Terminal + your SIEM

Most teams already have a SIEM or log pipeline. Terminal does not replace it — it fills the gap SIEM often misses: human-readable interactive session context.

• Keep SIEM for fleet-wide detections and correlations
• Use Terminal for privileged interactive session detail
• Document both in your monitoring policy
• Optional: alert on access anomalies in SIEM while investigating in Terminal

How it works

1. 1

   Define sources of truth

   SIEM owns host/auth telemetry at scale. Terminal owns mediated interactive sessions for eng access.

2. 2

   Operational runbooks

   When an alert fires, jump to Terminal session history for the user/host window — not only raw syslog.

3. 3

   Compliance narrative

   Show auditors both continuous monitoring (SIEM) and privileged session review (Terminal).

FAQ

All integrations