Plain-Language Alerts

Alerts written for IT teams,not security analysts.

Every IntelliThreat alert tells you what happened, what’s affected, and exactly how to fix it — in plain English. No interpretation layer, no security jargon, no SOC required.

What happened
What’s affected
How to fix it

Start a 30-Day Free Trial Request a Demo

Request a Demo

See IntelliThreat translate real telemetry into plain-language alerts your team can act on.

Or start your 30-day free trial — no credit card required.

Raw Telemetry vs. Plain Language

The same event. Two very different workflows.

Traditional tools hand you raw telemetry and wish you luck. IntelliThreat hands you a decision that’s already been made — explained in language anyone on your team can act on. Browse six real examples — swipe, or use the dots below.

Mailbox permission abuse

Manual triage & response~35 min

IntelliThreat AI8 sec

~35 min saved per alert

A Typical Raw Alert

{"CreationTime":"2026-05-12T03:14:22Z","Operation":"Add-MailboxPermission","ResultStatus":"Succeeded","UserKey":"svc-backup@contoso.com","ObjectId":"cfo@contoso.com","Parameters":[{"Name":"AccessRights","Value":"FullAccess"}]}

Severity: Medium · Source: UnifiedAuditLog

Now translate it, decide whether it matters, and figure out what to do.

The Same Event — IntelliThreat AI

Suspicious mailbox permission — contained

Contained automatically · 3:14 AM

What happened

At 3:14 AM, the service account svc-backup granted itself full access to your CFO’s mailbox. This account has never modified a mailbox permission before — a common precursor to email fraud.

Impact

One executive mailbox exposed. No mail was forwarded or read.

What we did

The permission was reverted and the account’s sessions were revoked under your containment threshold.

Your next step

Confirm with your backup vendor whether this change was expected. One click restores it if so.

Manual triage & response~50 min

IntelliThreat AI11 sec

~50 min saved per alert

A Typical Raw Alert

{"CreationTime":"2026-05-14T23:52:09Z","Operation":"New-InboxRule","ResultStatus":"Succeeded","UserId":"d.alvarez@contoso.com","Parameters":[{"Name":"ForwardTo","Value":"smtp:archive-sync@mail-relay.io"},{"Name":"DeleteMessage","Value":"True"}]}

Severity: Low · Source: Exchange Audit

A “low severity” line item — buried under 400 others that day.

The Same Event — IntelliThreat AI

Hidden forwarding rule — removed

Contained automatically · 11:52 PM

What happened

A new inbox rule on d.alvarez began silently forwarding every incoming email to an external relay, then deleting the copies — the classic setup for invoice fraud.

Impact

The rule was live for 4 minutes. Two messages left the tenant; both are listed in this alert.

What we did

The rule was deleted and the account’s sessions were revoked while sign-in risk was evaluated.

Your next step

Reset the user’s password and review the two forwarded messages, linked below.

Manual triage & response~45 min

IntelliThreat AI9 sec

~45 min saved per alert

A Typical Raw Alert

{"CreationTime":"2026-05-18T09:07:44Z","Operation":"Consent to application.","ObjectId":"d6f41a8e-22c4-4b09-9f1c-3a7be2d11e90","ExtendedProperties":[{"Name":"additionalDetails","Value":"{AppId:4b1a9c02, Permissions:Mail.ReadWrite offline_access}"}]}

Severity: Medium · Source: Entra ID Audit

Which app? Granted by whom? Is Mail.ReadWrite normal here? The log won’t tell you.

The Same Event — IntelliThreat AI

Risky OAuth app consent — revoked

Contained automatically · 9:07 AM

What happened

An app called “PDF Converter Pro” was granted rights to read and send mail after a phishing prompt. It was registered three days ago in a foreign tenant — a hallmark of consent-phishing campaigns.

Impact

Consent granted by one user. No mail was accessed before revocation.

What we did

The app’s consent was revoked tenant-wide and the granting user’s sessions were closed.

Your next step

Warn the user about the phishing email that triggered the prompt — a copy is attached to this alert.

