Threat visibility coverage
What each source can see — and cannot.
No single source sees everything. Use this matrix to decide which sensors a deployment needs for the questions you must be able to answer.
● visible ◐ partly visible ○ not visible — select a cell for its note
| Question | Web server logs | Page behaviour beacon | Endpoint agent | DNS logs | Firewall logs | Network mirror | Identity provider logs | Cloud audit logs |
|---|---|---|---|---|---|---|---|---|
| Who connected, and from which network? | ||||||||
| Which pages or resources were requested? | ||||||||
| How did the visitor behave on the page? | ||||||||
| Which process made the connection? | ||||||||
| Which domains did internal hosts look up? | ||||||||
| Was there lateral movement between internal hosts? | ||||||||
| Were credentials used, and where? | ||||||||
| How much data left, and to where? | ||||||||
| What was inside encrypted traffic? |
Select a cell.
SOVEREIGN BY DESIGN.
Request a technical briefing
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.