Skip to main content
RAIDEN is a Microsoft 365 threat detection and response platform. It connects to your M365 tenant, continuously monitors your audit logs, and surfaces suspicious activity as actionable investigations — so you can identify and contain threats without needing a dedicated security operations team.

​
Key features

Continuous audit log monitoring — RAIDEN polls your Microsoft 365 unified audit log in real time, processing sign-in events, admin activity, mailbox changes, and more across your entire tenant. AI-generated investigation cases — Related alerts are automatically grouped into Cases. Each case includes an AI-generated investigation report that summarises all evidence, explains the risk, and recommends next steps in plain language. One-click response actions — When you confirm a threat, RAIDEN lets you act directly from the investigation: revoke sessions, disable a compromised account, delete malicious inbox rules, or create a Conditional Access block policy — without opening a separate admin portal. Severity-based alert triage — Every detection is assigned a severity level (Critical, High, Medium, Low, or Info) so you can prioritise what needs attention immediately versus what can wait. Team roles — Invite your team with role-based access. Owners and Admins manage the platform, Analysts investigate and respond, and Viewers have read-only access.

​
What you need to get started

  • A Microsoft 365 tenant
  • A Global Administrator account in that tenant (required once, for admin consent during setup)
  • Your RAIDEN invite link (sent by your RAIDEN onboarding contact)
The Global Administrator account is only needed during the initial connection step. Once RAIDEN is connected, day-to-day use does not require admin privileges.

​
Cases vs Alerts

RAIDEN surfaces findings in two layers:
TermWhat it is
AlertA single detection event — for example, one suspicious sign-in from an unusual location
CaseA group of related alerts for the same user, treated as one investigation
Start with Cases. Each case contains an AI-generated report that summarises all related alerts and their context. Individual alerts are the raw signals; cases are the investigations you actually work from.
RAIDEN is in early access. Features are fully functional but some UI polish is still in progress. If you hit anything unexpected, contact your RAIDEN onboarding contact directly or email support@raidenhq.com.