Anomaly detection
Real-time rules that flag unusual session behaviour; tune detectors and allow-lists and review what fired.
Where:
/security/anomalyUsing the page
“Real-time heuristics and an ML second pass that flag unusual session behaviour. Tune the rules below; triggered alerts surface in the Alerts page and on each session timeline.”
Control
What it does
Detectors
Switch individual detectors on or off.
Allow-lists
Add trusted items to the Process allow-list (e.g.
powershell.exe Get-Process) and the Registry allow-list (e.g. HKLM\Software\Vendor\Component) with Add; remove with the × next to each.Recent anomalies
When, Detector, Severity (Critical, Warning, Info), Session, Message.
Related help
Sessions and session history
Every remote session on record, with its event timeline, risk score, notes and AI summary.
Alerts
Monitoring alerts from your computers (offline, high CPU, low disk, security warnings): acknowledge and resolve them.
Security Policy
Workspace-wide guardrails for sessions: clipboard, approval, who may connect by code, screen frame, direct connections, idle timeout, watermark, and network access rules.