What it detects
Nineteen named vendor formats, four layers.
Every parser is grounded in a named vendor's own documented log or API shape. There is no generic catch-all parser, so an unlisted vendor is not silently covered.
Network
6 formatsDNS query logs and HTTP/S proxy logs an operator exports
- BIND
- Infoblox
- Route 53 resolver
- Zscaler
- Netskope
- Squid
Endpoint
4 vendorsMDM and EDR inventory an operator pulls from their own tenant
- Microsoft Intune
- CrowdStrike Falcon
- SentinelOne
- Jamf Pro
Identity
3 providersOAuth grant and sign-in audit an operator pulls from their own directory
- Microsoft Entra ID
- Okta
- Google Workspace Admin
Application
6 platformsApplication audit logs an operator pulls from their own tenant
- Microsoft 365
- Google Workspace
- Slack
- Jira
- Salesforce
- GitHub
How it works
From a log export to a deduplicated inventory.
Collectors normalise vendor exports
Nineteen parsers, one per named vendor format, turn an operator-supplied log or API response into a normalised record. Every parser is bounded against oversized or malformed input, and an unsupported or unconfigured vendor simply yields nothing rather than a guess.
Correlation fuses observations into one inventory
The correlation engine groups observations by the most stable technical signals available: provider, a normalised user-agent, and destination host. The actor is deliberately excluded from the correlation key, so the same agent seen from two layers dedupes into one entry, keyed on the agent, never the person.
Trend dashboard tracks change over time
A per-tenant series of new-versus-cumulative counts, broken down by layer, risk, and provider, built entirely from fields already persisted on the discovered-agent record. It reports what was discovered, not a projection: an empty inventory yields an honest empty series, and a first-seen agent inside a configurable window surfaces as a new-tool alert.
Community signatures, fail-closed
An operator can submit a candidate signature for a provider, framework, or extension the shipped feed does not yet cover. It runs through the same validator as the feed updater (size and count caps, ReDoS-safe pattern checks, anchored host patterns) and, if it passes, sits quarantined until a maintainer promotes it. Nothing a candidate submits is live until that explicit step.
Honest limits
What Discovery is not.
Discovery reflects only what an operator feeds it.
There is no live capture and no standing access to any vendor. Every parser turns an export, log, or API response the operator already pulled from their own tenant into a normalised record. An unconnected vendor, or a layer nobody has fed a log into, yields nothing, not a gap flagged as a false negative.
No live vendor OAuth pull.
Vortalis holds no standing credential to Intune, Entra, Microsoft 365, or any other named vendor. Where a connector supports pulling directly from a configured base URL, it does so with a bearer token the operator supplies for their own tenant, on request, not a persistent OAuth grant Vortalis manages. The primary path stays the same either way: the operator's own export, handed to the connector.
A factual record, not a forecast.
The trend dashboard reports when agents were first and last persisted. It does not extrapolate or project future growth. New-tool alerting looks backward over a configurable recent window; it never predicts what has not yet been observed.
Discovery detects the agent, not the person.
The correlation key is built from provider, user-agent, and destination host, and deliberately excludes the actor reference. A user reference is only ever carried alongside an observation when the tenant has separately opted into user resolution, which defaults off, and it never forms part of what groups two observations into one agent.
A DNS match is a weaker signal than a proxy match.
A DNS query log shows the host an agent resolved, not the request it made; a proxy log showing the actual request path is stronger evidence. Discovery carries this distinction through rather than reporting every network match at the same confidence. A local or offline model on a device that never resolves a known provider host, or that resolves through an unmonitored resolver, is invisible to the network layer.
Discovery is included from the Professional tier up. See what it finds against your own logs before talking to us about the rest of the platform.