What the industry reports
- 22%of breaches begin with credential abuse, the single largest initial access vectorVerizon DBIR 2025
- 88%of basic web application attacks involve stolen credentialsVerizon DBIR 2025
- 54%of ransomware victims had credentials exposed in infostealer logs beforehandVerizon DBIR 2025
The moment
A session hijack at 02:14. A login from 5,900km away at 02:28. A rule forwarding mail out of the building at 02:44. Three queues, and nobody joins them up.
For the SOC analyst working the queue.
Correlated on the identity and on the source
A queue grouped by user never finds the one address working through ten accounts. Both axes run, and what correlates with neither stays on its own.
The order is part of the signal
A session hijack, then travel that is not possible, then a forwarding rule. Sequence is what separates an incident from four coincidences.
The blast radius is already attached
Governance writes to the same graph. Triage opens with what that account reaches, instead of a lookup somebody has to run.
What you get
Everything this covers.
Signal coverage
- Sign-in and audit events from the directory
- Six Microsoft 365 workloads, where an inbox rule would otherwise be invisible
- The connections screen names which subscriptions are live
Detection
- Rules in a Sigma-compatible schema, mapped to MITRE ATT&CK
- Impossible travel measured on real geography and speed
- A subnet hop told apart from one across a continent
- Password spray counted on failures across distinct accounts
- Legacy authentication downgrade caught on its own
Correlation
- Correlated on the identity and on the source address
- Events held in the order they happened
- Suppression rules mute the known-good and collapse duplicates
Response
- Every rule ships its own ordered response steps
- Detection and governance read one graph
- A review of that account's access, opened from the same conversation
What does the work
The parts of the product this uses.
Threat detection
Rules read like detections and map to the techniques they catch
Correlation and attack chains
Related events arrive as one chain instead of separate tickets
Investigations
The timeline, the attack path and the evidence arrive assembled
Guided response
Every rule ships the playbook for the thing it just caught