Practical guidance for detection engineering decisions and defensible security work.
67 resources
Detect cloud-side data movement through sharing, snapshots, replication, exports, and cross-account copies by following ownership and authority changes that network-only monitoring can miss.
Reason about exfiltration across network, SaaS, cloud, email, removable media, and covert channels by separating transfer-shaped evidence from proof of content and intent.
Recognize staging, archiving, transformation, and bulk collection as preparation for possible data movement while preserving legitimate backup, analytics, migration, and response explanation...
Interpret access to sensitive objects through subject, object, operation, purpose, peer context, and history without turning statistical deviation into a claim of malicious intent.
Detect fraud around payment, payroll, procurement, legal, and recovery workflows by protecting consequential state transitions and the authority and verification behind them.
Reason about external sharing, guest access, links, invitations, and delegated collaboration authority through resource sensitivity, audience, lifetime, and observed use.
Detect mailbox rules, forwarding, delegation, and permission changes by separating configuration, authority, message effect, and legitimate workflow context.
Read message trace, authentication results, routing, delivery, and mailbox events as separate evidence so email detections do not confuse sender claims with verified origin or delivery with ...
Design privacy-safe logging for prompts, retrieval, memory, model outputs, and tool actions by selecting the least sensitive evidence that can support a defined security decision.
Detect when an agent's exercised authority, tool sequence, target scope, or consequence exceeds the bounded purpose and confirmation policy of the initiating task.
