Docs menu
Catch attacks
Security events in, detections and alerts out, and the investigation that follows.
6 guides
Security events
- Collect Windows security eventsCollect Windows security events (4624, 4768, 4769) with an OpenTelemetry Collector and audit policy, and see which edges become Validated.
- What telemetry adds to the graphFailed logon counts (event 4625), 30-day behavior profiles and Tier 0 credential exposure that domain controller telemetry adds to each identity.
Detection and response
- Identity threat detection (ITDR)Detect Kerberoasting, DCSync, brute force, password spray and lateral movement from domain controller events, with MITRE ATT&CK IDs and paths to Tier 0.
- Triage alertsTriage ITDR alerts for Kerberoasting, password spray, brute force and DCSync, with MITRE ATT&CK IDs, evidence and the paths to Tier 0 for the targeted account.
- InvestigationsRun an AI-assisted identity investigation and read the report: peer comparison, logon pattern, MITRE ATT&CK findings and recommended actions.
- Identity TimelineInvestigate one identity's logon sessions, detection alerts and telemetry events in time order, with behavior overview, charts and access intelligence.
- Detection catalogEvery detection rule GraphnAI ships, on its own page.