# Log Salad

> Customer-controlled SIEM/SOAR; private evaluation, not public SaaS or qualified production deployment.

Contract: console-v1. Source snapshot: 23fdccfaa88f69e858769f1dad70f82739e2740f.

## Start here
- [Docs overview](/docs/): curated customer documentation
- [OpenAPI 3.1](/docs/console-v1/openapi.json): actual bounded public routes
- [Capabilities](/docs/console-v1/capabilities.json): supported candidates, planned limits and authority
- [Start a private evaluation](/docs/console-v1/quickstart.md): A short path from private console access to a reviewable investigation.
- [Authentication & authority](/docs/console-v1/authentication.md): Cookie sessions, same-origin mutations and narrowly scoped source tokens.
- [Onboard sources & ingest](/docs/console-v1/sources.md): Attach existing acquisition safely; distinguish configuration from provider verification.
- [Schemas & evidence](/docs/console-v1/schemas.md): Partial OCSF mapping, native provenance and evidence-backed narratives.
- [Query hot & historical evidence](/docs/console-v1/queries.md): Typed filters now; SQL preview is not unrestricted SQL execution.
- [Detections, signals & cases](/docs/console-v1/detections.md): Strict stateless rules, durable alerts and honest ATT&CK context.
- [Workflows & human approval](/docs/console-v1/workflows.md): Bound exact local case changes to a reviewed digest and revision.
- [Private deployment & retention](/docs/console-v1/deployment.md): BYOS is an ownership boundary, not a compliance badge.
- [Costs & operational status](/docs/console-v1/costs.md): Keep estimates, observations, bills and missing information separate.
- [Troubleshooting & reconciliation](/docs/console-v1/troubleshooting.md): Recover by inspecting persisted state, not by assuming the last request failed.
- [Capabilities & limits](/docs/console-v1/limits.md): A versioned public boundary for implementers, evaluators and agents.
- [API reference](/docs/console-v1/api.md): Actual versioned public operations.

## Authority and truth boundaries
The static documentation origin is not the API origin. Obtain the private console URL from the operator. Cookie mutations need exact Origin, CSRF and JSON; source tokens only permit own-source ingest/status. Never reuse human approval sessions for autonomous action. Poll ingestion until committed before source acknowledgement; 202 is inbox acceptance only. Reconcile persisted state before retrying an unknown side effect. Raw SQL, /signals, /actions/{id} GET, external ticket delivery and cloud containment are not public capabilities. Historical queries use PyIceberg time/source filters, not Presto/Trino. Inference is disabled; System One is planned advisory only with no action authority. Do not interpret synthetic demo evidence as live qualification.