Back to Dashboard

How It Works

Your complete guide to understanding and using the Security Console platform

🚀 Quick Start Guide

Get Started in 3 Simple Steps

  1. Connect Your Data Sources: Add your identity providers (Okta, Azure AD, Google), payment processors (Stripe, PayPal), email systems, and other security tools. Each connection takes just a few minutes to set up.
  2. Enable Threat Detection: Turn on the threat detection modules you need (Account Takeover, Payment Fraud, Phishing, etc.). The system will start monitoring immediately.
  3. Review & Respond: Check your dashboard daily for alerts, investigate threats, and take action. You'll receive email notifications for critical issues.

🔍 How the Platform Works

1

Connect Data Sources

Link your security tools and systems (Okta, Stripe, Gmail, etc.) through OAuth or API connections. The platform automatically starts collecting security events and user activity data.

↓
2

Continuous Monitoring

Our AI-powered system monitors all connected data sources in real-time, analyzing patterns, behaviors, and anomalies across millions of events.

↓
3

Threat Detection

Advanced machine learning models detect suspicious activities like account takeovers, payment fraud, credential stuffing, impossible travel, and more.

↓
4

Alert Generation

When threats are detected, alerts are created with severity levels (Low, Medium, High, Critical) and detailed context about what was found.

↓
5

Investigation & Response

Review alerts in your dashboard, investigate threats using detailed timelines and evidence, label threats for training, and take action to secure your systems.

🔗 How Data Sources & Threats Are Linked

Data Sources are the foundation of threat detection. Each data source provides different types of security events that feed into our threat detection modules.

📡 Data Sources

These are your connected systems:

  • Identity Providers: Okta, Azure AD, Google, Auth0
  • Payment Processors: Stripe, PayPal, Square
  • Email Systems: Gmail, Office 365, Exchange
  • Device Management: Jamf, Intune
  • Network Security: Palo Alto, Cisco, Cloudflare
  • Cloud Services: AWS, Datadog, Kong
→

⚠️ Threat Detection Modules

Each module analyzes data from relevant sources:

  • Account Takeover: Uses identity provider data
  • Payment Fraud: Analyzes payment processor events
  • Credential Stuffing: Monitors login attempts
  • Impossible Travel: Tracks location changes
  • Phishing: Scans email activity
  • SIM Swap: Uses telecom APIs
  • IMSI Catcher: Uses operator radio / attach logs
  • SIM / eSIM Clone: Same radio attach feed — IMSI + IMEI + cell
  • OTP Relay: OTP issued + login/auth success on the same user id (IdP MFA or OTP + login feed) — not Device telco OTP
  • ATM / Suspicious Card: Card / ATM authorization feed (issuer or switch) — not ecommerce processors alone

Example: How Account Takeover Detection Works

When you connect Okta as a data source, the Account Takeover module monitors:

  • Login attempts from new locations
  • Password change events
  • Email address modifications
  • Multi-factor authentication changes
  • Unusual access patterns

If suspicious patterns are detected (e.g., password change + email change + withdrawal), a High or Critical severity threat is created and you're immediately notified.

📥 How to Add Data Sources

1

Navigate to Data Sources Tab

Click on the "Data Sources" tab in your dashboard navigation.

↓
2

Click "Add Data Source"

Select the type of data source you want to connect (Identity Provider, Payment Gateway, Email System, etc.).

↓
3

Choose Your Provider

Select from our list of supported providers (Okta, Stripe, Gmail, etc.) or choose "Other" for custom integrations.

↓
4

Configure Connection

For OAuth providers: Click "Connect" and authorize the connection through your provider's OAuth flow.

For API connections: Enter your API endpoint and credentials (stored securely with encryption).

For file uploads: Upload CSV, JSON, or log files directly.

↓
5

Start Monitoring

Once connected, the system automatically starts collecting data. Enable the relevant threat detection modules to begin monitoring.

💡 Pro Tips for Adding Data Sources

  • Start with Identity Providers: These provide the most valuable security data and enable multiple threat detection modules.
  • Use OAuth when available: It's more secure than API keys and easier to set up.
  • Enable monitoring: Make sure "Monitoring Enabled" is checked so data is collected continuously.
  • Check connection status: Green status means active and collecting data. Red means there's an issue - check your credentials.

