# Substation Documentation

> Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.

## Guides
- [What is Substation?](https://substation.readme.io/docs/overview.md): Substation is a **toolkit for routing, normalizing, and enriching security event and audit logs.**
- [Use Cases](https://substation.readme.io/docs/use-cases.md): Substation supports 100s of use cases, but these are the most common.
- [Architecture & Design](https://substation.readme.io/docs/architecture-design.md)
- [Try Substation on Docker](https://substation.readme.io/docs/try-substation-on-docker.md)
- [Try Substation on macOS / Linux](https://substation.readme.io/docs/try-substation-on-macos-linux.md)
- [Try Substation on AWS](https://substation.readme.io/docs/try-substation-on-aws.md)
- [Evaluating & Transforming Data](https://substation.readme.io/docs/customizing-transforms.md)
- [Messages](https://substation.readme.io/docs/messages.md): Messages are an abstracted data type that store data as it moves through Substation.
- [JSON Parsing](https://substation.readme.io/docs/object-modification.md)
- [Nodes](https://substation.readme.io/docs/nodes.md): Substation deployments are composed of nodes that provide data transformation capabilities.
- [Concurrency](https://substation.readme.io/docs/concurrency.md): Concurrency determines the number of data transformation threads used by a <<glossary:node>>.
- [Batching](https://substation.readme.io/docs/batching-data.md): Transforms can support batching data for efficiency and organization.
- [Conditions](https://substation.readme.io/docs/conditions.md): Conditions are functions that evaluate a <<glossary:message>>.
- [Format](https://substation.readme.io/docs/cnd-format.md): Format conditions evaluate the format, structure, or shape of data.
- [Meta](https://substation.readme.io/docs/cnd-meta.md): Meta conditions apply other condition functions.
- [Network](https://substation.readme.io/docs/cnd-network.md): Network conditions evaluate network data.
- [Number](https://substation.readme.io/docs/cnd-number.md): Number inspectors evaluate number data.
- [String](https://substation.readme.io/docs/cnd-string.md): String inspectors evaluate string data.
- [Utility](https://substation.readme.io/docs/cnd-utility.md): Utility inspectors provide inspection functions that may be useful for testing or debugging.
- [Transforms](https://substation.readme.io/docs/transforms.md): Transforms are functions that transform a <<glossary:message>>. Transformation includes data modification, data enrichment, and data forwarding.
- [Aggregate](https://substation.readme.io/docs/tf-aggregate.md): Aggregate transforms aggregate or disaggregate data.
- [Array](https://substation.readme.io/docs/tf-array.md): Array transforms operate on JSON arrays.
- [Enrich](https://substation.readme.io/docs/tf-enrich.md): Enrich transforms enrich data using an external system or process.
- [Format](https://substation.readme.io/docs/tf-format.md): Format transforms change the format, structure, or shape of data.
- [Hash](https://substation.readme.io/docs/tf-hash.md): Hash transforms apply a cryptographic hash or checksum to data.
- [Meta](https://substation.readme.io/docs/tf-meta.md): Meta transforms apply other transforms.
- [Network](https://substation.readme.io/docs/tf-network.md): Network transforms operate on network data.
- [Number](https://substation.readme.io/docs/tf-number.md): Number transforms operate on number data.
- [Object](https://substation.readme.io/docs/tf-object.md): Object transforms operate on JSON objects.
- [Send](https://substation.readme.io/docs/tf-send.md): Send transforms send data to an external system.
- [String](https://substation.readme.io/docs/tf-string.md): String transforms operate on string data.
- [Test](https://substation.readme.io/docs/test.md): Test transforms are used for testing the system.
- [Time](https://substation.readme.io/docs/tf-time.md): Time transforms operate on time data. Substation uses nanosecond precision.
- [Utility](https://substation.readme.io/docs/tf-utility.md): Utility transforms provide testing or debugging functions.
- [Key-Value Stores](https://substation.readme.io/docs/key-value-stores.md): Key-Value Stores provide functions that retrieve and store data within and outside of Substation.
- [Secrets Store](https://substation.readme.io/docs/secrets-store.md): Secrets Store provides functions that retrieve and manage external secrets inside of Substation.
- [Metrics Destinations](https://substation.readme.io/docs/metrics-destinations.md): Metrics Destinations provide functions for reporting metrics from Substation to external systems.
- [Unit Testing](https://substation.readme.io/docs/unit-testing.md): Transforms can be unit tested using the Substation CLI tool.
- [Substation](https://substation.readme.io/docs/app-substation.md): CLI tool for managing configurations and supporting local development.
- [Substation](https://substation.readme.io/docs/app-aws-substation.md): Substation applications designed to run in AWS.
- [Autoscale](https://substation.readme.io/docs/app-aws-autoscale.md): Autoscale AWS services using SNS and CloudWatch Alarms.
- [Validate](https://substation.readme.io/docs/app-aws-validate.md): Validate Substation configurations.
- [Configurations as Code](https://substation.readme.io/docs/configurations-as-code.md)
- [Example Configurations](https://substation.readme.io/docs/example-configurations.md): Common configuration patterns for Substation conditions and transforms.
- [Style Guide](https://substation.readme.io/docs/style-guide.md): Style guide for configurations and configuration management.
- [Infrastructure as Code](https://substation.readme.io/docs/infrastructure-as-code.md)