How is CDR different from the threat tools built into each cloud?

A cloud's own tool sees that cloud. Onam CDR applies the same detection levels and the same four attack-sequence shapes across seven clouds' audit logs, and every detection is joined to the posture and identity graph — so a suspicious call arrives already linked to the identity that made it and what that identity can reach.

How do the three detection levels differ?

Level 1 judges one event at a time. Level 2 looks for a pattern across several events inside a time window. Level 3 compares an identity's behaviour with its own learned baseline. Each catches what the one before it cannot: a careful attacker avoids single loud actions, and a new technique matches no written pattern.

Does CDR require us to change our log retention settings?

No. CDR reads the logs where they already are and keeps its own detection state; your retention stays as it is. Longer history gives the behaviour baselines more to learn from.

CDR — Cloud Detection & Response

Is an attacker operating inside your cloud environment right now?

Credentials get stolen. What matters is what they are used for next.

Onam CDR reads your cloud audit logs and finds attacker behaviour in them — single suspicious events, multi-step sequences and identities acting unlike themselves — mapped to MITRE ATT&CK and joined to your posture and identity graph so every detection arrives with context.

See it in my cloud Read the docs

9,853

posture rules

cloud providers

549

cloud services

compliance frameworks

Why it matters How it works What you get See it live FAQ

Why this matters

An access key ends up in a public code repo.

On their own, the calls that follow look ordinary: an identity check, a bucket listing, a role lookup, a copy to somewhere new. A log tool that judges each event alone sees nothing worth raising. The story only appears when the events are read as a sequence and set against what that identity can reach — and that is the part a posture tool and a log archive each miss on their own.

The risk of not knowing

If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.

Re-checked on every scan, not once a quarter

How does it actually work?

The mechanism, not the marketing

1
Onam reads the audit logs your clouds already produce — CloudTrail on AWS, Activity Log on Azure, Cloud Audit Logs on Google Cloud, OCI Audit, ActionTrail on Alibaba Cloud, Activity Tracker on IBM Cloud, and Kubernetes audit logs — through the same cloud connection as the rest of the platform.
2
Level 1 detection rules judge single events: an action that is suspicious on its own, such as disabling logging or creating access keys for another user.
3
Level 2 correlation scenarios match patterns across several events within a time window — the shape of an attack that no single event shows.
4
Level 3 behaviour baselines learn what is normal for each identity and flag a statistical departure from it, so an identity acting unlike itself is raised even when no rule names the action.
5
A sequence detector looks for four attack shapes in every supported cloud's own vocabulary: data exfiltration, identity pivot, secrets staging and compute hijack.
6
Detections are mapped to MITRE ATT&CK, written to the platform's alerts, and joined to posture and identity context from the Onam graph — a confirmed exfiltration path is fed back to the resource's security posture.

What do you actually get?

Specific outputs, measurable outcomes

Single-event detection rules over cloud audit logs

Multi-event correlation scenarios within a time window

Per-identity behaviour baselines and anomaly detection

Attack-sequence detection

exfiltration, identity pivot, secrets staging, compute hijack

MITRE ATT&CK mapping on detections

Posture and identity context on every detection

Coverage across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, IBM Cloud and Kubernetes audit logs

Detections in the same alerts view as the rest of Onam Security

See it live

CDR — Cloud Detection & Response in the real console.

A recreation of the Onam console with sample data — the screens and finding types your team works with.

ONAMSecurity

Dashboard

Assets

Cloud Resources

Attack Paths

Paths · ATT&CK

Vulnerabilities

VM · CVE · SBOM

Risk

FAIR Model

Compliance

CIS · NIST · HIPAA

Cloud posture

Cloud Posture

CSPM · Alerts

Detection & data

CIEM

Identity & Entitlements

CDR

Detection & Response

CWPP

Workload Protection

Data Security

DSPM · Database

Platform

Reports

Onboarding

Providers · Users

Onam Admin

Security Admin

CDR — Detection & Response

4 Active Alerts2.3M events/hr

Last scan: 2 min agoConfigure Rules

2.3M

Events / Hour

Active Alerts

847

CloudTrail Events

Blocked IPs

TimeAlertMITRE TechniqueResourceSeverityStatus

Loading live data…

Detections correlated across events

2.3M events/hour distilled into 4 active alerts, mapped to MITRE ATT&CK

Clip length

11s

Data

Demo account

FAQ

Questions we get a lot

The audit logs each cloud already produces: AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs, OCI Audit, Alibaba Cloud ActionTrail, IBM Cloud Activity Tracker, and Kubernetes (including EKS) audit logs. CDR finds where those logs are stored in your account and reads them through the cloud connection you already set up.

Ready to see it live

Ready to see CDR — Cloud Detection & Response in your cloud?

Connect a read-only role in three minutes. Your first findings surface in under five.

Book a live demo →See pricing

Related capabilities

Attack Path Analysis Threat Detection CIEM — Identity Network Security