Backed by mandō

Identity resolution
at the process level.

Signum maps every UID, GID, group, and security context across your fleet in real time. Zero-trust identity infrastructure — from kernel to dashboard.

Request Enterprise Demo Try the CLI →

4.2M Identities Resolved / Day

0.3ms Mean Lookup Latency

99.999% Uptime SLA

signum — identity graph

$ signum --resolve

uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo),44(video),100(users)

$ signum --user --name

alice

$ signum --groups --name

alice sudo video users

$ signum --context

unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

$ _

Capabilities

Seven identity primitives.
One unified graph.

Every flag from the original spec — hardened, distributed, and observable.

uid

Effective User ID

The -u primitive. Resolves the effective UID of the current process. Handles setuid binaries, privilege escalation contexts, and sudo transitions with zero ambiguity.

gid

Effective Group ID

The -g primitive. Returns the effective group ID for the running process. Critical for file permission resolution, shared resource access, and RBAC enforcement.

grp

Full Group Enumeration

The -G primitive. Enumerates all group IDs associated with the identity — primary, supplementary, and inherited. Complete membership graph in a single call.

→nm

Name Resolution Layer

The -n modifier. Translates numeric IDs into human-readable names. Pairs with -u, -g, and -G for audit-ready identity output across every context.

real

Real ID Introspection

The -r modifier. Returns the real ID instead of the effective ID. Essential for forensic analysis, privilege boundary detection, and identity drift auditing.

ctx

SELinux Security Context

The -Z primitive. Surfaces the SELinux security context of the current process. Mandatory access control visibility — user, role, type, and sensitivity level in one payload.

nul

Null-Delimited Output

The -z primitive. Delimits entries with NUL characters instead of whitespace. Built for pipeline-safe, machine-parseable identity streams at any scale.

Process

From kernel to dashboard
in four steps

Deploy enterprise-grade identity resolution without touching your auth stack.

Deploy Agent

Install the Signum agent on every node in your fleet. One binary, zero config. Auto-discovers user databases, NSS modules, and LDAP backends.

Map Identity Graph

Signum builds a real-time directed graph of every UID → GID → group membership relationship. Effective and real IDs tracked simultaneously.

Resolve on Demand

Query any identity primitive — user, group, all groups, names, real vs. effective, security context — via CLI, API, or SDK. Sub-millisecond response.

Audit & Enforce

Continuous identity posture monitoring. Detect privilege escalation, group drift, and context violations. Export to your SIEM. Enforce policies in real time.

Capability	Signum	Manual id(1)	DIY Scripts	Legacy IAM
Real-time UID/GID resolution	✓	✓	~	✗
Full group enumeration	✓	✓	~	✗
SELinux context awareness	✓	✓	✗	✗
Distributed fleet coverage	✓	✗	~	~
Identity drift detection	✓	✗	✗	~
Audit-ready name resolution	✓	~	✗	✓
Pipeline-safe NUL output	✓	✓	✗	✗
Real vs. effective ID tracking	✓	✓	✗	✗

Plans

Transparent pricing.
No identity tax.

Start free. Scale with your fleet.

Community

$0/mo

Up to 50 nodes
UID / GID resolution
CLI access
Community support

Get Started

Trusted by identity-obsessed teams

"We replaced 14 custom scripts and two internal tools with Signum. One binary, one query, one source of truth for every UID across 3,000 nodes."

Lucia Romero VP of Platform Engineering, Stratos

"The SELinux context flag alone saved our compliance team 200 hours per audit cycle. Signum makes mandatory access control actually observable."

Ayesha Nazari CISO, Meridian Defense Systems

"The real vs. effective ID tracking caught a privilege escalation path we'd missed for two years. Signum is now a mandatory deployment across every environment."

Celeste Torres Director of Security, Helios Cloud

"We pipe Signum's null-delimited output directly into our SIEM. Machine-parseable identity streams at 4M+ events per day, zero parsing errors."

Victor Park Staff SRE, Lattice Infrastructure

Interactive

Try Signum

Explore the identity graph. Toggle flags to see real signum output.

signum — interactive

-u user -g group -G groups -n name -r real -Z context -z null-delim

User:

$ signum

uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo),44(video),100(users)

FAQ

Frequently asked questions

What's the difference between effective and real IDs?

The real ID is the identity of the user who started the process. The effective ID is the identity the process is currently running as — which may differ due to setuid binaries or privilege escalation via sudo. Signum's -r flag lets you introspect the real ID at any time, while the default returns the effective ID. Understanding this distinction is critical for security auditing.

Does Signum replace my existing IAM solution?

No. Signum operates at the process level — it resolves the identity of the running process, not the user's organizational role. Think of it as the identity primitive that sits beneath your IAM stack. It integrates with LDAP, Active Directory, Okta, and PAM to provide ground-truth identity data to your existing toolchain.

How does the SELinux security context flag work?

The -Z flag surfaces the SELinux security context of the current process, formatted as user:role:type:sensitivity. This is mandatory access control metadata that exists independently of the standard Unix permission model. Signum makes it queryable via the same API as every other identity primitive.

What does null-delimited output mean?

The -z flag replaces whitespace delimiters with NUL characters (ASCII 0x00). This produces machine-parseable output that's safe for pipelines processing entries with spaces, special characters, or multi-byte encodings. Critical for high-throughput event streams and SIEM ingestion.

Can I resolve identity for a different user?

Yes. Signum accepts one or more usernames as arguments. Without arguments, it resolves the identity of the current process. With arguments, it resolves identity for each specified user — including their UID, GID, all groups, and optional security context.

Identity resolution
at the process level.