Platform
What ITP Contributes to the Platform
No analyst receives an identity alert that has not already been cross-referenced against what the endpoint, DNS, exposure and response layers know.
One engine
Every identity verdict correlated before an analyst sees it
Six paths, not thirty
Routing every verdict through the engine instead of product to product
Two directions
Verdicts out to the engine, detection outcomes back into identity risk
The fragmentation problem
An identity capability delivered as another console makes a fragmented operation worse, because it adds a schema, a queue and a false-positive rate to an environment already unable to reconcile the ones it has.
Correlation belongs in one place, not in six. A platform in which each product enriches each other product has thirty integration paths to maintain and no single point at which an incident is known to be complete. Routing every verdict through the engine reduces that to six.
| Condition | What it is |
|---|---|
| Siloed tools | Each product raises its own alerts in its own console, with its own schema and its own false-positive rate, and no awareness of what the others are seeing. |
| Alert overload | The volume itself becomes the vulnerability, because the one alert that mattered is indistinguishable from the many that did not. |
| Manual correlation | When an identity event, an endpoint event, a DNS verdict and an exposure finding all belong to one incident, joining them means reconciling four consoles, four schemas and four timelines by hand, which scales with neither alert volume nor tenant count. |
ITP addresses all three by the same mechanism. Correlation happens once, inside the engine, before anything reaches a queue, so many alerts arrive as one incident and a reconciliation task measured in analyst hours finishes before an analyst opens it.
For the analyst, a detection that reads suspicious PowerShell executed on a server arrives instead as suspicious PowerShell run by a help-desk account at two in the morning, against a server it has never touched, hours after it authenticated from a host confirmed compromised. The first begins an investigation. The second begins a response.
What each layer contributes
The AI-SecOps Autonomous Analysts are the exception to the table below, because their contribution is made after correlation rather than as a signal into it, and it is described on How it works.
The integration is bidirectional
ITP to the engine. Authentication events, behavioral risk scores, privileged-access activity, identity-attack detections and posture findings flow in two roles: as enrichment they annotate detections raised elsewhere with the account, its privilege and its recent access; as detections in their own right they enter the incident queue.
The engine to ITP. Detection observations, threat intelligence matches and incident outcomes flow back and adjust the identity risk state.
The loop closes there. A single identity event is corroborated by every other layer, and the outcome of that corroboration sharpens the layers that produced it, so accuracy improves as a function of the platform being used rather than of rule maintenance by the customer or the provider.
Professional Services
Onboarding and scoping
Authorizing identity sources and establishing the protected directory user scope, connecting directories and identity providers, and setting baseline detection and enforcement policy per tenant.
Integration
Connecting ITP to the TDIR engine and the wider platform, and to the customer’s own SIEM, response automation and collaboration tooling.
Pilot and rollout
A bounded initial scope, typically one directory and a defined identity population, run through baseline learning and into live detection so tuning is done against the customer’s own data.
Enablement and training
Role-based tracks for analysts and administrators covering the risk-band model, behavioral baselining, identity-centric response and the reporting workflow.
Ongoing optimization
Periodic review of detection effectiveness, false-positive rates, posture trend and service-level performance as the identity population and the threat landscape change.
A capability handed over unconfigured protects nothing, and identity defense depends on decisions the customer must make about scope, policy and enforcement. ITP is delivered with a professional-services wrap that takes an organization to governed, effective coverage rather than to an activated license.
Attackers no longer break in. They log in.
Every verdict reaches the TDIR engine and is correlated there, and the detection outcomes come back and adjust the identity risk state.
Request a Demo