Sign-in & audit feeds

The feeds that fill in what the cloud APIs do not cover: identity detail, endpoint events and the network edge.

What these feeds catch that a cloud API cannot

The cloud APIs describe what happened in the tenant. They do not see the network edge or the endpoint, and some of the most useful facts are in the gap between them.

A VPN authentication at the firewall with no matching sign-in in the directory is an example: each feed alone looks unremarkable, and together they say something authenticated that your directory does not know about. Hal has both, from the same client, in one store.

The other half of this page is silence. A syslog feed can stop for a week without anything appearing to be wrong, which is a hole in exactly the record you would reach for during an incident. Every feed here carries a threshold, so stopping is an event.

Entra ID

Sign-in logs, risky sign-ins and directory changes, by read-only API.

Windows endpoints

Windows event logs shipped by an optional userspace Fluent Bit forwarder. No kernel driver and no command channel: it updates only when you or your RMM run its installer. Why that matters →

Network devices

Routers, firewalls and switches send syslog to a Hal collector on the site’s LAN, which forwards it to Hal. Nothing is installed on the devices and nothing is exposed to the internet. How it works →

Silence detection

Every feed carries a threshold. A source that stops reporting raises a flag rather than leaving a quiet gap in the record.

Setup

Scopes, steps and troubleshooting: in the docs →

The Hal portal events list: each finding with its severity, the client and the model that judged it, with one row expanded to show the reasoning and the numbered remediation steps — **What these feeds add up to.** The sign-in, endpoint and syslog events arrive every few minutes and are read together. What reaches you is a severity, a client, a model’s conclusion and, expanded, the reasoning and the steps.

See what Hal surfaces on your own clients.

No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.

Book a walkthrough Pricing

01You ask us your questions. No deck, no demo dataset.
02You sign a short evaluation agreement, and we stand up your own instance.
03You connect one tenant from your own admin console. Hal watches it for 14 days.
04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.