Security and access
Who can see your data, what your workloads can send, and how an attack becomes a signal.
Three separate questions #
Security in this product is three things that meet rather than merge, and keeping them apart makes each one easier to reason about.
- Access — who a human is, and what they are allowed to see and change.
- Credentials — what a machine is allowed to send, and to which parts of your telemetry.
- Detection — what is noticed when something looks wrong, and what an analyst does about it.
Access #
Sign-in is handled by your identity provider, so access follows the directory you already run. Roles decide what a member can do once they arrive, and organisations keep one organisation's data out of another's.
- Identity and roles — sign-in, the managed roles, and custom ones.
- Organisations and data isolation — how one organisation's data is kept apart from another's.
- Audit trail — who changed what, recorded as it happened.
Credentials #
A workload sends telemetry under a key rather than under a person. A scoped key limits that key to the signals it actually needs, so a compromised collector can send metrics without also being able to read anything back.
- Scoped API keys — one credential per workload, limited by scope.
- Application keys — non-human identities that act on behalf of an automation, with their own roles.
Detection #
Detection turns your telemetry into signals. A rule watches for a pattern and raises a signal; an analyst triages it. The pieces are the rule library, the signal list, and the suppressions that keep known noise out.
- Detection rules — the shipped library, and how to write your own.
- Security signals — the list, the detail view, and triage.
- Suppressions — silencing what is known to be noise.
Getting the data in #
Detection reads what your workloads actually send, so its coverage is bounded by your telemetry. Two things widen it.
- App and API protection reads attack attempts out of your request traces, and reports how much of your traffic carries the attributes it needs.
- Client address attribution resolves the real client behind a chain of trusted proxies, which is what makes per-address detection work behind a load balancer.
Start where your data already is
Authentication rules read logs, application rules read spans, and the network and denial-of-service rules read flows and metrics. Whichever of those your instrumentation covers best is where you will get useful signals soonest.
Onward #
Start with Identity and roles if you are setting access up, with Scoped API keys if you are setting telemetry up, and with Security signals if you are already collecting and want to see what it found.