra ID or any OIDC provider. Users click “Continue with SSO” and land in the right role.
Admin → System Setup → Single Sign-On
SAML 2.0 SSO
For IdPs that speak SAML — ADFS, Entra ID, Okta. The server publishes SP metadata, verifies the signed assertion and issues the session.
Admin → System Setup → SAML
Active Directory / LDAP
Bind directly against your directory so existing AD accounts log in with no extra provisioning, with a group mapping to the admin role.
Admin → System Setup → LDAP
Account security
Each user manages their own password and session security from their account screen.
User menu → Account Security
Access control
Decide exactly who can see and change which decoys. Roles set the level of power; Vault-style hierarchical namespaces scope visibility down a tree; scoped API keys give machines least-privilege access; and SCIM keeps it all in sync with your directory.
Roles & organisations (RBAC)
Share an estate as an organisation with owner / admin / member / viewer roles, so people get exactly the power they need — no more.
Admin → Users · org switcher
Hierarchical namespaces
Path-based scoping like Vault: a grant on eu/db sees eu/db and everything beneath it, but never its parent or siblings. Map namespaces to teams, regions or business units.
Create tripwire → Namespace
User management
Create, disable, search and re-role users; see status, subscription and last-login at a glance.
Admin → Users
Scoped API keys
Long-lived keys for CI and automation, restricted to specific actions (e.g. create-only) so a key baked into an image can’t read the dashboard or touch billing.
Settings → API Keys
SCIM 2.0 provisioning
Your identity provider pushes user and group lifecycle automatically — joiners, movers and leavers — and AD groups map straight to Tripwire roles. Protected accounts can’t be locked out.
Configured by your IdP → /scim/v2
Integrations
Every detection can flow straight into the tools your team already watches — your SIEM/SOC pipeline and your chat and email channels.
SIEM / SOC forwarding
Forward every detection to your collector as a generic JSON webhook and/or ArcSight CEF over syslog — Splunk, Sentinel, QRadar, Elastic.
Admin → System Setup (env-configured)
Notifications (Slack & email)
Per-user Slack and email alerts the moment a decoy is touched, so the right people know in seconds.
Settings → Notifications
Operations & monitoring
Everything an operator needs to run the deployment day to day: a live detections feed, a cross-user inventory, a tamper-aware audit trail, system health, offline licensing and built-in support.
Detections feed
Real connections to decoys surface as trips within seconds, with the captured credentials, source and context.
Admin → Detections
System health
A live health view in the console, plus /healthz, /readyz and a Prometheus /metrics endpoint your platform team can scrape directly.
Admin → System Health
Audit log
Every privileged action — including IdP-driven SCIM changes — is recorded with actor, target and time for compliance.
Admin → Audit log
Tripwire inventory
A cross-user inventory of every decoy in the deployment, who owns it and its state.
Admin → Tripwires
Support tickets
An in-product support channel for your users, handled by your admins.
Admin → Support
Security & privacy
The self-hosted build is designed for air-gapped and regulated environments: it never phones home, and it ships the operational hooks your security and platform teams expect.
Zero-egress / air-gapped
The admin UI in the server image makes no third-party requests: analytics, the cookie banner, web fonts, Stripe and the CAPTCHA loader are stripped and assets are vendored locally. Safe behind an air gap.
Built in — no configuration
Health probes & metrics
Native liveness and readiness probes (the readiness check verifies the database) wired as the container HEALTHCHECK, plus a Prometheus exposition with request, detection and notification counters.
GET /healthz · /readyz · /metrics