Sign-up to an investigated incident, in about ten minutes.

You need an account and a token. That is the entire prerequisite list, and both take under a minute.

Create your organisation at the registration link — no credit card, and the free tier is real enough to do everything in this guide. An organisation is your isolated tenant: your data, your team, your settings, walled off from everyone else's. The first person in becomes the owner, which is the role that controls billing, team membership, and the most sensitive settings; you can invite teammates and assign lighter roles later.

Then mint a token under Settings → API tokens. Tokens are how anything — an application, a script, an agent, a curl command — authenticates to the platform, and they are scoped, so each one can do only what you grant it. For this quickstart an ingest-capable token is all you need. Get into the habit now of giving every token the narrowest scope that lets it do its job; it is the single most important security habit on the platform and it costs nothing to start right. Copy the token somewhere safe when it is created — you will paste it into the commands below.

With those two things in hand, the rest of this is just pointing telemetry at an endpoint and clicking a few times. Let's go.

Open Explore (or Logs) in the dashboard. Your events should be there; if the view looks empty, widen the time range, because a narrow default window is the most common reason new data appears to be missing. Once you see your events, you have proven the whole ingest path end to end — which is the milestone that matters, because everything else builds on data actually arriving.

Now try a filter. Search uses a readable query language you can pick up by example: filter by a field, match text, narrow by level. Type the service name you sent, or filter to level:error, and watch the results narrow. The important thing to internalise is that this same query language is used everywhere — the filter you just wrote is the same syntax that will back a saved chart, an alert, and a detection rule. Learn it once here, and the skill compounds across the rest of the platform.

If you want to watch events arrive in real time — useful when you are actively shipping a change — switch on live tail, which follows a filtered stream as it happens using the same syntax. Between historical search and live tail you can answer almost any "what is happening / what happened" question, and you now know how to do both. That is Step 2 done.

Here is what makes the platform different from a place that merely stores and alerts. When a monitor fails, a metric breaches, or a detection matches, it opens a first-class incident — and the AI analyst immediately goes to work on it. It gathers the related events, traces what the incident touches, corroborates against threat intelligence where relevant, and attaches a root-cause verdict with the supporting evidence cited. You do not have to start this; it starts itself.

So the first time an incident opens in your new setup, open it and notice what is already there: not a bare alert and a link, but a conclusion you can read and verify. The recommended next action — block a source, roll back a deploy, force a password reset — is proposed for you to approve, never executed automatically, so you stay in control while the laborious gathering is done for you. This is the moment the ten minutes pays off: you went from sign-up to being handed investigated incidents, not raw alerts.

From here, the natural next steps are to invite your team and set up on-call so incidents reach the right person, publish a status page so customers stay informed, and let the context graph build a live map of what depends on what. None of those are required to get value — you already have it — but each one deepens the platform's usefulness, and each is a few clicks away now that the foundation is flowing. When you are ready, the user guide walks through the day-to-day, and the admin guide covers roles, tokens, and governance for a growing team.

What you’ve actually accomplished

It is worth pausing on how much ground those ten minutes covered, because it is more than it feels like in the moment. You stood up an isolated tenant, established authenticated ingest over open standards, proved the pipeline end to end, learned the one query language that runs through the whole platform, put a check on something that matters, turned on real security coverage, wired a notification path, and saw an incident arrive already investigated. In most stacks, each of those is a separate tool, a separate integration, and a separate afternoon. Here they are one short setup, because the platform was built to be adopted in exactly this order.

That ordering is deliberate, and it is the same order we would suggest you keep growing in. Get one slice genuinely trustworthy — the service that matters most, its logs, a monitor, a detection pack or two — before you widen, because a handful of signals you believe is worth more than a hundred you have learned to ignore. Then add the next slice the same way, and let coverage accumulate as your confidence does. The platform does not punish incremental adoption; it rewards it, which is why starting small and widening deliberately beats trying to switch everything on at once.