Log Sources
Every source Hal monitors is ingested every few minutes and retained for 365 days, searchable across all of a client’s sources at once. Cloud sources connect by API with nothing installed; Windows endpoints use a lightweight log shipper; network gear sends syslog to a Hal collector on its own LAN.
Setup walkthroughs for cloud tenants live under Getting Started.
Entra ID
Hal reads identity activity from Microsoft Entra ID through Microsoft Graph, over read-only permissions.
OpenGoogle Workspace
Hal reads Google Workspace activity through the Reports API and the Alert Center, over a service-account authorization you grant in your Admin Console, and never writes to the workspace.
OpenMicrosoft 365
Hal reads your clients’ Microsoft 365 audit activity through the Microsoft 365 Management Activity API, over read-only credentials you grant and can revoke at any time.
OpenNetwork Devices
Routers, firewalls and switches send syslog to a Hal collector on their own LAN, and the collector forwards it to Hal. Nothing is installed on the devices, nothing is exposed to the internet, and Hal never reaches back into them.
OpenWindows Endpoints
Hal puts a userspace log shipper on a Windows endpoint, with the installer that keeps it current: one signed-in download you can run by hand or push from your RMM with the client passed as a parameter.
OpenSee what Hal surfaces on your own clients.
No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.
- 01You ask us your questions. No deck, no demo dataset.
- 02You sign a short evaluation agreement, and we stand up your own instance.
- 03You connect one tenant from your own admin console. Hal watches it for 14 days.
- 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.