Petra Security vs
Blackpoint Cloud Response
Petra rebuilt detection from the ground up to catch the sophisticated M365 attacks that traditional ITDRs miss. Our behavioral models catch attacks faster, produce 5-20x fewer false positives, and automate the forensic reconstruction that used to take your team hours.




Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
See what's in your last
six months of logs.
Get insurance-grade forensics on the last 6 months of your M365 logs. Setup takes 5 minutes with results in 48 hours.