Getting Started

This page takes you from an empty tenant to a working security queue. The whole flow is: connect a data source, let SubImage sync it into the graph, and start working the Issues it produces.

1. Sign in

Open your SubImage tenant and sign in. If your organization uses single sign-on, use the corporate login; otherwise use the invitation you were emailed. Admins can invite the rest of the team from Team management and wire up single sign-on at any point.

2. Connect your first data source

Everything SubImage knows comes from data sources you connect, called modules. Open Modules, find the source you want (AWS is the usual first one), and click Config to open its setup form.

Each module has its own setup guide with the exact permissions, scopes, and credentials it needs; browse them under Modules in the sidebar. A few things that apply across the board:

• Credentials can go in SubImage's managed vault or stay in your own AWS Secrets Manager and be referenced by ARN. See Secrets.
• Some sources connect over OAuth as an integration you install once (GitHub, Slack, Jira); others use their own credentials (AWS, GCP, Okta).
• To reach a private API (a private EKS cluster, an on-prem Jamf server), deploy a SubImage Outpost first.

3. Let the first sync run

Once a module is configured, SubImage syncs it into the graph. The first sync populates your Inventory and then, downstream, produces vulnerabilities, findings, and attack paths. A first sync can take a while depending on the size of your environment; you can trigger it manually from the module rather than waiting for the schedule.

4. Work your Issues

When the sync finishes, open Issues. This is your queue: SubImage groups the raw signal (vulnerabilities, compliance findings, attack paths) into prioritized issues, each with a plain explanation of why it matters and, where possible, a concrete fix. Work top-down by priority. Issues explains the priority score, the triage vector, and how to assign, snooze, and route.

5. Go deeper

The Issues queue is the front door; each underlying surface has its own view when you want to explore:

• Vulnerabilities: CVEs, vulnerable packages, and fix-first action items.
• Attack Paths: how an attacker could chain resources to reach something critical.
• Rules and Compliance: policy checks and framework scores (CIS AWS, GCP, Azure).
• Inventory: the normalized catalog of every resource, provider by provider.
• Graph: the relationship graph behind the inventory, with an interactive explorer.

6. Route work to your team

Issues are more useful where your team already works. Set up automatic routes to Slack, email, a webhook, or a tracker like Linear or Jira, filtered so each destination gets only what it should. See the routing section of Issues and the Integrations guides.

7. Connect an AI assistant (optional)

SubImage exposes its full API over MCP, so you can point Claude Code, Cursor, or another agent at your security data and ask questions in plain language. See Connect via MCP and the ready-made workflows in Agent Skills.