Read in order for a complete onboarding path, or jump to any chapter. Each chapter opens the full article with steps and tables.
Chapter 1 · Getting Started
Understand the Trustity platform, its management and enforcement components, and the recommended path to a verified first deployment.
Open chapter →Chapter 2 · Getting Started
Which Trustity website to use, where to sign in, and how the public marketing site, Cloud Portal, MSSP portal, Dev, and Labs fit together.
Open chapter →Chapter 3 · Getting Started
Prepare administrators, entitlements, policies, deployment controls, and acceptance criteria for a new Trustity organization.
Open chapter →Chapter 4 · Getting Started
Map Trustity entitlements to portal areas, endpoint components, supported platforms, policies, and deployment checks.
Open chapter →Chapter 5 · Getting Started
Prepare DNS, HTTPS egress, proxy, TLS inspection, browser services, and validation for Trustity endpoints and administrators.
Open chapter →Chapter 6 · Getting Started
Navigate the Trustity Cloud Portal and use its deployment, policy, device, event, user, and audit areas safely.
Open chapter →Chapter 7 · Cloud Portal
Download entitled endpoint installers, enroll devices with your organization license key, and validate successful deployment.
Open chapter →Chapter 8 · Cloud Portal
Prod and eval branches, Latest/Previous targeting, and quiet auto-update for Windows and Linux TAO agents.
Open chapter →Chapter 9 · Getting Started
Deploy and enroll the Trustity Agent on Windows interactively or silently, then verify service, portal, and module health.
Open chapter →Chapter 10 · Getting Started
Download TAO from the Cloud Portal, install and enroll it on supported Linux systems, and verify systemd and portal health.
Open chapter →Chapter 11 · Getting Started
Recommended folder, process, and service exclusions so third-party AV/EDR agents do not quarantine or block Trustity TAO.
Open chapter →Chapter 12 · Getting Started
Add Microsoft Defender Antivirus path and process exclusions so TAO installs, heartbeats, and VisionX stay healthy.
Open chapter →Chapter 13 · Getting Started
Coordinate CrowdStrike Falcon IOA / ML exclusions for Trustity TAO paths and processes during install and steady-state.
Open chapter →Chapter 14 · Getting Started
Add SentinelOne path and process exclusions (or exclusions policy) so TAO is not blocked or rolled back on Windows endpoints.
Open chapter →Chapter 15 · Getting Started
Generic exclusion checklist for Carbon Black, Sophos, Symantec, Trend Micro, and other AV/EDR products coexisting with Trustity TAO.
Open chapter →Chapter 16 · Getting Started
Prove that the first TAO endpoint is installed, enrolled, online, current, receiving policy, and ready for a controlled module test.
Open chapter →Chapter 17 · Getting Started
Expand Trustity from a verified pilot into production with staged rings, change control, and measurable exit criteria.
Open chapter →Chapter 18 · Getting Started
Where TAO writes logs on Windows and Linux, how to read them, and how to create a redacted support bundle for analysis.
Open chapter →Chapter 19 · Cloud Portal
Navigate entitled policy areas, apply organization or group scope, and choose manual groups or Active Directory.
Open chapter →Chapter 20 · Cloud Portal
Configure Windows agent uninstall, service-stop, UI protections, and portal check-in interval.
Open chapter →Chapter 21 · Cloud Portal
Organize the fleet with device groups or an Active Directory tree, monitor enrolled endpoints, request inventory scans, and manage baselines.
Open chapter →Chapter 22 · Cloud Portal
Read the domain the organization already has. Show the computer tree, see which stations have TAO, and optionally apply policy by Active Directory computer group.
Open chapter →Chapter 23 · VisionX Visual DLP
Plan, configure, validate, and operate VisionX visual-channel protection on managed Windows endpoints.
Open chapter →Chapter 24 · VisionX Visual DLP
Choose and validate Always on, Standby, or On-demand VisionX activation.
Open chapter →Chapter 25 · VisionX Visual DLP
Triage VisionX events (including strict no-camera locks), handle evidence responsibly, and support a locked user.
Open chapter →Chapter 26 · VisionX Visual DLP
Tune lock response, confidence, persistence, cooldown, evidence, and locking through a controlled pilot. Includes how endpoint CPU affects lock speed.
Open chapter →Chapter 27 · GenGuard
Plan, pilot, deploy, and validate the managed GenGuard browser extension - with or without TAO.
Open chapter →Chapter 28 · GenGuard
Practical GPO/Intune checklist to force-install GenGuard and push tenant configuration.
Open chapter →Chapter 29 · GenGuard
Build and validate GenGuard policy with templates, DLP keywords, domain rules, and web categories.
Open chapter →Chapter 30 · GenGuard
Monitor browser-extension health, triage DLP events, and investigate reporting gaps - including TAO-bridged and endpoint GenGuard.
Open chapter →Chapter 31 · GenGuard
How GenGuard inside TAO protects the workstation - text, files, and contexts - alongside the browser extension.
