> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blocklight.co/llms.txt
> Use this file to discover all available pages before exploring further.

# What is Blocklight

> Blockchain runtime security with a rich, declarative detection language

## Overview

Blocklight is an open-source Runtime Security Engine for the EVM. It allows security engineers to define threat patterns using declarative YAML rules, ingest real-time blockchain data, and trigger automated alerts. Built for high-performance monitoring of DeFi protocols and on-chain infrastructure.

## Our Approach

Blocklight is built on the **Detection-as-Code** philosophy: security rules as version-controlled, testable, and maintainable code. Write detection logic in declarative YAML—no programming required.

**Core Principles:**

* **Detection-as-Code** - Version control your security rules, test them, and deploy with confidence
* **YAML-Based Rules** - Declarative syntax that's easy to read, write, and maintain
* **Real-Time Observability** - Monitor EVM chains in real-time with structured alerts
* **Production-Ready** - Built for high-throughput monitoring with intelligent caching and concurrent processing

## Use Cases

<CardGroup cols={2}>
  <Card title="Security Monitoring" icon="shield">
    Detect threats in real-time: suspicious transfers, approval phishing, token burns, and high-risk transaction patterns.
  </Card>

  <Card title="Observability" icon="chart-line">
    Monitor on-chain activity, track protocol interactions, and gain visibility into your DeFi infrastructure.
  </Card>

  <Card title="Threat Detection" icon="bug">
    Identify malicious patterns, track known attacker addresses, and alert on high-risk transactions.
  </Card>

  <Card title="Compliance & Auditing" icon="magnifying-glass">
    Track high-value movements, monitor sanctioned addresses, and generate audit trails for compliance.
  </Card>
</CardGroup>

## How It Works

Blocklight connects to blockchain nodes via RPC/WebSocket, analyzes transactions in real-time, evaluates your detection rules, and sends alerts when threats are detected. Everything is configured in YAML—no coding required.

For a detailed look at Blocklight's architecture, see the [Architecture](/architecture) page.

<CardGroup cols={2}>
  <Card title="Getting Started" icon="rocket" href="/getting-started">
    Install Blocklight and create your first detection rule in minutes.
  </Card>

  <Card title="Writing Rules" icon="pen-to-square" href="/rules/structure">
    Learn how to write powerful detection rules in YAML.
  </Card>

  <Card title="Deployment" icon="server" href="/deployment/docker">
    Deploy Blocklight in production with Docker.
  </Card>

  <Card title="API Reference" icon="code" href="/api/overview">
    Integrate Blocklight with your applications via REST API.
  </Card>
</CardGroup>