Saporo, Order in chaos

Change & Event Monitoring

See identity changes. Understand their impact.

Track identity changes and flagged events. Use attack and access paths, permissions and misconfigurations to assess impact and prioritize investigations.

Book a demoFree assessment
Log Events / Activity
Saporo Log Events activity over time, with flagged and not flagged events per hour, and activity by source for Domain Controller logs, AD directory changes and Microsoft Entra ID, in an example environment
Log Events / Overview
Saporo Log Events overview showing flagged events, unresolved log findings, high value targets involved, reachable high value targets and events observed, in an example environment

Know what changed, when and where

  • Active Directory
  • Domain Controller logs
  • Microsoft Entra ID
  • Azure
  • AWS CloudTrail
  • Google Workspace
  • Google Cloud

  • Track changes

    Follow account, permission, group membership and application credential changes.

  • See who was involved

    Inspect acting accounts and affected objects where recorded.

  • Check data freshness

    See when each source was last checked.

Saporo Log Events activity over time, with flagged and not flagged events per hour, and activity by source for Domain Controller logs, AD directory changes, Microsoft Entra ID, AWS CloudTrail, Azure resources, Google Workspace and Google Cloud, in an example environment
Log Events / ActivityExample environment and data.
Saporo Observed lifecycle events showing objects created, changed, and deleted in the selected period, the latest observed objects, and flagged lifecycle events with their recorded details, in an example environment
Log Events / Observed lifecycle eventsScroll sideways to see more. Example environment and data.

Prioritize flagged events by exposure

Use identity exposure and reachable critical assets to focus on the activity that deserves review.

Saporo Review priorities panel listing unresolved log findings grouped by matched control and ordered by impact, including NTLMv1 authentication, membership changes in admin groups, permissions changed at the domain root, and a high-risk sign-in reported by Microsoft, in an example environment
Log Events / Review prioritiesExample environment and data.

  • Flagged activity

    See which of 85+ built-in log controls flagged an event and why, then open the supporting evidence.

  • Reachability and blast radius

    Prioritize identities that can reach critical assets and enable wider attacker movement.

  • Native Microsoft risk signals

    Review Microsoft-detected risky sign-ins with identity exposure context.

Active Directory event

Membership changed on an AD group which has Admin rights

Log EventActive Directory

Affected identity

JORDAN.HAYES

User

SAPORO.LOCAL

Impact
Critical
Attack opportunity
8.5 /10

Security context

  • Permissions
  • Attack paths
  • Misconfigurations
Saporo Explore graph showing how a standard user can reach Domain Admins through group membership, local admin access to a server, a readable gMSA password, and ACL permissions, in an example environment

Explore / Attack paths to Domain AdminsExample environment and data.

Spend less time qualifying events

Search, reuse queries and inspect supporting evidence to assess urgency with less manual investigation.

Saporo event explorer listing logs with date, event name, node name, acting account, source, object type, flag status, severity, and reachable high value targets, with column filters, search, and CSV export, in an example environment
Log Events / EventsScroll sideways to see more. Example environment and data.
Saporo list of prewritten log queries by category, including to-review logs with reachable high value targets, application consent grants, PIM role assignments, user password resets by an admin, and NTLM audit events, in an example environment
Logs / Suggested queriesExample environment and data.

  • Prewritten queries

    Start with ready-made searches for common identity investigations.

  • Saved searches

    Save custom queries and rerun them whenever needed.

  • Evidence and follow-up

    Inspect properties and findings, add notes, create tickets and export results.

Put score changes in context

Connect score trends with findings and environment changes to investigate what may have contributed.

Saporo Overview dashboard with the Resistance Score over the last 30 days, Attack Path and Compliance score lines, event markers on the timeline, and a day summary listing objects changed, findings resolved, and objects deleted, in an example environment
Overview / Resistance Score over timeScroll sideways to see more. Example environment and data.

Connect your security tools

  • Enrich your SIEM

    Help your SOC prioritize investigations in its existing tools with findings and identity exposure context.

  • Bring in detection context

    Tag affected identities through API integrations, then assess their reachable assets and potential blast radius.

  • Kibana included

    Kibana is deployed by default alongside Elasticsearch for custom searches, dashboards and additional log integrations.

Data sources

Change & Event Monitoring Q&A

Questions about event monitoring

A flag marks potentially abnormal or security-relevant activity for review. Open the event to see the matched control, severity, recorded properties and related findings.

Yes, when the source records it. Domain Controller security logs complement AD directory change records with who performed the action.

Yes. Search and filter all collected events, not only flagged activity, to understand the context of a change.

Saporo links Microsoft-detected risky sign-ins to the identity’s exposure and reachable critical assets, so your team can weigh potential impact alongside Microsoft’s risk level.

Yes. Use prewritten queries, save your own searches and build dashboards in the included Kibana environment.

See what changed and what it puts at risk

Explore identity activity, investigate priority events and keep exposure under control.

Book a demo