# Petra Security Docs

- [Welcome to Petra Security](https://docs.petrasecurity.com/docs/welcome.md): Petra Security is a detection and analysis tool for M365 attacks. Teams use Petra to detect and quickly shut down BECs, deeply investigate M365 environments, and prepare active risk assessments.
- [Petra Scan](https://docs.petrasecurity.com/docs/scan.md): A 6-month forensic lookback on any Microsoft 365 tenant. Scan surfaces active attackers and leftover persistence, then includes 14 days of active monitoring per tenant.
- [Onboard a Tenant](https://docs.petrasecurity.com/docs/add-tenant.md): How to add your tenants onto Petra and what to expect shortly afterwards.
- [Mid Trial FAQs](https://docs.petrasecurity.com/docs/mid-trial-faqs.md): Frequently asked questions during your Petra trial.
- [What Petra Alerts On](https://docs.petrasecurity.com/docs/what-petra-alerts-on.md): Petra only alerts on real account compromises. Everything else is noise.
- [Microsoft 365 Audit Logs](https://docs.petrasecurity.com/docs/audit-logs.md): How Microsoft audit logs work with Petra, how to enable them, and what to expect.
- [Microsoft Partner Center](https://docs.petrasecurity.com/docs/partner-center.md): Onboard and manage client tenants in bulk through your Microsoft Partner Center and GDAP relationships.
- [Is A User Compromised?](https://docs.petrasecurity.com/docs/is-a-user-compromised.md): How to triage login activity and rule out the common false positives.
- [ITDR vs. Email Security](https://docs.petrasecurity.com/docs/itdr-vs-email-security.md): Petra is an identity threat detection tool, not an email security tool. Here is how they differ and why you need both.
- [What did the attacker do?](https://docs.petrasecurity.com/docs/investigating/investigate-what-the-attacker-did.md): Learn how to view and analyze actions performed by attackers during an account compromise
- [What emails did the attacker access?](https://docs.petrasecurity.com/docs/investigating/investigate-email-access.md): Determine the full extent of unauthorized access to a compromised account's mailbox.
- [How did this compromise happen?](https://docs.petrasecurity.com/docs/investigating/how-did-this-compromise-happen.md): How to explain to a client the path an attacker took to compromise their account.
- [What activity is coming from outside the US?](https://docs.petrasecurity.com/docs/investigating/investigate-activity-outside-united-states.md): Learn how to monitor and analyze login activity originating from non-US locations
- [Who is using a proxy/VPN? Which ones?](https://docs.petrasecurity.com/docs/investigating/investigate-proxy-and-vpn-use.md): Learn how to identify and analyze proxy, VPN, and data center usage in your environment
- [Who is attacking my environment? (Failed Attacks)](https://docs.petrasecurity.com/docs/investigating/investigate-failed-attacks.md): Investigate unsuccessful login attempts and attacker behavior
- [Domain Spoofing (Direct Send, SPF, DMARC, DKIM)](https://docs.petrasecurity.com/docs/investigating/domain-spoofing.md): Find out whether Exchange Online Direct Send is enabled, understand your SPF, DMARC, and DKIM results, what each misconfiguration exposes you to, and the exact steps to fix it.
- [Remediate an Account Compromise](https://docs.petrasecurity.com/docs/remediation/how-to-remediate.md): Step-by-step guide for handling and remediating compromised accounts in Petra
- [What is Petra Response?](https://docs.petrasecurity.com/docs/remediation/what-is-petra-response.md): Petra's SOC can remediate incidents for you.
- [Cross-Tenant Phish Removal](https://docs.petrasecurity.com/docs/remediation/cross-tenant-phish-removal.md): Find and remove a phishing email from every managed tenant by subject.
- [Threat Remediation Report](https://docs.petrasecurity.com/docs/reporting/incident-report.md): White-label PDF report.
- [Tenant Report](https://docs.petrasecurity.com/docs/reporting/tenant-report.md): Everything Petra identifies, including M365 incidents, failed attacks, uncommon activities, and spotlighted investigations can be compiled into a white-labeled PDF report.
- [Prospecting Report](https://docs.petrasecurity.com/docs/reporting/prospecting-report.md): A white-labeled PDF that transforms 6 months of Microsoft 365 forensics into a sales-ready document for prospecting and client meetings.
- [Posture Report](https://docs.petrasecurity.com/docs/reporting/posture-report.md): Assess a tenant's Microsoft 365 configuration, hand the client a white-labeled PDF with a posture score and ranked risks, fix the gaps from inside Petra, then run a follow-up report that proves what improved.
- [Policy Report](https://docs.petrasecurity.com/docs/reporting/policy-report.md): A white-labeled PDF for a single Conditional Access policy: proof of what it blocked if it is enforced, or a pitch and sign-off request if it is not.
- [User Activity Report](https://docs.petrasecurity.com/docs/reporting/user-activity-report.md): A white-labeled PDF summarizing a specific user's sensitive M365 activity across Exchange, SharePoint, and Teams.
