One platform, honestly inventoried

A risky sign-in gets a step-up challenge, and the signal breakdown that triggered it is stored rather than discarded. Step-up is the safest possible automated action: the user proving their identity is the remediation, so the action is self-correcting when it is wrong.

A real WebAuthn ceremony with signature verification. A forged signature, a phished origin and a replayed assertion are all rejected — verified against each case, not assumed. Text messages and authenticator push notifications are not treated as phishing-resistant, because they are not.

First match wins, and every evaluation produces a per-rule trace naming the winning rule and why each earlier one did not apply. When somebody asks why a contractor got in, there is an answer rather than a theory.

Allow and deny by address range or country, evaluated before rule matching. A sign-in from a blocked zone is refused outright; the same credentials from outside it work normally.

Standard federation with the SAML implementation hardened against signature wrapping, duplicate identifiers, nested assertions and cross-tenant replay — each case tested against the live route rather than the library's documentation.

Eighty-five named permissions rather than three tiers called admin, user and viewer, plus delegated administration so an office manager can reset a password without being able to read the audit log.

Creates users and memberships from your HR or directory system, against the real tables — the shadow-store mount it once ran against has been retired.

Microsoft 365, Entra ID, Windows Event Log and Google Workspace from Core upward. Infrastructure sources — syslog, HTTP event collector, OpenTelemetry, CloudTrail — from Protect. The Windows collector was read against a live System channel rather than a fixture.

Events are normalised to OCSF 1.6.0 so a detection rule is written once instead of once per vendor, and a query about sign-ins does not need to know which product produced them.

Covering eighty techniques across twelve of the fourteen tactics, with roughly a third of the library devoted to Microsoft 365 identity because that is where attacks on companies this size actually begin. Every rule is authored in-house, so no rule obliges us to print another vendor's name in your alert interface.

This is enforced: the validation gate refuses to load a rule without it. A rule you cannot interpret is a rule you switch off in week two, and a switched-off rule is worth nothing regardless of how good it looked in a bake-off.

Matches pass through tenant overrides, a windowed aggregation with a threshold and a cooldown, and a shadow-mode gate. A rule in shadow mode records its finding and contributes to risk without creating work for a human — which is the correct behaviour for a rule that fires on a condition you are still remediating.

Severity, thresholds, windows, cooldowns and suppressions are all yours to change, and every change records who made it and why. Lowering a rule's severity lowers its risk contribution too, so tuning cannot quietly hide an entity from the risk engine.

Correlates a chain into one incident instead of one alert per step — a six-step business email compromise sequence produces a single incident. Built and tested; not yet exercised end to end in production.