Real-time detection of suspicious activity, attack attempts and security anomalies.
Prevention alone is not enough
Any well-built system stops most attempts. The question is not whether protection works, but how long it takes to notice that, in one case, it did not. Industry statistics consistently show that the interval between compromise and discovery is measured in weeks, not hours.
Detection shortens this interval. It does not replace prevention; it deals with what gets past it.
What is watched
Access patterns that do not look like normal activity: repeated sign-in attempts, requests to objects the user has no rights to, downloads in unusual volume, out-of-hours activity for accounts that only work during the day.
Signals are not judged in isolation. One refused request is normal; a hundred refused requests in two minutes, from the same account, are not. The context is built from the audit log, which records every operation anyway.
What is done with a signal — an alert, a temporary block, escalation to the security team — is a policy decision, configured by the organisation. The system provides the detection; the response remains yours.
- detection on access and usage patterns, not only on known signatures;
- signals built from the existing audit log;
- response rules configurable by the organisation;
- structured export to your own security monitoring system.
What the organisation gains
An incident discovered in hours, not weeks, costs something else. It is contained to what has already happened, instead of spreading silently.
And for breach notification — where the law imposes short deadlines — early detection is the only thing that makes the deadline realistic.
Questions and answers
Does it replace a SIEM?
No. It covers detection inside the platform and exports the signals to your monitoring system, if you have one.
Who receives the alerts?
Recipients and thresholds are configured. Usually the security team or the platform administrator.
Does it produce many false alerts?
Thresholds are calibrated on the organisation’s real activity in the first weeks of operation. Poor calibration produces either noise or silence.
What happens to a suspicious account?
The action — alert, temporary block, re-authentication request — is a policy decision that you make.