- [Domain Spoofing Report](https://docs.petrasecurity.com/docs/reporting/domain-spoofing-report.md): Download a white-labeled PDF of a tenant's spoofing exposure: whether Direct Send is enabled, plus SPF, DMARC, and DKIM posture and the spoofing risk for every domain.
- [Marketing Hub](https://docs.petrasecurity.com/docs/marketing-hub.md): Downloadable sales materials, presentations, and documentation to help you sell Petra to existing clients and prospects.
- [Anonymize Incidents](https://docs.petrasecurity.com/docs/anonymize-incidents.md): Show any quickly caught incident as a victory lap, and any Scan finding as a cautionary tale, without exposing your client's data.
- [Conditional Access Policies](https://docs.petrasecurity.com/docs/policies/conditional-access-policies.md): View your Conditional Access Policies across all tenants and see which policies are blocking sign-ins.
- [Updating Notification Methods in Petra](https://docs.petrasecurity.com/docs/settings/update-incident-notification-methods.md): Configure how your team receives alerts when incidents occur
- [Member Roles and Permissions](https://docs.petrasecurity.com/docs/settings/member-roles-and-permissions.md): Understand the different member roles and permissions in Petra
- [Authentication](https://docs.petrasecurity.com/docs/settings/authentication.md): Control how members sign in to your Petra organization — including allowed login methods, MFA enforcement, Just-in-Time provisioning, and SSO
- [Co-Managed Tenants](https://docs.petrasecurity.com/docs/settings/co-managed-tenants.md): Give your clients secure, scoped access to their own tenant in Petra
- [Pause or Remove a Tenant](https://docs.petrasecurity.com/docs/settings/offboard-tenant.md): How to pause or offboard a tenant from Petra
- [Billing & Payment](https://docs.petrasecurity.com/docs/settings/billing.md): Access invoices, manage payment methods, and resolve billing portal login issues.
- [How Petra Calculates Billable Licenses](https://docs.petrasecurity.com/docs/settings/licensed-users.md): Which users am I billed for?
- [View Tenant Applications](https://docs.petrasecurity.com/docs/settings/view-tenant-applications.md): See all applications registered in a tenant from the Admin panel
- [ConnectWise PSA Integration](https://docs.petrasecurity.com/docs/integrations/connectwise.md): Connect Petra with ConnectWise PSA (Manage) for automated ticketing and billing sync.
- [Autotask PSA Integration](https://docs.petrasecurity.com/docs/integrations/autotask.md): Connect Petra with Autotask PSA for automated ticketing and billing sync.
- [Halo PSA Integration](https://docs.petrasecurity.com/docs/integrations/halo.md): Connect Petra with Halo PSA for automated ticketing and billing sync.
- [Custom Webhooks](https://docs.petrasecurity.com/docs/integrations/custom-webhooks.md): Connect any automation tool to Petra and trigger workflows the moment an incident is detected.
- [Sign-In Troubleshooting](https://docs.petrasecurity.com/docs/troubleshooting/sign-in.md): Common sign-in issues and how to resolve them
- [Changelog](https://docs.petrasecurity.com/docs/changelog.md)
- [Introduction](https://docs.petrasecurity.com/docs/api-reference/introduction.md): Welcome to the Petra Security API documentation
- [Authentication](https://docs.petrasecurity.com/docs/api-reference/authentication.md): Learn how to authenticate with the Petra Security API
- [API Troubleshooting](https://docs.petrasecurity.com/docs/api-reference/troubleshooting.md): Common causes of API errors and how to fix them
- [Get Tenants](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-tenants.md): List the Petra tenants in your organization. Use this to discover Petra tenant IDs to pass to the other endpoints. Removed (deleted) tenants are excluded; paused tenants are included with `isPaused: true`.
- [Get Usage](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-usage.md): Retrieve tenant usage stats, including billable date range and number of licensed users.
- [Get Billable Users](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-billable-users.md): Retrieve the list of billable users for a specific Petra tenant. A user is considered billable if they have non-empty assignedLicenseSkuIds and are not deleted (deletedAt is null).
- [Get Incidents](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-incidents.md): Retrieve security incidents ordered by creation date (newest first).
- [Get Failed Attacks](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-failed-attacks.md): Retrieve failed-attack data for a specific tenant. Returns attack counts by country, daily attack breakdowns by type, and the most targeted users for the requested date range.
- [Get Posture Reports](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-posture-reports.md): Retrieve completed Microsoft 365 security posture reports for the tenants in your organization. By default this returns the most recent completed report for each tenant, newest first. Each report includes the score and grade, a rollup of control results, the Global Administrators review, the top ris…

## OpenAPI Specs

- [openapi](/docs/api-reference/openapi.json)

## Optional

- [Research](https://www.petrasecurity.com/research)
- [Support](mailto:support@petrasecurity.com)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.