The AI architecture behind workflow-aware detection.

Detection quality is bounded by data quality. Ordrani ingests workflow events from GitHub and API activity from AWS CloudTrail through read-only integrations, then validates each record against a schema, removes duplicates and orders events by when they occurred rather than when they arrived.

Audit sources deliver events late and out of order; cloud trails can lag by minutes. The pipeline is designed around event-time processing with tolerance for late arrivals, so that sequences are reconstructed in the order they actually happened.

Coverage depends on configuration. CloudTrail data events such as object-level storage access are not captured by default and carry additional cost; GitHub audit coverage varies by plan and access method. Ordrani reports what each customer’s sources can and cannot see, rather than implying complete visibility.

The same machine identity appears under different names in different systems: a role ARN in IAM, an assumed-role session in CloudTrail, a subject claim in a federated token, a workflow reference in source control. Identity resolution reconciles these into a single canonical identity with a complete history.

Each resolved identity carries a profile: its configuration and trust relationships, its federation paths, its observed behavior and the context in which it normally operates. Profiles are the unit against which every later judgement is made.

Ordrani’s detection is a stack of specialized AI models, each built for one kind of judgement. Learned baselines and outlier models capture deviation from an identity’s norm, sequence models capture changes in the order of behavior, and deterministic rules anchor the stack on operations known to be dangerous.

Automation is a favorable subject for behavioral modeling: a deployment role tends to do the same things, in the same order, on the same schedule. That regularity makes deviations meaningful — provided the models understand legitimate change.

Baselines are therefore release-aware. Approved deployments, infrastructure changes and maintenance windows are treated as context that can explain a deviation, and models re-learn after verified change rather than reporting it indefinitely.

When a GitHub Actions workflow authenticates to AWS through OpenID Connect, the token it presents carries claims describing the repository, ref, environment and workflow. CloudTrail records the resulting role assumption. Together these establish that a given session was created on behalf of a given workflow.

Establishing which job — and which subsequent API call — belongs to which run is harder. Session naming conventions, source identity and session tags, and lightweight deployment instrumentation can each strengthen the link. Where none is available, the platform falls back to correlation and says so.

Ordrani does not assume every cloud action can be attributed to a particular job. It measures attribution coverage directly — the proportion of relevant activity reliably linked to an execution — and treats improving that figure as a core engineering objective.

Individual anomalies are common and usually benign. What distinguishes an intrusion is a progression: reconnaissance followed by privilege change, followed by access to something valuable — often spread across systems and minutes or hours apart.

Sequence Reasoning evaluates connected events within shared identities, sessions and time windows. It combines explicit, reviewable patterns that encode known attack progressions with trained classifiers that are refined as confirmed cases accumulate.

A high-priority case requires corroborating evidence, not merely unusual activity. That requirement is the main defense against the alert fatigue that undermines anomaly detection in practice.

Investigations are where analyst time is spent, and where language models can help most. Ordrani uses an evidence-grounded model to draft the narrative of each case: what happened, in what order, why it matters and what an analyst should verify next.

The model operates under strict constraints. It works from the structured evidence the detection layers produced, cites that evidence, and states uncertainty plainly. Detection, prioritization and response remain the responsibility of deterministic components and people.

Customers grant Ordrani narrowly scoped, read-only access. Event data is encrypted in transit and at rest, each tenant’s data and models are isolated, and retention is configurable. The platform never ingests secret values or credential material — it analyzes how credentials are used, not the credentials themselves.

The processing architecture favors proven components: a well-structured event pipeline, PostgreSQL for structured and relational data and established machine learning libraries for modeling, with streaming platforms, analytical column stores and accelerated inference applied as volume and latency demand.

Ordrani fits into existing security operations, with case export to SIEM and ticketing systems and an API for programmatic access.