Open chapter →Chapter 32 · FileGuard
Why FileGuard labels a file on the station, and how that label works with GenGuard, VisionX, Vault, and HostGuard.
Open chapter →Chapter 33 · FileGuard
Review what a station found in documents, and on Windows in pictures and scans. The file stays on the station.
Open chapter →Chapter 34 · FileGuard
Set a label, choose an audience, update it later, and ask the station for a masked excerpt. The file stays on the station.
Open chapter →Chapter 35 · FileGuard
GenGuard asks TAO before a paste, drop, or file picker hands a labeled file to the page, including images and PDFs.
Open chapter →Chapter 36 · FileGuard
How a FileGuard label sits with VisionX, GenGuard, Vault, and HostGuard on the same TAO agent.
Open chapter →Chapter 37 · Vault & PAM
Configure, validate, and operate password rotation for managed local accounts on Windows, and on Linux with the differences noted below.
Open chapter →Chapter 38 · Vault & PAM
Safely force-rotate a local account and manage the Windows built-in administrator identity.
Open chapter →Chapter 39 · Vault & PAM
Reveal local-account credentials safely and maintain least-privilege Vault roles.
Open chapter →Chapter 40 · Vault & PAM
Configure Personal Vault restrictions, manage PIN-protected encrypted files, and create password-protected sharing links.
Open chapter →Chapter 41 · Vault & PAM
Publish an employee File Vault separate from the Cloud Portal, with per-person PIN-protected encryption, recovery keys, and password-protected share links.
Open chapter →Chapter 42 · HostGuard IPS
Deploy and operate endpoint failed-logon detection with report-only and blocking modes.
Open chapter →Chapter 43 · HostGuard IPS
Tune failed-logon thresholds and move safely from report-only observation to firewall blocking.
Open chapter →Chapter 44 · Axiom
Axiom is an on-premises security platform for organizations that want enforcement and operational evidence in the SMB and DNS paths without installing an agent
Open chapter →Chapter 45 · Axiom
A production Axiom deployment uses three separate Ubuntu or Debian servers: 1. **Management Server** - Web UI, node registry, policy control plane, reputation d
Open chapter →Chapter 46 · Axiom
The Management Server is the only role administrators need to browse directly. It stores policy and reputation data, registers data-plane nodes, receives teleme
Open chapter →Chapter 47 · Axiom
The SMB node needs a stable client-facing IP and reachability to the real file server. Clients will connect to the Axiom IP, not the file-server IP. Plan firewa
Open chapter →Chapter 48 · Axiom
Axiom can sit between endpoints and upstream resolvers, or between an internal DNS/DC server and its upstream resolvers. In an Active Directory environment, end
Open chapter →Chapter 49 · Axiom
An Axiom cluster is a Management-controlled group of nodes with the same data-plane role. An SMB cluster contains one source SMB node and one or more SMB replic
Open chapter →Chapter 50 · Axiom
Axiom license activation is designed for restricted networks. The Management Server creates a machine-bound activation request and verifies the signed response
Open chapter →Chapter 51 · Cloud Portal
Invite local portal users, assign Owner/Admin/Analyst/Viewer roles, complete set-password, validate access, and remove access safely.
Open chapter →Chapter 52 · Cloud Portal
Understand SSO authentication and SCIM lifecycle provisioning, configure the current preview safely, and explain the customer value.
Open chapter →Chapter 53 · Cloud Portal
Issue scoped Cloud Portal API keys for automations without using the organization license key.
Open chapter →Chapter 54 · Cloud Portal
Configure idle session guidance and revoke portal sessions for privileged operators.
Open chapter →Chapter 55 · Cloud Portal
Configure email and webhook routing for critical portal alerts without treating retries as guaranteed delivery.
Open chapter →Chapter 56 · Cloud Portal
Review policy history snapshots and roll back entitled module policies when a change needs to be reversed.
Open chapter →Chapter 57 · Cloud Portal
Set evidence and audit retention preferences, preview purge impact, and export audit JSONL with SHA-256 integrity headers.
Open chapter →Chapter 58 · Cloud Portal
Use Security Assurance to track MFA, SSO staging, alerts, and audit export readiness - not SOC 2 certification.
Open chapter →Chapter 59 · Cloud Portal
Search, validate, export, and retain organization-scoped administrative audit history.
Open chapter →Chapter 60 · Cloud Portal
Search and export cross-module operational activity for investigations and review.
Open chapter →Chapter 61 · Cloud Portal
Forward selected portal audit events to syslog or an HTTPS webhook and validate delivery.
Open chapter →Chapter 62 · Cloud Portal
Review portal identity details, enroll MFA, manage factors, and sign out securely.
Open chapter →Chapter 63 · Cloud Portal
Open, track, and securely communicate through Cloud Portal support tickets.
Open chapter →Chapter 64 · Getting Started
Diagnose enrollment, service, network, heartbeat, policy, and session issues without exposing credentials or destroying agent state.
Open chapter →