Behavioral detection
Petra catches more real attacks, faster and with fewer false positives. Our models analyze 30x more data than location-first tools to surface the AI-era attacks others miss.


MSPs choose Petra for next-generation detection across every client tenant, end-to-end remediation that saves hours every week, and insurance-grade reports your clients can read at a glance.
“Petra is the single best software we've ever bought a license for at Ever Nimble.”

Petra catches more real attacks, faster and with fewer false positives. Our models analyze 30x more data than location-first tools to surface the AI-era attacks others miss.

When Petra catches an attack, it closes the entire incident, without manual cleanup or waiting on your clients to act. Your team gets hours back every week.

We reconstruct the full story of every compromise automatically: root cause, attacker timeline, and every action taken. It's all done for you, consolidated into a single view.

Every incident comes with a client-ready, white-labeled PDF your clients can read at a glance — ready to send the same day no editing required.

Deploy across every client tenant in two clicks via Microsoft Partner Center, then manage them all from one console.

Run complimentary Petra Scans on prospects, and pitch with co-branded materials and an anonymized incident library.


Get Started
Get insurance-grade forensics for the last 6 months of your M365 logs, including past and active attacks, in 48 hours.
5-min setup · 48-hour turnaround
Switched from Huntress
“I think a lot of people are in the same position that we were——they just don't know what's really happening until all the forensic analysis is done.”
David Xiong
M-Cubed
7
Attackers Huntress missed
Switched from Huntress
“Not only did it catch those 4 attacks our prior ITDR whiffed on, it's also really fast and intuitive for getting logs and reporting on incidents.”
Alex Appleton
Compu-SOLVE Technologies
4
Residential proxy attacks caught
Switched from Huntress
“Even if [other ITDRs] build all these features, they're still missing attacks. The most important thing is detection. That's why we switched to Petra.”
Anthony Birone
ElasticIT
5
Live incidents rivals missed
Switched from Huntress
“Nobody's catching the stuff that Petra does, at the speed they do, with the clarity they give.”
Jeff Wilson, CISO
Hansen Gress
2
ITDRs replaced
Switched from Huntress
“We moved to Petra for the Teams protection. We didn't expect day one to surface a six-month-old compromise our prior ITDR had been sitting on top of.”
Julian Gelfand
Always Beyond
6-mo
Residential proxy attack caught




Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Get insurance-grade forensics on the last 6 months of your M365 logs. Setup takes 5 minutes with results in 48 hours.