The Security center
Alerts, detection rules, sessions, and the audit trail.
Security (admins only) watches your workspace for anomalies.
Notable events raises alerts from detection rules: repeated failed sign-ins, destructive actions, permission changes, impossible travel (sign-ins from two countries within hours), and more. Acknowledge or resolve each alert. triage state persists.
Search and investigate is a full-text view over the audit trail and login history, with severity facets and a time histogram.
Active sessions lists everyone signed in, with force sign-out. Login history records IP, country, and browser for every attempt.
Custom detection rules can match any activity pattern with a threshold and time window.
Rule templates. The New Rule form starts from templates (vault activity, data exports, member changes, settings changes, billing changes) so you can add a detection without writing regex. Keyword watch turns any plain keyword into a safe pattern for you, and Custom regex is still there for full control.
Behavioral detections are tunable. Impossible travel, failed sign-in bursts, many source IPs, locked accounts, and forced password resets are built in and on by default. You can now turn any of them off for your workspace from the Detection Rules panel. A burst of repeated failed sign-ins is grouped into a single alert per account per day instead of flooding the board.