Pipe Lockdown blocks into the SIEM you already run

Mon, 01 Jan 0001 00:00:00 +0000

Overview: Root Lock by HeartSuite integrates with your existing SIEM, EDR, and observability stack via syslog (journald/rsyslog) and webhook. Configure once in Alert Settings → Fleet, and let your central tooling handle monitoring, correlation, and alerting. There is no requirement to run the Dashboard on every host for day-to-day fleet visibility.

Raw denial decisions and higher-level alerts are emitted in real time. Successful allowlisted work is not streamed. Incident tools receive the events you configure them to receive.

Drive the allowlist from your own tooling

Mon, 01 Jan 0001 00:00:00 +0000

Overview: Root Lock by HeartSuite is designed to be driven by your existing central tooling. The Dashboard is the surface for a single host. Enterprises use their control planes to manage policy and observe at scale.

Cloud Path and Local Path remain how each host is installed. This page is not a different install. It is how you harvest a baseline, install that package on many hosts, and apply extras without a Dashboard session on every machine.

Alerts when Lockdown blocks something on Root Lock by HeartSuite

Pipe Lockdown blocks into the SIEM you already run

Drive the allowlist from your own tooling