Security Monitoring · managed detection

Turn security logs into findings your team can investigate.

Send JSON events to Hanasand for authentication checks, suspicious-login findings, and analyst review.

Open cases View API docs

One endpoint

Send JSON events using an organization API key.

Useful first detections

Start with repeated failures, new countries, and geographically incompatible logins.

Evidence-first review

Inspect the matching events, rule ID, source context, and original event sample.

Send an event

POST https://api.hanasand.com/mill
Authorization: Bearer hsk_<organization-key>
Content-Type: application/json

{
  "events": [{
    "timestamp": "2026-08-03T08:15:00Z",
    "event_type": "authentication",
    "action": "login",
    "outcome": "success",
    "user": {"id": "user-123"},
    "source": {"ip": "203.0.113.10", "country": "NO"}
  }]
}

Security Monitoring scope

A working MDR starting point, not a generic log dump.

Security Monitoring is built on the existing Hanasand organization, API-key, tenant, and analyst process. The API keeps one stable endpoint while vendor adapters and broader rule families feed the same event model.

• Suspicious login findings
• Impossible-travel evidence
• organization-specific raw and normalized events
• Extensible path for Sigma and Hanasand rules