Each finding aligns to tactics/techniques for faster triage and auditability
Highlights configuration drift and policy violations tied to business impact
Detects multi-stage attacks (initial access → persistence → exfiltration)
Baselines cloud identities, services, and workloads to spot anomalies (rare actions, unusual peers, time/geo outliers)
Admin actions, token/app consent risk, external sharing anomalies (e.g., O365/Google Workspace)
Registry pulls, runtime anomalies, function abuse, excessive permissions