Most ITDR tools inspect logins and a narrow slice of cloud events. Petra was built to watch the full surface attackers abuse: inbox rules, SharePoint exfiltration, MFA and device registrations, and the persistence mechanisms that get left behind. More attacks caught, deeper remediation, and a cleaner forensic story for every incident.
Capability |
|
Huntress ITDR | Blackpoint | SaaS Alerts |
|---|---|---|---|---|
Detection | ||||
| Detection approach | Behavioral (all M365 activity) | Location (logins, inbox rules, partial SharePoint activity) | Location (logins & cloud events) | Rule-based |
| Detects known-bad IPs in login logs | ||||
| Attacker intent analysis in Exchange & SharePoint | ||||
| Detects residential proxies | ||||
| Dynamic tuning for per-client VPN usage | ||||
| Catches credentials blocked by MFA or Conditional Access | ||||
| Manual tuning required | None | Moderate (travel allowlists, VPN whitelists) | Moderate | Heavy |
| 24/7 US-based SOC | ||||
Remediation | ||||
| Disables account & revokes sessions | ||||
| Removes malicious inbox rules & forwarding | Partial | Partial | ||
| Reset password in the portal | ||||
| Fleet-wide phishing email retraction | ||||
| Reverses attacker activity in SharePoint | ||||
| Reverses malicious MFA & device registrations | ||||
Forensics | ||||
| Finds root-cause phishing email | ||||
| Shows IP address of attacker sign-in | ||||
| Attacker timeline across M365 | Full | Basic | ||
| Generates client-ready PDF | ||||
Log & Data Retention | ||||
| M365 SIEM included with ITDR | Separate product | |||
| Log retention & search window | 12 mo. searchable | 1 mo. hot / 12 mo. cold | ||
Reporting & Sales Enablement | ||||
| Targeting analytics per client | ||||
| Pre-sales incident response report | ||||
| Anonymized incident library for sales | ||||
Platform Coverage | ||||
| M365 | ||||
| Google Workspace | ||||
Run a free 6-month scan to see how Petra can level up your security team.