Two minutes to set up, 24 hours to see value.
Petra is API-only with no agent deployment. You're integrated in two minutes and seeing real detections within 24 hours.


Resellers choose Petra for behavioral ITDR, with rapid time-to-value and partner enablement built in.
“Petra is a generation ahead of anybody else in M365 security.”


Get Started
Get insurance-grade forensics for the last 6 months of your M365 logs, including past and active attacks, in 48 hours.
5-min setup · 48-hour turnaround
Petra is API-only with no agent deployment. You're integrated in two minutes and seeing real detections within 24 hours.
Petra rebuilt detection from the ground up to catch more attacks, faster, and with less noise. Our behavioral detection models analyze 30x more data than location-first ITDRs.
We provide co-branded materials, partner portal access, and an anonymized incident library you can use in every pitch.
We're built exclusively for the channel, with partner economics and co-sell support. We serve over 400 channel partners today.

Petra surfaces the sophisticated modern attacks that other tools miss, in real time and with almost no false positives.

We remediate M365 compromises end-to-end and automatically resolve every incident. Get hours back every week.

Every incident produces a client-ready forensic report: root cause, attacker timeline, and every action taken.




Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Attack Impact
The attacker had access to the account for 3 minutes. Microsoft logging was delayed by 2 minutes. The attack was caught 5 seconds after Microsoft published audit logs, and was contained 1 second later. The attacker was removed before they could do any damage.
During this time, the attacker:
Accessed
0 emails
0 documents
Sent
0 emails
0 documents
Modified
0 emails
0 documents
Deleted
0 emails
0 documents
User Details
UPN:
askywalker@acmecorp.com
Mail:
askywalker@acmecorp.com
Created:
1/8/2023, 12:31:31 PM
Title:
AP Manager
Dept:
Accounts Payable
Location:
San Francisco, California, United States
No authentication methods found
Activity
Refresh
Export
1/5/26 - 2/8/26
Activity Type
Timestamp
Attacker Action
Attacker Target
IP Address
ISP
City
Region
Country
2026-02-04 11:57:09 AM PST
officehome
latitude.sh
buffalo
ny
united states
2026-02-04 12:31:59 PM PST
officehome
routerhosting llc
buffalo
ny
united states
2026-02-04 12:32:36 PM PST
officehome
datacamp limited
buffalo
ny
united states
2026-02-04 12:32:46 PM PST
officehome
psychz networks
buffalo
ny
united states
2026-02-04 01:52:03 PM PST
office 365 exchange online
latitude.sh
frankfurt am main
he
germany
2026-02-04 01:53:01 PM PST
officehome
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:02 PM PST
officehome
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:14 PM PST
office 365 exchange online
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:53:33 PM PST
ACH Remittance Advice – Payment ID #2389172
latitude.sh
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
routerhosting llc
limburg an der lahn
he
germany
2026-02-04 01:53:34 PM PST
ACH Remittance Advice – Payment ID #2389172
datacamp limited
limburg an der lahn
he
germany
2026-02-04 01:54:21 PM PST
Outlook Rules Organizer
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:31 PM PST
my profile
psychz networks
limburg an der lahn
he
germany
2026-02-04 01:54:45 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Decentralized user-facing synergy
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:02:40 PM PST
Invoice and PO Confirmation for March Services
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:04:21 PM PST
my signins
latitude.sh
limburg an der lahn
he
germany
2026-02-04 02:06:05 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:06:06 PM PST
latitude.sh
buffalo
he
germany
2026-02-04 02:11:43 PM PST
RE: Finalized Q1 2025 Statements Attached
routerhosting llc
buffalo
he
germany
2026-02-04 02:11:44 PM PST
RE: Finalized Q1 2025 Statements Attached
datacamp limited
buffalo
he
germany
Get insurance-grade forensics on the last 6 months of your M365 logs. Setup takes 5 minutes with results in 48 hours.