Skip to content

Docs

Team and Enterprise

Anomaly detection

A background detector watches your activity stream and flags unusual sessions — off-hours access, first-time host access, and bursts of file operations. Each flag becomes a Detection you can review, and the workspace's owners and admins are notified. It runs continuously, with working defaults and nothing to set up.

What it flags

  • Off-hours access — a session opened outside normal business hours (evenings / weekends), evaluated in the actor's local time. One flag covers the whole off-hours period: reconnecting a terminal or reopening the query console that same night does not raise another.
  • New host access — the first time a given user connects to a particular server or database.
  • Mass operations — a burst of file downloads / uploads by one actor inside a short window.

Review & triage

Open Detections to see open flags, each with its severity, the actor, the target, and when it fired. The sidebar badge counts open detections. For each one you can:

  • Acknowledge — you've seen it and it's expected / handled.
  • Dismiss — it's a false positive.
The detector is the sole writer of detections — reviewers only acknowledge or dismiss. When a flag is raised, the workspace's owners and admins get a security notification. The detector runs safely across replicas (a single cursor advances the watermark), so each event is evaluated once.

Tuning it

It runs with sensible defaults out of the box, and Workspace → Detection adjusts them for your workspace: business hours, the burst threshold for mass operations, each rule's severity, and whether a rule runs at all. Every field can be left to inherit the platform default, and the card shows the resolved settings actually in force.

Off-hours access also has an alert grouping setting. Grouped by window — the default — raises one detection per person, per host, per off-hours period, so acknowledging it stays acknowledged. Per session raises one for every connect instead, which is louder but shows each session separately. A team that genuinely works nights is usually better served by widening business hours than by dismissing flags one at a time.

Permissions

detection.read detection.manage detection.configure

detection.read views the list; detection.manage acknowledges and dismisses; detection.configure changes the tuning.