Your identity layer is the perimeter. Defend it like one.

ManySignal connects natively to Microsoft Active Directory, Microsoft Entra ID (Azure AD), Okta, Ping Identity, JumpCloud, and Google Workspace. LDAP-based directories and SCIM-compatible providers are supported via generic connectors.

ManySignal looks for authentication patterns associated with MFA fatigue (push flood), OTP interception (rapid OTP retry), SS7-based bypass (auth from unexpected carrier origin), and adversary-in-the-middle proxy (auth source IP not matching device IP). Each pattern fires a dedicated detection rule with contextual evidence.

ManySignal infers location from IP geolocation when device GPS is unavailable. Impossible travel fires when two authentications occur for the same user from geographically distant IPs within a time window that makes physical travel impossible. The detection includes travel speed calculation in the evidence package.

Privileged accounts — domain admins, cloud IAM admins, service accounts with elevated access — have tighter behavioral baselines and lower anomaly thresholds. Any privilege use outside business hours, from an unexpected device, or for a resource not accessed in the past 90 days fires a high-confidence triage case.

Standard UEBA tracks behavioral anomalies per user in isolation. Identity attack surface defense adds: a unified identity graph linking all accounts for a single human (AD, Entra, Okta, SaaS), detection of specific identity attack techniques (credential stuffing, golden ticket, pass-the-hash), and coverage of service accounts and machine identities — not just human users.

ManySignal monitors Windows Security Event logs for the specific event IDs associated with credential theft techniques: Event 4768/4769 for Kerberoasting (service ticket requests for high-value SPNs), NTLM authentication patterns associated with pass-the-hash (network logins without interactive session), and DCSync activity (DRSUAPI replication calls from non-domain-controller hosts). Each detection correlates the technical event with the identity context of the requesting account.

ManySignal's Investigate agent traces the full lateral movement chain starting from the compromised credential: which hosts authenticated, which resources were accessed, which additional credentials were harvested. The blast-radius view shows every system reachable from the compromised account before containment. The Respond agent can suspend the identity across all connected directories simultaneously — Okta, Entra ID, and Active Directory — in a single approval action.

Yes. ManySignal monitors SAML assertion logs, OAuth token issuances, and federated authentication events. Golden SAML attacks (forged SAML assertions), token replay across federation boundaries, and audience-unrestricted tokens are all detected via specific detection rules. The entity graph links the federated identity event to the source IdP and destination application, providing full context for the attack path.

Yes. The identity posture view surfaces: accounts inactive for more than 30/60/90 days, accounts with admin privileges not used in the past 90 days, service accounts with broad access but no recent activity, and API keys older than your configured rotation policy. These findings are not behavioral anomalies — they are identity hygiene risks surfaced via the entity graph. Remediation workflows can be triggered directly from the posture view.