Identity security · Domain Intelligence Pack
Monitor human and machine identity, sessions, credentials, privilege, and access behavior across infrastructure.
Overview
What the Identity DIP monitors, detects, explains, and makes possible.
The Identity DIP keeps live identity security state, with source and time preserved.
Findings assessed for security exposure and service impact.
Review the relationships and supporting evidence behind a finding.
Domain actions Ollandi can propose, each checked against policy before it runs.
Example investigation
Follow an illustrative condition through the domain signals, assessment, proposed response, and verification.
A valid MFA session appears from a new device and geography.
Privileged operations follow. Ollandi tests travel, delegated access, and credential misuse.
Step-up authentication and temporary privilege suspension are selected as reversible actions.
The session state, operator decision, and evidence bundle remain available for review.
Coverage
Evidence keeps its source and time. Ollandi relates it to other packs, service dependencies, policy, authority, and history.
Domain Intelligence Packs
Every pack feeds the same shared state, so evidence from one domain can support or challenge another.
Domain Intelligence Pack
Monitor cloud control planes, identities, resources, posture, and exposure as one changing security state.
Learn moreDomain Intelligence Pack
Monitor live workload execution and connect process behavior to images, deployments, identities, network paths, and services.
Learn moreDomain Intelligence Pack
Monitor communication paths, segmentation, service reach, and movement across cloud, campus, data center, and hybrid networks.
Learn moreDomain Intelligence Pack
Monitor endpoint processes, users, files, software changes, connections, and device health in wider infrastructure context.
Learn moreDomain Intelligence Pack
Monitor private infrastructure, directories, virtualization, storage, databases, configuration, and hybrid dependencies.
Learn moreDomain Intelligence Pack
Monitor ATM availability, dispensing, cash, hardware, communications, security events, vendors, and service obligations.
Learn moreFAQ
No. Device, session, privilege, and subsequent activity still matter. New geography or a new device is context to investigate, not proof of misuse.
Observed activity is related to the account’s role, expected scope, permissions, and connected workloads. Approved automation is considered alongside misuse and configuration drift.
Choose a session or privilege incident with authentication records, role changes, and follow-on activity. Assess both suspicious behavior and plausible legitimate use.
Get started
Choose a session or privilege incident to review against identity history and the access graph.