Manual triage & response~30 min

IntelliThreat AI6 sec

~30 min saved per alert

A Typical Raw Alert

{"CreationTime":"2026-05-21T02:41:18Z","Operation":"UserLoggedIn","ResultStatus":"Succeeded","ClientIP":"185.220.101.42","UserId":"k.osei@contoso.com","DeviceProperties":[{"Name":"OS","Value":"Windows 10"}]}

Severity: Medium · Source: Entra Sign-in Logs

A successful login. Looks fine — unless you know where 185.220.101.42 is.

The Same Event — IntelliThreat AI

Impossible travel sign-in — account isolated

Contained automatically · 2:41 AM

What happened

k.osei signed in from an anonymizing exit node 19 minutes after a legitimate sign-in from Chicago — and the new session immediately tried to register a new MFA device.

Impact

One account compromised. The attacker never reached mailbox data.

What we did

Authentication was disabled, all sessions revoked, and the rogue MFA registration blocked under your containment threshold.

Your next step

Verify with the user, then re-enable sign-in with one click.

Manual triage & response~60 min

IntelliThreat AI14 sec

~60 min saved per alert

A Typical Raw Alert

{"CreationTime":"2026-05-26T17:18:02Z","Operation":"FileDownloaded","SourceFileName":"Q2_Pipeline_Master.xlsx","SiteUrl":"/sites/sales","UserId":"m.reyes@contoso.com"}

× 312 similar events in 11 minutes · Severity: Informational

312 separate “informational” events. No single one looks like a problem.

The Same Event — IntelliThreat AI

Unusual mass download — access tightened

Flagged for review · 5:18 PM

What happened

An account that normally touches 6 files a day downloaded 312 files in 11 minutes from the Sales SharePoint.

Impact

Files include pipeline and pricing documents; a full manifest is attached.

What we did

Sharing was frozen on the affected library and an audit report generated. No containment threshold was crossed, so the account remains active.

Your next step

Review the manifest with HR and management before deciding on access changes.

Manual triage & response~90 min

IntelliThreat AI7 sec

~90 min saved per alert

A Typical Raw Alert

{"CreationTime":"2026-06-02T06:03:51Z","Operation":"FileModified","ObjectId":"/personal/j_park/Documents/budget.xlsx.lkd","UserId":"j.park@contoso.com","ClientAppName":"OneDrive Sync"}

× 1,400 renames in 4 minutes · Severity: High

By the time a human reads this, the encryption is already finished.

The Same Event — IntelliThreat AI

Ransomware pattern in OneDrive — stopped

Contained automatically · 6:03 AM

What happened

A synced laptop began renaming files to an unknown extension at machine speed — 1,400 files in 4 minutes, the signature of ransomware encrypting through the OneDrive client.

Impact

Encryption was limited to one user’s sync folder; no shared libraries were affected.

What we did

The account’s sessions were revoked, sync was blocked, and a clean restore point was identified for one-click recovery.

Your next step

Isolate the laptop from the network, then run the guided file restore.

Anatomy Of An Alert

Every alert includes three things.

Root Cause Analysis

What happened and why — in plain English, with the reasoning behind the detection.

Impact Assessment

What data, users, or systems may be affected — so you know how urgent it really is.

Step-by-Step Remediation

Clear instructions your IT team can follow immediately — no escalation needed.

Built For Your Team

Designed for IT teams, not just security analysts.

Unlike traditional security tools that require specialized expertise, IntelliThreat AI™ is explicitly designed so your existing IT team can run security operations.

No SOC required — standalone security without a dedicated security operations center.
Immediately actionable — every alert ships with remediation guidance built in.
No interpretation delay — act directly instead of waiting for an analyst to translate.
Readable from day one — deploys in minutes, with no configuration or training.

Why It Matters

Plain-language alerting eliminates the need for security analysts to interpret technical alerts — your IT team acts directly.

Alerts written for IT teams,not security analysts.

The same event. Two very different workflows.

Every alert includes three things.

Root Cause Analysis

Impact Assessment

Step-by-Step Remediation

Designed for IT teams, not just security analysts.

Your download is ready