Data attack surface

ManySignal integrates with DLP tools (Microsoft Purview, Google Cloud DLP, Nightfall) and data catalogs (Collibra, Alation) to pull sensitivity classifications. Resources without classification labels are analyzed using pattern matching (PII patterns, financial data patterns) and content-based classification. Sensitivity tiers (public, internal, confidential, restricted) are used to weight access anomaly scores.

Yes. ManySignal monitors the staging behavior that precedes exfiltration: bulk data access significantly above baseline, compression of large datasets, unusual file format conversions, and data being moved to staging directories outside normal workflow patterns. These pre-exfiltration signals are typically detectable 10-60 minutes before data crosses the network perimeter.

ManySignal ingests CloudTrail (S3), GCP Audit Logs (GCS), and Azure Monitor (Blob) to monitor every object access, ACL change, bucket policy modification, and public access configuration change. Access patterns are baselined per bucket and per identity. GetObject, ListBucket, and PutBucketPolicy events by non-standard identities are flagged against the baseline.

Yes. ManySignal integrates with database activity monitoring solutions (Imperva, IBM Guardium) and cloud-native database audit logs (AWS RDS audit, Snowflake QUERY_HISTORY, BigQuery data access logs). Queries returning unexpectedly large result sets, queries executed by compromised credentials, and direct database access bypassing application tier are all monitored.

Data staging before ransomware encryption follows a detectable pattern: bulk recursive file system access, compression of large directory trees, unusual network upload volumes to cloud storage or external destinations. ManySignal's pre-exfiltration detection fires on these staging behaviors, enabling containment before the ransomware encryption payload executes. The typical staging-to-encryption window is 10–45 minutes — sufficient time for autonomous containment actions to interrupt the attack.

Yes. When an incident is classified as involving potential data exfiltration, ManySignal's Report agent generates a structured data impact assessment: what data types were accessed, which identities accessed them, what volume of data was involved, and the time window of access. This assessment forms the basis for Article 33 GDPR notifications, HIPAA breach reports, and SEC cybersecurity incident disclosures. The assessment is continuously updated as investigation reveals additional scope.

ManySignal ingests file access events from on-premises sources (Windows file server audit logs, NFS access logs, SharePoint on-premises audit) and cloud storage simultaneously. Both sets of access events are correlated in the entity graph against the same user identity and behavioral baseline. An anomaly that crosses environments — accessing an on-premises file server and then a cloud storage bucket in the same session — is detected as a compound finding even though the events come from separate systems.

ManySignal processes log events and access metadata — not the content of protected data files. Log events are stored in the configured data residency region (US, EU, or APAC) for the customer account. No document content, database record content, or personal data from monitored storage is transmitted to ManySignal infrastructure. The DPA is available for review and specifies exactly what data is processed and where.