VigilanceDiscuss Vigilance

Operational visibility

Identity and access monitoring

Collect and correlate identity, access, application and trust signals so meaningful change becomes visible.

Discuss VigilanceExplore the detail ↓

Signal path

Collection only matters when action follows.

From signal to responseSignals are ingested, normalised and correlated before detections create alerts. Actionable alerts become owned incidents, responses and learning. Alert and incident are distinct stages.01SIGNALSIdentity · access · trust02INGESTGoverned collection03NORMALISEConsistent entities04CORRELATERelated activity05DETECTTested analytics06ALERTCondition to assess07INCIDENTOwner + severity08RESPONDContain + remediate09LEARNTune + assureFrom signal to responseSignals are ingested, normalised and correlated before detections create alerts. Actionable alerts become owned incidents, responses and learning. Alert and incident are distinct stages.01SIGNALSIdentity · access · trust02INGESTGoverned collection03NORMALISEConsistent entities04CORRELATERelated activity05DETECTTested analytics06ALERTCondition to assess07INCIDENTOwner + severity08RESPONDContain + remediate09LEARNTune + assure
An alert describes a condition requiring assessment. An incident is an owned investigation with severity and a response path.
Continuous assurance over delegated authorityDelegation, scope, approval, expiry, revocation and policy conflict events can feed Vigilance detection and assurance when the implemented integration provides them.SOURCES / PATTERNSCONTROLOUTCOMESDELEGATIONSCOPE CHANGEAPPROVALEXPIRYREVOCATIONPOLICY CONFLICTVIGILANCEAuthority contextCorrelate + assessDETECTIONASSURANCEContinuous assurance over delegated authorityDelegation, scope, approval, expiry, revocation and policy conflict events can feed Vigilance detection and assurance when the implemented integration provides them.SOURCES / PATTERNSDELEGATIONSCOPE CHANGEAPPROVALEXPIRYREVOCATIONPOLICY CONFLICTVIGILANCEAuthority contextCorrelate + assessOUTCOMESDETECTIONASSURANCE
Availability depends on the Delegance control surface and monitoring integration implemented for the environment.
01

More logs are not the outcome

Organisations often hold extensive telemetry without a clear model for ownership, correlation or action. Vigilance starts with the risk and control question, then identifies the signals needed to answer it.

02

Identity and access coverage

Potential sources include Microsoft Entra events, directories, privileged access, application administration, entitlement changes, identity recovery, custom systems and external-party activity.

03

Delegance monitoring

A Delegance environment can emit signals for new or high-risk delegation, expiry, revocation, privilege escalation, failed approval patterns, separation-of-duties conflicts and action outside expected scope. Availability depends on the implemented integration.

04

Continuous assurance

Coverage, signal quality, recurring exceptions, unresolved incidents and weakly observed systems become inputs to governance—not merely technical dashboard statistics.

Apply the model

Make the signal actionable.

Start with the risk, available telemetry, accountable owner and proportionate response.

Talk to MAITS →