How is CDR different from AWS GuardDuty or Microsoft Defender?

Native tools only see their own cloud and produce alerts without posture context. Onam CDR ingests their findings as one of many signals, adds cross-cloud behavioural and ML detection, and enriches every alert with identity, network, and data context — so a GuardDuty signal about a suspicious API call arrives already correlated to the specific identity and the assets it can reach.

What is the latency from event to alert?

Typically under two minutes from log emission to alert delivery for L1 and L2 detection. L3 ML detection runs on rolling windows and can surface novel patterns within 5–15 minutes depending on event volume.

Does CDR require us to change our log retention settings?

No. CDR reads logs at ingest and stores its own detection state; you keep your existing retention. Onam recommends at least 90 days of CloudTrail for baseline construction, but detection works with whatever retention you have.

CDR — Cloud Detection & Response

Is an attacker operating inside your cloud environment right now?

By the time a SIEM fires an alert, the attacker has already moved. CDR closes the gap.

Q: What log sources does CDR consume?

AWS CloudTrail (management and data events), VPC Flow Logs, GuardDuty findings, Azure Activity Log and Entra ID sign-in logs, GCP Cloud Audit Logs, Kubernetes audit logs, and container runtime events. All ingested via read-only integrations.

Onam CDR runs continuous three-tier behavioral analysis over your cloud audit logs — detecting everything from known attack patterns to novel techniques no signature has seen, and correlating every finding with your posture and identity graph for instant context.

See it in my cloud Read the docs

10,000+

security rules

cloud providers

< 5 min

to first finding

100%

agentless

Why it matters How it works What you get See it live FAQ

Why this matters

An access key ends up in a public code repo.

The SIEM ingests CloudTrail on a 15-minute batch. By the time the correlation rule fires, an attacker has already listed every bucket, enumerated your IAM policies, and started staging data in a scratch account. Ninety percent of cloud breaches involve valid credentials — traditional log tools were not built for that speed or shape.

The risk of not knowing

If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.

Real-time detection, not periodic audits

How does it actually work?

The mechanism, not the marketing

1
Onam streams cloud audit logs — CloudTrail, VPC Flow, Azure Activity Log, GCP Cloud Audit, Kubernetes audit — in near real time, no external SIEM required.
2
L1 rule-based detection matches 200+ known-bad signatures aligned to MITRE ATT&CK for Cloud, covering credential abuse, persistence, exfiltration and defense evasion.
3
L2 behavioural analysis maintains 30-day per-entity baselines, so an identity behaving unlike itself (new region, new API, off-hours) fires an anomaly even without a rule.
4
L3 unsupervised ML surfaces novel techniques by clustering rare event sequences that never match known signatures — the class of threat traditional detection misses entirely.
5
Every alert is auto-enriched with posture, identity, and network context from the Onam graph and routed to Slack, PagerDuty, or email with response playbooks attached.

What do you actually get?

Specific outputs, measurable outcomes

L1 rule-based detection

200+ known-bad signatures across CloudTrail, VPC Flow, and K8s audit logs

L2 statistical behavioral baselines

per-entity anomaly detection over 30-day windows

L3 ML anomaly detection

novel threats with no prior signature

MITRE ATT&CK for Cloud mapping

Posture + identity enrichment on every alert

Incident correlation into unified incidents

Real-time alerting

Slack, PagerDuty, email with full context

Response playbooks

quarantine, revoke, block

See it live

CDR — Cloud Detection & Response in the real console.

Not a mockup — the actual Onam console on a live demo account, showing exactly what your team sees.

ONAMSecurity

Dashboard

Assets

Cloud Resources

Attack Paths

Paths · ATT&CK

Vulnerabilities

VM · CVE · SBOM

Risk

FAIR Model

Compliance

CIS · NIST · HIPAA

Cloud posture

Cloud Posture

CSPM · Alerts

Detection & data

CIEM

Identity & Entitlements

CDR

Detection & Response

CWPP

Workload Protection

Data Security

DSPM · Database

Platform

Reports

Onboarding

Providers · Users

Anup Yadav

Security Admin

CDR — Detection & Response

4 Active AlertsLive · 2.3M events/hr

Last scan: 2 min agoConfigure Rules

2.3M

Events / Hour

Active Alerts

847

CloudTrail Events

Blocked IPs

TimeAlertMITRE TechniqueResourceSeverityStatus

Loading live data…

Detections correlated in real time

2.3M events/hour distilled into 4 active alerts, mapped to MITRE ATT&CK

Clip length

11s

Data

Demo account

FAQ

Questions we get a lot

AWS CloudTrail (management and data events), VPC Flow Logs, GuardDuty findings, Azure Activity Log and Entra ID sign-in logs, GCP Cloud Audit Logs, Kubernetes audit logs, and container runtime events. All ingested via read-only integrations.

Ready to see it live

Ready to see CDR — Cloud Detection & Response in your cloud?

Connect a read-only role in three minutes. Your first findings surface in under five.

Book a live demo →See pricing

Related capabilities

Attack Path Analysis Threat Detection CIEM — Identity Network Security