DriftSentinel

DriftSentinel is a web app (with lightweight endpoint/agent optional) that detects “quiet” compromises by watching for behavior drift rather than known signatures. It ingests identity, SaaS, cloud audit, and endpoint telemetry, then builds baselines per user/service account/workload. When an attacker slowly changes tactics—new OAuth scopes, unusual API call sequences, atypical data access paths, or privilege creep—the app flags the drift and explains what changed in plain language. It focuses on high-signal detections that small security teams can actually investigate: suspicious consent grants, impossible travel paired with token reuse, anomalous admin actions, and data exfil patterns that evade DLP. The product ships with a guided triage view that ties events into one incident timeline and suggests containment steps (disable token, revoke sessions, rotate keys). It’s a combination traditional + AI app: rules for reliability, AI for summarization and clustering.