> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Create a workspace, add a product family, match your first SBOM and get ready for the 24-hour clock, in about ten minutes.

This guide follows the **Get started** checklist on the Overview page of a new workspace. By the end, Pharus watches your
product, knows where its reports go, and has someone to page when an exploited vulnerability turns up.

<Info>
  Every new workspace starts with a 14-day trial of every software feature, with no card. See
  [plans and features](/plans).
</Info>

<Steps>
  <Step title="Create your account and company">
    Go to [https://app.pharussecurity.com/sign-up](https://app.pharussecurity.com/sign-up?lang=en) and sign up with your work email, or with Microsoft or
    Google. Confirm your email address from the link Pharus sends you. Then set up the company in three short steps:

    * **Company**: the name, the main establishment and how many product families you have.
    * **Routing**: where your CRA reports go under Art. 14(7). Not sure yet? Continue, and set it later.
    * **Pipeline**: where your first SBOM will come from.

    The company becomes your workspace, and you are its owner. Details: [sign up](/workspace/sign-up).
  </Step>

  <Step title="Add a product family">
    A product family is what you sell, such as "Gateway G3". On the Overview page, select **Add a product family**, or go
    to **Settings → Product families** and select **Add product family**. Give it a name and tick the member states
    where the product is made available. On the family's page that opens next, check its reporting route: it inherits
    the company's Art. 14(7) route unless you set its own.

    Details: [product families](/monitoring/product-families) and [routing](/incidents/routing).
  </Step>

  <Step title="Send your first SBOM">
    Open **SBOMs**. Upload a CycloneDX or SPDX SBOM in JSON for the family, or follow **Connect a pipeline** to send one
    from every build in GitHub Actions, Azure DevOps or Dependency-Track. Pharus matches every component within seconds
    and lists the results under **Vulnerabilities**.

    Pipelines authenticate with an API token for the product family, created under **Settings → API tokens** by an owner
    or admin.

    Details: [SBOMs](/monitoring/sboms), [vulnerabilities](/monitoring/vulnerabilities) and the
    [API reference](/api-reference/introduction).
  </Step>

  <Step title="Add the on-call rota">
    The 24-hour clock doesn't stop for weekends. Under **Settings → On-call**, choose who is paged when an exploited
    vulnerability matches, and a backup. Each person verifies their mobile number under **Settings → Your profile**
    before they can be paged.

    Details: [on-call rota](/on-call/rota) and [paging](/on-call/paging). The rota is part of Core and Plus.
  </Step>

  <Step title="Invite a colleague">
    Under **Settings → Members**, invite the people who handle incidents with you. On Core and Plus, a determination
    needs a second person to approve it. Pharus is priced per product family, so there is no cost per seat.

    Details: [members and roles](/workspace/members-and-roles).
  </Step>

  <Step title="Publish security.txt">
    Give researchers a way to report vulnerabilities to you. Under **Settings → Disclosure**, check your contact details
    and policy, then publish the generated security.txt on your own domain. Reports arrive in the **Disclosure inbox**.

    Details: [disclosure page](/disclosure/disclosure-page) and [security.txt](/api-reference/security-txt).
  </Step>
</Steps>

## What happens next

When a component in one of your SBOMs matches a vulnerability that CISA KEV or EUVD lists as exploited, Pharus opens an
incident, starts the 24-hour clock and, on Core and Plus, pages whoever is on call. From there:

1. Check the awareness time on the incident's Overview tab, then record your determination on the **Determination**
   tab: was the vulnerability actively exploited in your product? See [incidents](/incidents/overview) and
   [decision record](/incidents/decision-record).
2. Check the route to your coordinating CSIRT. See [routing](/incidents/routing).
3. Paste the early warning into ENISA's Single Reporting Platform and record the receipt.
   See [SRP paste pack](/incidents/srp-pack).

Every Monday, the [weekly digest](/monitoring/weekly-digest) sums up new matches across your product families.

<Tip>
  Practise before it's real. A [drill](/incidents/drills) runs the whole filing as a tabletop exercise, without
  sending anything.
</Tip>

## Related

<CardGroup cols={2}>
  <Card title="Key concepts" icon="lightbulb" href="/concepts">
    The words Pharus uses and how the pieces fit together.
  </Card>

  <Card title="Incidents" icon="siren" href="/incidents/overview">
    How incidents open, and what to do in the first 24 hours.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.