Cloud security · Domain Intelligence Pack
Monitor cloud control planes, identities, resources, posture, and exposure as one changing security state.
Overview
What the Cloud DIP monitors, detects, explains, and makes possible.
The Cloud DIP keeps live cloud security state, with source and time preserved.
Findings assessed for security exposure and service impact.
Review the relationships and supporting evidence behind a finding.
Domain actions Ollandi can propose, each checked against policy before it runs.
Example investigation
Follow an illustrative condition through the domain signals, assessment, proposed response, and verification.
A service account gains privilege outside an approved change window.
Secrets enumeration follows. Ollandi tests a deployment error, configuration drift, and credential compromise as competing explanations.
A reversible privilege suspension and session revocation are checked against policy, service dependency, and blast radius.
Anomalous calls stop; the before-and-after state and decision evidence are preserved.
Coverage
Evidence keeps its source and time. Ollandi relates it to other packs, service dependencies, policy, authority, and history.
Domain Intelligence Packs
Every pack feeds the same shared state, so evidence from one domain can support or challenge another.
Domain Intelligence Pack
Monitor human and machine identity, sessions, credentials, privilege, and access behavior across infrastructure.
Learn moreDomain Intelligence Pack
Monitor live workload execution and connect process behavior to images, deployments, identities, network paths, and services.
Learn moreDomain Intelligence Pack
Monitor communication paths, segmentation, service reach, and movement across cloud, campus, data center, and hybrid networks.
Learn moreDomain Intelligence Pack
Monitor endpoint processes, users, files, software changes, connections, and device health in wider infrastructure context.
Learn moreDomain Intelligence Pack
Monitor private infrastructure, directories, virtualization, storage, databases, configuration, and hybrid dependencies.
Learn moreDomain Intelligence Pack
Monitor ATM availability, dispensing, cash, hardware, communications, security events, vendors, and service obligations.
Learn moreFAQ
The change is related to the initiating identity, affected resources, approval window, and subsequent API activity. An unusual grant alone does not establish compromise.
Connected accounts can contribute to the same entity graph. Cross-account interpretation depends on available audit events, identity correlation, and permitted access.
Use a documented privilege or configuration incident. Compare the explanation, affected scope, and proposed intervention against the known timeline.
Get started
Bring an IAM or configuration incident and the relevant audit trail to review with the cloud team.
