Connectors
Sources
Each card is the pull this board expects. The numbers are a representative AMHS sample. Live credentials are not stored here, and they should wait until Entra ID sign-in is in place.
Microsoft Entra ID
Sign-in is planned and not built yet. Nothing in this preview is gated, and no tenant is connected.
SOC
Investigations, types, protection outcome, and the AMHS incidents raised from them.
25 investigations · 7 incidents · 6 open
Last sample 17 Oct 22:08 UTC
- Investigation id, type, severity, status
- Protection: blocked, detected, or manual
- Open and resolve timestamps
- MITRE techniques
- AMHS incident and owner
Identity
MFA enrollment, users, authentication failures, and warnings.
116,698 auth events in 90 days
Last sample 17 Oct 22:08 UTC
- Users and factor enrollment
- Push, hardware token, WebAuthn
- Failures: fraud, deny, timeout, spray
- Warnings: new device, anonymous IP, location
- Bypass codes and lockouts
EDR
Agents, alerts, and blocks or other mitigations.
3,629 alerts in 90 days
Last sample 17 Oct 22:08 UTC
- Agents online, offline, isolated
- Alerts by classification
- Killed, quarantined, blocked, pending
- Storyline tied to an investigation
DNS Filtering
DNS blocks, categories, identities, and destinations.
189,111 blocks in 90 days
Last sample 17 Oct 22:08 UTC
- Requests and blocks
- Security categories
- Users, devices, networks
- Destinations
- Detected versus blocked
Email attacks, remediation, and the messages behind investigations.
1,337 judged messages in 90 days
Last sample 17 Oct 22:08 UTC
- Attack type
- Recipient and sender
- Auto-remediation versus manual
- VIP mailboxes
- False positives released back