Threat visibility

Cross-System Threat Anomaly Detection

A correlation service that ingests signals from disparate systems and surfaces coherent incident views rather than isolated alerts.

DocumentedApply for Grant Access

Mission problem

Small internal security teams cannot triage the volume of low-signal alerts produced by modern estates, and coordinated activity is easily missed.

Who it protects

· NGOs
· Institutes
· Think tanks
· Advanced R&D labs

Sensitive assets involved

· Operational continuity
· Sensitive systems
· Executive and researcher accounts

Required inputs

· Identity events
· Endpoint telemetry
· Cloud audit logs
· Network flow summaries
· Data-access events
· Vendor telemetry where available

Connected systems

· SIEM or logging platforms
· Cloud audit sources
· EDR
· Identity providers

How the service works

Signals are normalized to a common schema.
Correlation rules and heuristics assemble candidate incidents.
Analysts and reviewers see one composed view instead of scattered alerts.

Human-review points

· Incident confirmation
· Containment decisions
· Cross-team escalation

Evidence produced

· Composed incident record
· Signal lineage
· Reviewer disposition

Service interlocks

· Secure Workflow Orchestration with Human Review Gates
· Vendor and Dependency Trust Monitoring
· Scenario Simulation, Red-Team Rehearsal, and Incident-Response Orchestration

Cross-System Threat Correlation (illustrative)

Illustrative scenario

Illustrative: credential misuse discovered across three systems

Three individually low-signal events across identity, cloud storage, and a vendor portal are correlated into a single incident view and routed for containment review.

Deployment prerequisites

· Access to relevant log sources
· Defined incident-response ownership

Beneficiary responsibilities

· Provide log access
· Staff triage roles
· Confirm containment actions

Limitations and non-claimsRequires validation

· Detection is bounded by the quality of connected signals.
· The service does not autonomously contain high-impact incidents without human review.

Frequently asked

Is this a replacement for our SIEM?

No. It composes correlated views on top of existing telemetry and can complement an SIEM.

How are false positives handled?

Analyst dispositions feed back into correlation heuristics; every disposition is preserved in the evidence chain.

Can it detect insider misuse?

The service is designed to correlate coordinated activity across identity, data, and vendor surfaces, which is often where insider misuse first appears.

Delivery model

Onboarding → Policy Definition → Controlled Rollout → Steady-State Assurance. Every phase produces named evidence artifacts.

4-Phase Delivery Timeline

Phase 1
Onboarding
Read-only connection to identity, endpoint, cloud audit, network flow, data-access, and available vendor telemetry sources. Baseline volumes and quality are established.
- · Signal source inventory
- · Baseline quality report
Phase 2
Policy Definition
Correlation rules, thresholds, incident-response ownership, and containment authority are co-authored with the beneficiary and ratified.
- · Correlation ruleset
- · Response ownership map
Phase 3
Controlled Rollout
Correlation runs in observation mode; composed incidents are reviewed by named analysts. Escalation and containment paths are exercised through tabletop rehearsal.
- · Observation-mode incident log
- · Tabletop after-action
Phase 4
Steady-State Assurance
Ongoing correlation tuning, analyst rotation, and quarterly threat-visibility packs for stakeholders.
- · Quarterly threat-visibility pack
- · Analyst rotation record

Beneficiary scenarios

Illustrative

Coordinated credential misuse across three systems

A stolen credential is used from a new geography (identity), triggers an unusual cloud storage listing (audit), and is followed by an outbound vendor-portal login (vendor). Individually low-signal; correlated into one composed incident, routed for containment review with a rollback token for the affected credential.

Illustrative

Executive-account phishing follow-through

A researcher's account receives an anomalous OAuth grant (identity), begins pulling embargoed papers from a repository (data), and forwards summaries to an external mailbox (endpoint). The correlation composes a single incident view and escalates to the security lead and executive sponsor.

Engineering detail

Integration model+

Read-only signal ingestion from SIEM or logging platforms, cloud audit sources, EDR, IdP, and vendor telemetry where available. No agents are required beyond what the beneficiary already runs.

Data flows+

Signals are normalized to a common schema, enriched with identity and asset context, evaluated by correlation rules and heuristics, composed into candidate incidents, and routed to analyst review with full signal lineage.

Cryptographic components+

Signal snapshots are hashed at capture; composed incident records are signed. Sensitive payloads remain in beneficiary tenancy.

Logging architecture+

Every composed incident preserves the full signal lineage, correlation rule references, analyst disposition, and any containment actions with rollback tokens.

Deployment prerequisites+

Access to relevant log sources, defined incident-response ownership, named analysts, and an executive sponsor for containment authority.

Operational limits+

Detection is bounded by connected signal quality and coverage. The service does not autonomously contain high-impact incidents without human review.

Governance model

Approval gates

· Correlation rule publication requires analyst lead ratification.
· Composed incidents above a defined risk threshold require named analyst confirmation.
· Containment actions require executive sponsor sign-off.
· External disclosure requires evidence-pack review before release.

Exception handling

Analyst dispositions (confirmed, benign, or under investigation) are recorded with rationale and preserved in the evidence chain.

Rollback paths

Containment actions carry rollback tokens where downstream systems support reversal. Rollback attempts are logged whether or not they succeed.

Beneficiary control boundaries

The beneficiary owns response ownership, analyst rosters, and containment authority. The overlay composes and proposes; humans decide.

Evidence and reporting outputs

· Composed incident record
· Signal lineage across sources
· Correlation rule references
· Analyst disposition and rationale
· Containment action log
· Rollback token
· Tabletop after-action record
· Quarterly threat-visibility pack

Grant scope

Included

· Connectors to an agreed set of log sources and telemetry providers
· Correlation ruleset authoring and tabletop rehearsal
· Analyst onboarding and observation-mode rollout
· Steady-state tuning and quarterly threat-visibility packs

Beneficiary responsibilities

· Provide log access and asset context
· Staff analyst triage roles and rotation
· Confirm containment actions through the executive sponsor

Timeline

Typical: 4-phase delivery over 8–14 weeks depending on source count and signal quality.

Explicit exclusions

· Replacement of the beneficiary's SIEM or EDR
· Endpoint agent deployment
· Autonomous containment of high-impact incidents

Portfolio interlock

Portfolio Interlock Web

Predecessors, successors, and operational interlocks across the portfolio.

Natural predecessors

· Sensitive Data Classification and Routing
· Vendor and Dependency Trust Monitoring

Natural successors

· Secure Workflow Orchestration with Human Review Gates
· Scenario Simulation, Red-Team Rehearsal, and Incident-Response Orchestration

Operational interlocks

· Evidence-Grade Audit and Provenance Capture

Risks and non-claims

Requires validation

· Signal gaps produce correlation blind spots; the observation-mode rollout surfaces these explicitly.
· Alert fatigue is a real risk; analyst rotation and threshold tuning are part of steady-state assurance.
· The service does not certify incident-free operation; it composes coherent views and preserves evidence.

Discuss this service in your context

All services Grant access