📊 Using Your Dashboard

📈

Analysis Tab

View key metrics, recent alerts, and threat trends. Click on any metric card to filter threats by that criteria.

🔍

Threat Explorer

Browse all detected threats, filter by severity, status, or type. Click any threat to see detailed investigation timeline.

🔌

Data Sources

Manage all your connected systems. Add new sources, check connection status, and configure monitoring settings.

⚙️

Settings

Configure email notifications, enable/disable threat detection modules, and manage your preferences.

Understanding Threat Severity Levels

  • Critical (Red): Immediate action required - potential account compromise or financial fraud in progress
  • High (Orange): Serious security concern - suspicious activity that needs investigation
  • Medium (Yellow): Moderate risk - unusual patterns that may indicate threats
  • Low (Blue): Informational - minor anomalies worth monitoring

Threat Status Workflow

  • New: Recently detected threat, needs review
  • Investigating: You're actively looking into this threat
  • Resolved: Threat has been addressed and is no longer active
  • False Positive: Marked as not a real threat - helps improve detection accuracy

✨ Best Practices for Smooth Platform Usage

1. Start with Core Data Sources

Begin by connecting your most critical systems first - typically your identity provider (Okta/Azure AD) and payment processor (Stripe/PayPal). These provide the foundation for most threat detection.

2. Enable Relevant Threat Modules

Not all threat detection modules apply to every business. Enable the ones relevant to your use case:

  • E-commerce businesses: Focus on Payment Fraud, Account Takeover, Credential Stuffing
  • Enterprise: Prioritize Account Takeover, Impossible Travel, Phishing Detection
  • Financial services: Enable all modules, especially Payment Fraud and SIM Swap

3. Review Alerts Daily

Make it a habit to check your dashboard each morning. Start with Critical and High severity threats, then review Medium severity items. This helps you catch issues early.

4. Label Threats Accurately

When you mark threats as "False Positive" or "Resolved", you're training the AI to improve. The more accurate your labels, the better the system becomes at detecting real threats.

5. Configure Email Notifications

Set up email notifications for Critical anomalies so you're immediately alerted to serious threats, even when you're not actively checking the dashboard.

6. Monitor Connection Health

Regularly check your Data Sources tab to ensure all connections are active (green status). If a connection shows errors, update credentials or check API permissions.

🔄 Complete Data Flow

📡

Data Collection

Your connected systems send security events and user activity data to our platform via secure APIs or OAuth connections.

↓
🔐

Secure Storage

All data is encrypted in transit and at rest. Credentials are stored using industry-standard encryption.

↓
🤖

AI Analysis

Machine learning models analyze patterns, detect anomalies, and identify suspicious behaviors across all your data sources.

↓
⚠️

Threat Detection

When threats are detected, alerts are created with severity levels, detailed context, and actionable information.

↓
📧

Notifications

You receive email notifications for critical threats and can configure daily/weekly summary reports.

↓
✅

Investigation & Response

Review threats in your dashboard, investigate using detailed timelines, and take action to secure your systems.

❓ Frequently Asked Questions

How often is data collected?

Data collection happens continuously in real-time for OAuth and API connections. The default monitoring interval is 5 minutes, but you can adjust this in your data source settings.

Is my data secure?

Yes. All data is encrypted in transit (TLS) and at rest. API keys and OAuth tokens are encrypted using industry-standard encryption. We never store your actual passwords or sensitive payment details.

Can I connect custom systems?

Yes! You can add custom data sources by selecting "Other" when adding a data source. Provide your API endpoint and credentials, and the system will start collecting data.

How do I know if a threat is real?

Each threat includes a detailed timeline showing all related events. Review the evidence, check if the user's behavior matches their normal patterns, and investigate suspicious activities. If it's a false positive, mark it as such to help improve detection.

What happens if I disconnect a data source?

Data collection stops immediately, but all historical data and threats remain in your dashboard. You can reconnect at any time to resume monitoring.

Can I export my data?

Yes, you can export threat data as CSV from the Threat Explorer tab. This is useful for reporting, compliance, or analysis in other tools.

🆘 Need More Help?

If you have questions or need assistance:

  • Check the detailed threat information by clicking on any threat in the Threat Explorer
  • Review your data source connection status in the Data Sources tab
  • Ensure your email notifications are configured in Settings
  • Contact support if you encounter any technical issues