Server Features — a guided tour

Everything your self-hosted Tripwires deployment can do, shown the way an administrator sees it — no terminal required. Each feature points to exactly where it lives in the admin console, with a short video you can play.

Day one

Creating & managing tripwires

Plant decoys (database logins, documents, API keys, cloud credentials and more), then watch the whole estate from one console. Search, filter and drill into any decoy and its detections.

Create a tripwire

Pick a technology — PostgreSQL, a Word document, an AWS key, a kubeconfig — name it, tag it, choose a namespace, and the server mints the decoy and its artifact for you.

Dashboard → New Tripwire

▶ Creating a decoy end to end, from technology to ready-to-plant artifact.

Search, filter & organise

Server-side search, category and status filters, tag filters and pagination keep a large estate manageable.

Dashboard

▶ Search, category/status filters, tag filter and pagination across the estate.

Tripwire detail & history

Open any decoy to see its configuration, the artifact to plant, and the full timeline of trips against it.

Dashboard → any tripwire

▶ A single tripwire’s configuration, artifact and detection history.
Who gets in

Identity & single sign-on

Let staff sign in with your existing identity provider instead of local passwords. The server is an OIDC client, a SAML 2.0 service provider, and an LDAP/Active Directory client — pick whichever your organisation already runs.

OpenID Connect (OIDC) SSO

Federate with Keycloak, Okta, Entra ID or any OIDC provider. Users click “Continue with SSO” and land in the right role.

Admin → System Setup → Single Sign-On

▶ Configuring OIDC and signing in through the identity provider.

SAML 2.0 SSO

For IdPs that speak SAML — ADFS, Entra ID, Okta. The server publishes SP metadata, verifies the signed assertion and issues the session.

Admin → System Setup → SAML

▶ SAML service-provider setup and an end-to-end signed-assertion login.

Active Directory / LDAP

Bind directly against your directory so existing AD accounts log in with no extra provisioning, with a group mapping to the admin role.

Admin → System Setup → LDAP

Read the Active Directory / LDAP guide

Account security

Each user manages their own password and session security from their account screen.

User menu → Account Security

▶ Per-user password and account-security controls.
Who can do what

Access control

Decide exactly who can see and change which decoys. Roles set the level of power; Vault-style hierarchical namespaces scope visibility down a tree; scoped API keys give machines least-privilege access; and SCIM keeps it all in sync with your directory.

Roles & organisations (RBAC)

Share an estate as an organisation with owner / admin / member / viewer roles, so people get exactly the power they need — no more.

Admin → Users · org switcher

▶ Organisations, the owner/admin/member/viewer roles, and member management.

Hierarchical namespaces

Path-based scoping like Vault: a grant on eu/db sees eu/db and everything beneath it, but never its parent or siblings. Map namespaces to teams, regions or business units.

Create tripwire → Namespace

▶ Path-based namespaces controlling who sees which slice of the estate.

User management

Create, disable, search and re-role users; see status, subscription and last-login at a glance.

Admin → Users

▶ The admin user-management screen across all accounts.

Scoped API keys

Long-lived keys for CI and automation, restricted to specific actions (e.g. create-only) so a key baked into an image can’t read the dashboard or touch billing.

Settings → API Keys

▶ Minting a scoped API key and using it from the CLI.

SCIM 2.0 provisioning

Your identity provider pushes user and group lifecycle automatically — joiners, movers and leavers — and AD groups map straight to Tripwire roles. Protected accounts can’t be locked out.

Configured by your IdP → /scim/v2

SCIM setup in the configuration guide

Plug into your stack

Integrations

Every detection can flow straight into the tools your team already watches — your SIEM/SOC pipeline and your chat and email channels.

SIEM / SOC forwarding

Forward every detection to your collector as a generic JSON webhook and/or ArcSight CEF over syslog — Splunk, Sentinel, QRadar, Elastic.

Admin → System Setup (env-configured)

▶ A detection forwarded to a SIEM as JSON webhook and CEF syslog.

Notifications (Slack & email)

Per-user Slack and email alerts the moment a decoy is touched, so the right people know in seconds.

Settings → Notifications

▶ Configuring Slack and email alerts for trips.
Run & monitor

Operations & monitoring

Everything an operator needs to run the deployment day to day: a live detections feed, a cross-user inventory, a tamper-aware audit trail, system health, offline licensing and built-in support.

Detections feed

Real connections to decoys surface as trips within seconds, with the captured credentials, source and context.

Admin → Detections

▶ A real connection to a decoy surfaces as a trip within seconds.

System health

A live health view in the console, plus /healthz, /readyz and a Prometheus /metrics endpoint your platform team can scrape directly.

Admin → System Health

▶ The System Health screen for the whole deployment.

Audit log

Every privileged action — including IdP-driven SCIM changes — is recorded with actor, target and time for compliance.

Admin → Audit log

▶ The audit trail of privileged actions across the deployment.

Tripwire inventory

A cross-user inventory of every decoy in the deployment, who owns it and its state.

Admin → Tripwires

▶ The deployment-wide tripwire inventory.

Support tickets

An in-product support channel for your users, handled by your admins.

Admin → Support

▶ The built-in support-ticket workflow.
Built for sensitive estates

Security & privacy

The self-hosted build is designed for air-gapped and regulated environments: it never phones home, and it ships the operational hooks your security and platform teams expect.

Zero-egress / air-gapped

The admin UI in the server image makes no third-party requests: analytics, the cookie banner, web fonts, Stripe and the CAPTCHA loader are stripped and assets are vendored locally. Safe behind an air gap.

Built in — no configuration

How the zero-egress build works

Health probes & metrics

Native liveness and readiness probes (the readiness check verifies the database) wired as the container HEALTHCHECK, plus a Prometheus exposition with request, detection and notification counters.

GET /healthz · /readyz · /metrics

Observability & metrics reference