How ElasticIT Relies on Petra’s Advanced Detection Models to Protect Its Clients

Anthony first heard of Petra from a peer MSP who was evaluating Petra as an alternative to Huntress. ElasticIT was already running Huntress for ITDR alongside Blumira, but Anthony was intrigued enough to run a Petra Scan on the last six months of their logs. Within 48 hours, the Scan surfaced six uncaught incidents that ElasticIT’s existing tools had missed.

In one case the attacker had access to the account through Microsoft’s Direct Send functionality to bypass email security through an email titled “Action Required: Service Termination Alert.” In another, the attacker went undetected by using a residential proxy. Both are the kind of modern attack that slips past traditional ITDRs, since the activity looks local and legitimate. Petra’s machine learning models uncover user intent, allowing them to identify these as compromises.

The Scan also surfaced compromises ElasticIT had already remediated, and Anthony was struck by how much time his team would have saved on forensics and reporting had Petra been deployed sooner. Two incidents in the weeks before he found Petra had each required a full-day Purview investigation. Petra’s forensic report was delivered in about ten minutes.

The Scan convinced Anthony and the ElasticIT team to deploy Petra fully across their tenant base.

At one of their largest tenants, Petra runs side by side with Huntress, Aegis, and Abnormal Security for contractual reasons. So far, Petra has caught five compromises, none of which were caught by the other three tools.

In addition to upleveling their detection capabilities, Anthony’s team has also reduced noise from false positives.

Before Petra, ElasticIT never had password leaks surfaced by its security stack. Petra’s leak detection catches a specific gap that Anthony’s team was never able to stop before:

Detection is what Anthony cares about most, but he’s quick to point out that the rest of the platform is what keeps his team’s efficiency and service quality high.

Petra’s end-to-end remediation ensures his team fully closes out an incident:

Anthony is also able to keep clients in the loop sooner thanks to Petra’s fast turnaround. Previously, ElasticIT often delayed notifying clients until investigations were complete to avoid causing panic. Their answers came from Purview searches that took all day and ran about 24 hours behind, with clients pressing for updates. White-labeled reports now go to clients when incidents occur, replacing a process that, according to Anthony, was resource intensive, slow and didn’t always produce user-friendly output.

Petra’s audit log search has become one of Anthony’s favorite features. The ElasticIT team spends far less time in Purview these days as a result. Anthony touts the search as better than paid SIEM tools, and values it enough that he thinks it could stand on its own as a product.