Centeye Gatewatch™ — identity threat detection & response, first-class on Microsoft and Google.

Account takeover detection from live provider signals

Centeye consumes the identity providers’ own event streams and calls the takeover from the signals that carry it:

• Risky sign-ins & impossible travel — a login from two countries an hour apart, a token used from the wrong device, a pattern that breaks the user’s established history.
• MFA-fatigue detection — repeated push-prompt bombardment engineered to extract a tired “approve.”
• Session hijacking & token-theft (AiTM) signals — replay and adversary-in-the-middle indicators read from the identity provider.
• Malicious inbox rules — the forwarding and delete rules attackers plant for persistence and fraud cover.
• Rogue OAuth app detection — third-party grants quietly given access to mail and files: the persistence layer of a modern takeover.
• Credential exposure — monitoring for leaked and infostealer-harvested credentials tied to the tenant.

live IdP streams · Entra ID + Google Workspace

Both identity providers, first-class

Most identity tools are Microsoft-first with Google bolted on — or absent. Centeye treats Microsoft Entra ID and Google Workspace as equal citizens: the same detections, the same response verbs, the same console. For a provider with a mixed client book, that is the difference between operating one product and two.

Response that ends the takeover — and proves it

Alerts do not evict an attacker; response verbs do. Centeye executes them within your policy, then re-reads the identity provider itself to verify the session is gone and the door is shut.

• Revoke all sessions — evict stolen tokens everywhere at once.
• Compromised-user lockout — disable or suspend the account.
• Forced password reset — automated, as a response action.
• MFA method reset — remove the authenticator the attacker enrolled.
• Conditional access / geo-fence policy — fence a compromised account to safe locations immediately (Entra ID).
• Temporary admin-role removal — de-escalate a compromised administrator (Google Workspace).

stage → approve → execute → verify · provider re-read