Security Signal Intelligence API
Correlate security events, detect weak signals and attack sequences, surface insider-threat, privilege-escalation, lateral-movement, account-takeover, credential-abuse, and brute-force patterns, and score severity—using caller-supplied JSON events and logs with local explainable rules only.
Correlate caller-supplied security events into related incident groups using time windows and shared actor/host/IP links. Observed grouping only—not a confirmed attack.
Identify early suspicious-activity indicators from caller-supplied events. Weak signals are hypotheses with explicit confidence—not confirmed attacks.
Detect caller-supplied event sequences that match local attack-pattern rules. Matches are inferred patterns, not confirmed compromises.
Identify unusual user activity in caller-supplied logs (off-hours, bulk/export wording, privilege changes). Not a confirmed insider attack.
Detect privilege-escalation indicators from caller-supplied privilege fields and escalation keywords. Not confirmation of successful abuse.
Identify suspicious host-to-host movement from caller-supplied network/auth logs. Does not access the caller's network.
Identify account-takeover indicators when multiple distinct signals appear for the same user (geo/device/MFA/recovery). Not a confirmed takeover.
Detect suspicious credential usage such as repeated failures, fail-then-success, or reuse across many hosts from caller-supplied auth events.
Identify burst, distributed, and low-and-slow brute-force patterns from caller-supplied authentication failures.
Calculate an explainable severity score for detections derived from caller-supplied events, with scoring breakdown and confirmedAttack=false.