Stream.Security

aid: stream-security
name: Stream.Security
description: Stream.Security (formerly Lightlytics) is a cloud detection and response (CDR) and real-time CNAPP vendor that
  builds a live model of a customer's cloud - its "CloudTwin" - by continuously ingesting configuration state and activity
  from AWS, Azure, GCP, Kubernetes, ECS and VMware vSphere, then correlating posture drift against runtime behaviour to expose
  exploitable attack paths, excessive privilege, external exposure and active threats. The platform combines cloud-native
  log ingestion (CloudTrail, VPC Flow Logs, Route53 DNS, ELB/ALB, WAF, Entra ID audit) with eBPF runtime agents on Kubernetes,
  ECS and standalone VMs, adds canary/trap decoy resources and auto-remediation, and exposes it all through a public REST
  API and an MCP server so security teams and agents can query inventory, detections, vulnerabilities, attack paths and posture
  violations programmatically.
url: https://raw.githubusercontent.com/api-evangelist/stream-security/refs/heads/main/apis.yml
image: https://cdn.prod.website-files.com/5f05d585ae7f3b0c47bc77a4/67166fa0d1d0600f5c5d67e8_page-preview.png
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.20'
created: '2026-08-29'
modified: '2026-08-29'
tags:
- Company
- Security
- Cloud Security
- Cloud Detection and Response
- CNAPP
- Threat Detection
- Vulnerability Management
- Kubernetes
- Observability
- DevSecOps
- Artificial Intelligence
x-enrichment:
  date: '2026-08-29'
  status: enriched
  artifacts_added: 21
  pass: local-v1
apis:
- name: Stream Security API
  description: REST API over the Stream Security CloudTwin. 34 operations across twelve resource groups - inventory, attack
    paths, config changes, threat detections, detection rules, posture security rules and violations, vulnerabilities (CVE),
    network and identity logs, Kubernetes/ECS agent integrations, notification rules, canaries and workspaces. Bearer (JWT)
    API token auth, with an optional `workspace` header to target a specific workspace.
  humanURL: https://docs.streamsec.io/reference/getting-started-with-stream-api
  baseURL: https://{app}.streamsec.io/openapi
  tags:
  - Security
  - Cloud Security
  - Threat Detection
  - Vulnerability Management
  - Inventory
  properties:
  - type: OpenAPI
    url: openapi/stream-security-api-openapi.json
  - type: Documentation
    url: https://docs.streamsec.io/
  - type: APIReference
    url: https://docs.streamsec.io/reference
  - type: GettingStarted
    url: https://docs.streamsec.io/reference/getting-started-with-stream-api
  - type: Authentication
    url: authentication/stream-security-authentication.yml
  - type: ErrorCatalog
    url: errors/stream-security-problem-types.yml
  - type: Conventions
    url: conventions/stream-security-conventions.yml
  - type: DataModel
    url: data-model/stream-security-data-model.yml
  - type: Overlay
    url: overlays/stream-security-api-overlay.yaml
  - type: Webhooks
    url: asyncapi/stream-security-notifications-webhooks.yml
  - type: RateLimits
    url: rate-limits/stream-security-rate-limits.yml
- name: Stream Security MCP Server
  description: Hosted remote MCP server that lets an agent query the Stream Security CloudTwin in natural language - resource
    metadata, configuration changes, misconfigurations, external exposures, excessive privileges, and threat-detection triage
    against identity, network and Kubernetes audit logs. Documented as a preview; tool schemas are auth-gated behind a Stream
    Security API token.
  humanURL: https://docs.streamsec.io/docs/stream-security-mcp-server-preview
  baseURL: https://app.streamsec.io/mcp
  tags:
  - MCP
  - Artificial Intelligence
  - Security
  tags_raw:
  - Model Context Protocol
  - Artificial Intelligence
  - Security
  properties:
  - type: MCPServer
    url: mcp/stream-security-mcp.yml
  - type: ToolCrosswalk
    url: mcp/stream-security-tool-crosswalk.yml
  - type: Documentation
    url: https://docs.streamsec.io/docs/stream-security-mcp-server-preview
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: DomainSecurity
  url: security/stream-security-domain-security.yml
- type: Website
  url: https://www.stream.security/
- type: DeveloperPortal
  url: https://docs.streamsec.io/
- type: Documentation
  url: https://docs.streamsec.io/
- type: APIReference
  url: https://docs.streamsec.io/reference
- type: GettingStarted
  url: https://docs.streamsec.io/docs/onboarding
- type: Blog
  url: https://www.stream.security/blog
- type: GitHubOrganization
  url: https://github.com/lightlytics
- type: SignUp
  url: https://app.streamsec.io/
- type: Support
  url: https://www.stream.security/contact-us
- type: TermsOfService
  url: https://www.stream.security/terms
- type: PrivacyPolicy
  url: https://www.stream.security/privacy-policy
- type: LLMsTxt
  url: llms/stream-security-llms.txt
- type: Packages
  url: packages/stream-security-packages.yml
- type: Conformance
  url: conformance/stream-security-conformance.yml
- type: Compliance
  url: conformance/stream-security-conformance.yml
- type: Lifecycle
  url: lifecycle/stream-security-lifecycle.yml
- type: Plans
  url: plans/stream-security-plans-pricing.yml
- type: AgentSkill
  url: skills/_index.yml
- type: Authentication
  url: authentication/stream-security-authentication.yml