Thirteen modules, one console
Activate the modules you need, when you need them. No additional server, no new console, no extra password: everything fits into the console you already use. And what each module observes in isolation, the SIEM brings together.
Pick a module
Windows file access auditing: who opened, modified or deleted which document, when, and from which computer. The agent relies on the native Windows audit log, with no driver to install. FirstSI also records who can open what: a folder open to everyone, broken permission inheritance or changed permissions are flagged straight away.
Continuous network flow analysis: exchanges, volumes, protocols and unusual traffic spikes. The explorer shows who communicates with whom, to which country and for which service; a single click on an address brings together everything FirstSI knows about it.
Availability of your services and sites: HTTP, TCP and ping probes, incidents and response times. Maintenance windows prevent unwarranted alerts.
Network infrastructure monitoring: SNMP devices, SD-WAN routers and their tunnels, Internet links, Wi-Fi access points. Devices on a subnet are discovered automatically.
Cross-module event correlation: a file access followed by an unusual outbound flow forms a single incident, with its timeline.
DNS query monitoring and threat detection: malicious domains, tunnelling, exfiltration. Often the first visible sign of a compromise.
Automatic software inventory, with tracking of CVE vulnerabilities and end of support (EOL). You know what is installed, and what is no longer supported. Every machine also receives a security score (antivirus, patches, encryption, firewall) and disk growth is tracked: you know which server will fill up first, and in how many days.
Service mapping: the dependencies between applications and servers, inferred automatically from data already collected. Before you stop a server, you know which services will be affected.
Performance of your SQL Server and MariaDB databases: slow queries, wait statistics, blocking chains and instance health. Background tasks are watched too: failed scheduled jobs, forgotten integrity checks, overdue backups. Silent failures become visible.
Windows authentication tracing: who signs in, on which machine and from which computer, whether successful or not. Logons outside usual hours are flagged automatically. An account's record brings together its lockouts and their real origin (VPN attempts, computer), its addresses, its usual computers and its Microsoft 365 sign-ins; every IP address shows its country, its network operator and whether it belongs to a hosting provider. It also watches over Active Directory (privileged accounts, credential attacks, domain controllers, a posture score) and compares each server with its baseline to catch anything installed behind your back.
Teams calls dropping with no explanation? NetDiag installs on the affected computer, takes a measurement every 15 seconds and identifies the source of the problem: computer, Wi-Fi, VPN, line, DNS or service. Real Teams call quality, the state of the Wi-Fi access point as seen from UniFi, traceroute and packet capture at the time of the incident, and a PDF report ready to share. Once uninstalled, it leaves no trace on the computer.
Your firewalls and gateways join the same console: logs and flows are relayed by the site agent, then matched against the directory and threat lists. VPN login attempts from dozens of addresses, a computer contacting a malicious domain, a tunnel going down: you are notified, with the account and the machine involved. Password-spraying campaigns run from a single address range or hosting provider are grouped into one incident, and every locked-out account opens its own, naming the real origin of the lockout. It also shows what an attacker sees of you from the Internet: exposed services, known vulnerabilities, published names, without a single scan.
Your Hyper-V hosts, failover cluster and Veeam backups join the console, read-only: FirstSI never changes anything on the hypervisors, the cluster or the backups. Checkpoints forgotten for months, swelling differencing disks, broken disk chains, cluster shared volumes filling up, with the date they will be full: everything surfaces before it costs you. You know whether your VMs would restart elsewhere if a node were lost, which ones are not in any backup, and you are alerted the moment someone tampers with the backups, as ransomware does before it encrypts. On the hypervisor, the agent goes unnoticed: a few seconds of collection every quarter of an hour.
Information system security
Directory, servers, shares, computers, databases, hypervisors and their backups, whatever shows from the Internet, Microsoft 365: FirstSI watches the footholds of an attack and the silent failures that come before nasty surprises. Every finding arrives with the machine and the account involved, and both the assistant and ticket pre-diagnostics draw on it to answer.
Request a demoAddition to a privileged group, bulk changes, ticket theft, rogue replication, modified group policy, cleared log: the alert is immediate, and names who did it.
Learn more: Active Directory securityA posture score tracked month after month, domain controllers checked continuously (replication, time, backup, certificates), a periodic review of sensitive groups ready to export, and the accounts of people who have left but are still active.
Learn more: Active Directory securityEach server is compared with its baseline: services, scheduled tasks, local administrators and accounts. Any suspicious addition is flagged; a legitimate change is approved in one click.
Learn more: Server securityWho is allowed to open each folder, and since when. Folders open to everyone, broken inheritance, changed permissions: your shares hold no more surprises.
Learn more: Files and sharesAntivirus and EDR running, signatures up to date, patches, disk encryption, obsolete protocols, firewall: a score for each machine and for the whole estate. Time, DHCP and file-share replication are checked too.
Learn more: Server security“Full in 18 days”: volume and database growth is tracked, so saturation is anticipated instead of endured.
