Microsoft 365
Microsoft 365 is the richest single source Hal reads, and for most MSPs it is where an incident first becomes visible.
What the audit log adds to the sign-in log
A sign-in log tells you an account authenticated from an unusual place. On its own that is a maybe: travel, a VPN, a phone on a foreign carrier.
The unified audit log tells you what the session then did. A successful sign-in followed minutes later by a new inbox rule forwarding mail to an outside address is not an unusual sign-in, it is a business email compromise with a timeline. Hal reads both feeds from the same tenant, so the second fact is available at the moment the first one fires rather than during the investigation afterwards.
That is why this source is first: for most MSPs it is where an incident becomes visible, and it is the one that carries both halves.
See what Hal surfaces on your own clients.
No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.
- 01You ask us your questions. No deck, no demo dataset.
- 02You sign a short evaluation agreement, and we stand up your own instance.
- 03You connect one tenant from your own admin console. Hal watches it for 14 days.
- 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.