Custom Threat Models

Understand how Enterprise custom threat models let you define detection rules tailored to your application's threat surface.

Learn how to target nested JSONB fields like metadata.service or metadata.network_intelligence.is_vpn in your custom threat model conditions.

Complete reference for all condition operators: equals, contains, not_in, regex, exists, and numeric comparisons.

Ready-to-use Enterprise detection rules: compromised accounts, data exfiltration, SSH botnets, credential stuffing, and more.