Learn more: Server securityFailed scheduled jobs, forgotten integrity checks, overdue backups: whatever failed quietly overnight is reported first thing in the morning.
Learn more: DatabasesExposed services, known vulnerabilities, published names, accounts named in data leaks: your surface as seen from the Internet, gathered passively, without a single scan.
Learn more: Microsoft 365 and Internet exposureMail forwarded outside, anonymous sharing links, authorised third-party apps: whatever leaves Microsoft 365 without using the front door is spotted.
Learn more: Microsoft 365 and Internet exposureBefore encrypting anything, ransomware goes after the backups. A deleted job, a disabled schedule, a vanished repository, restore points melting away, VMs deleted or shut down en masse: the alert goes out at once, matched against administrator logons on the hosts.
Learn more: Virtualisation and backupsTaken “just before the update”, then forgotten for three months: the disk behind it grows every day and slows the VM down. Old checkpoints, swelling differencing disks, broken disk chains: each one surfaces with its age and size.
Learn more: Virtualisation and backupsYou know in advance whether the remaining hosts would absorb the failure, when each cluster shared volume will be full, and which VMs are in no backup at all or missed the last one.
Learn more: Virtualisation and backupsSolutions
Every IT team comes in through a different door: a directory that keeps you up at night, branches that complain, an audit to prepare for the spring. Pick yours, and the thirteen modules follow.
Thirteen modules, one console, a single agent.
Sensitive groups, posture, forgotten accounts.
Correlated incidents, with their timeline.
SD-WAN, tunnels, Wi-Fi, carrier links.
Wi-Fi, Teams and apps, seen from the computer.
Persistence, security status, capacity.
Who opened what, and who is allowed to.
Performance, background jobs, backups.
Hyper-V, cluster, Veeam, read-only.
Sign-ins, leaks, what an attacker sees.
AI on your premises, tickets already checked.
Small teams, scattered sites, public services.
A head office, dozens of facilities.
Branches, factories, warehouses, one screen.
Continuity, access to records, attacks.
All your clients, one console, isolated spaces.
How it works
A single MSI installer for all modules. The agent runs as a Windows service, is configured and updated remotely, in a single click, using signed and verified updates. On each site, it also acts as a relay for equipment where nothing can be installed (firewalls, gateways, Wi-Fi): their logs and flows pass through it, encrypted, without opening a single port to the outside.
Data is collected locally, with a built-in buffer: if the connection to the server is interrupted, each module keeps up to 256 MB of data locally, enough to ride out ordinary outages without losing anything. Synchronisation resumes automatically as soon as the network is back. Even an isolated network with no Internet access stays covered: its agents go out through a single point, a relay on the site or your corporate proxy, and nothing can be read along the way.
Real-time alerts in the console, by email or by webhook. Thresholds, correlation rules and maintenance windows: you choose what warrants an alert.
AI assistant
Describe the situation as you would to a colleague: “the branch has been slow since this morning”. The assistant queries every module itself (Internet links, network, Wi-Fi, computers, hypervisors, security, tickets), cross-checks the results and identifies the most likely cause, with supporting evidence. The AI model (whichever one you choose) is installed within your own infrastructure: your data never leaves it.
Connectors
Ticketing tool, deployment tool, ERP… Connect your applications to FirstSI: the assistant consults them alongside everything else. You describe the information you need, the AI prepares the query and explains it; you test it, then approve it.
Ticket pre-diagnostics
As soon as a request reaches your service desk, FirstSI carries out the checks a technician would make first: account, computer, VPN, Microsoft 365 sign-ins, printing, network, alerts… The AI summarises the most likely lead and adds an internal note to the ticket, with the appropriate category. The technician starts with the answer.
Microsoft 365
Outlook asking for the password again and again, Teams refusing access, a single sign-on application suddenly out of reach: FirstSI reads the Microsoft 365 sign-in logs and explains the cause in plain English: a recently changed password, a declined multi-factor prompt, an access policy, a non-compliant device.
Tablets and phones
A business app that has fallen behind on two tablets, a device left in a drawer that no longer syncs: FirstSI consults your Google console and immediately identifies the devices lagging behind, with their last sync.
Lines and boxes
“My mobile has no signal”, “the internet crawls across the whole site”: FirstSI queries your carriers' customer areas and tells you right away whether the line is suspended, cancelled or out of allowance, and whether the site box is running on its 4G backup because the fibre is down.
Phone system
“I'm not getting any calls”, “nobody answers at reception”: FirstSI reads your 3CX phone system and shows where calls actually go (to which extension, queue or voicemail), depending on the extension's status and the time of day. Carrier lines, services and the phone system's backup are watched continuously.
Security & compliance
FirstSI processes sensitive data and has been designed accordingly. Every secret is encrypted, every session is short-lived, every action is logged.
Where to start
No sign-up
The platform under real conditions, on a fictional but complete IT estate.
More questions about installation, hosting, GDPR or integrations? All frequently asked questions
Open the live demo: thirteen modules, a full IT estate, nothing to install. Three minutes in the demo tell you more than an hour-long presentation.
See the demo