# Operate

> DFE is deployed. Now it needs people, data, and a way to tell it's healthy.

## The first week

In this order:

1. Sign in as `admin` and change the password. Where the logins are: [Users and OIDC](/v/2.2.2/operate/users-and-oidc.md).
2. Connect your identity provider, so your people sign in as themselves. Same page.
3. Add a source. Events land in `main` until you do. [A source](/v/2.2.2/dfe-engine/data-plane/source.md) is one stream of events, with its routing, its table and its detections in one definition.
4. Reshape the stream if the record as it lands isn't enough: [Transforms](/v/2.2.2/operate/transforms.md).
5. If you want scheduled rules and alerts: [Detections and hunts](/v/2.2.2/operate/detections-and-hunts.md).
6. Find out how you'll know when something breaks: [Monitoring](/v/2.2.2/operate/monitoring.md).

## Sources

A source has one origin. Either the receiver matches pushed events to it, or a fetcher pulls them.

| Origin | How events arrive | Start at |
|---|---|---|
| Pushed | Your agents and devices send to dfe-receiver, which terminates their protocols at the edge | [The source definition](/v/2.2.2/dfe-engine/data-plane/source-definition.md), then [webhook callers](/v/2.2.2/dfe-receiver/webhook-setup.md) for products that push alerts |
| Fetched | dfe-fetcher dials out to a SaaS or cloud API on an interval | [Cloud and SaaS setup guides](/v/2.2.2/dfe-fetcher/cloud-setup.md) |

[Sources](/v/2.2.2/operate/sources.md) is how you browse the catalogue of ready-made ones and create them in one call.

A source is active, dormant or disabled. [Storing and operating a source](/v/2.2.2/dfe-engine/data-plane/source-registry.md) says what each state does to its table. [Data evolution](/v/2.2.2/dfe-engine/data-evolution.md) is how a stream goes from landing raw to having its own columns, one field at a time.

> **Coming from Splunk or Elastic?** You don't define a schema before data flows. Every field from a new source works from the first event. Then you put schema effort only into the fields that pay you back: promote them in the meta schema, tighten their definitions, and name the searches you need so DFE picks the right indexes. Promotion doesn't backfill: new records land in the column, older ones stay readable where they were. Nothing that already works breaks along the way. More in [what's different](/v/2.2.2/coming-from.md#nothing-breaks-when-a-source-changes).

## Everything else

| You want to | Go to |
|---|---|
| Reshape events on the way in | [Transforms](/v/2.2.2/operate/transforms.md) |
| Let people in, and decide what they can do | [Users and OIDC](/v/2.2.2/operate/users-and-oidc.md) |
| Search, build dashboards, define rules and hunts | [The console](/v/2.2.2/dfe-ui/console-and-the-flow.md). Its menu runs in the order the data moves: Observe, Data flow, Detect, Stack, Access |
| Run rules on a schedule | [Detections and hunts](/v/2.2.2/operate/detections-and-hunts.md) |
| Watch the stack's own health | [Monitoring](/v/2.2.2/operate/monitoring.md) |
| Grow it | [Autoscaling](/v/2.2.2/dfe-infra/autoscaling.md). Pods scale on KEDA on every target, and node scaling differs per target |
| Keep it running, and fix it when it isn't | [Day to day and troubleshooting](/v/2.2.2/operate/day-to-day.md) |
| Move to a newer release | [Upgrades](/v/2.2.2/dfe-infra/deployment/upgrades.md), and the [rollback runbook](/v/2.2.2/dfe-infra/deployment/upgrade-rollback.md) |
| Keep the raw copy of every record | Set `archive: true` in a source's flow. [The source flow](/v/2.2.2/dfe-engine/data-plane/source-flow.md) says what that needs |