Uncommon Activity (Interesting Events)

Uncommon activity (interesting events)

Petra doesn't only alert on clear-cut incidents. It also flags "uncommon activity"—behavior that stands out as unusual for a user or tenant. These show up as interesting events in the reporting hub. They may or may not turn into full incidents; they're meant to give you an early signal so you can decide whether to investigate further. This article explains what uncommon activity is and how to use it.

What uncommon activity is

Uncommon activity is behavior that doesn't match what Petra has come to expect for that user or tenant. For example, a user might sign in from a country they've never used before, access a type of resource they don't normally use, or perform an action at an unusual time. Petra compares current activity to past patterns and surfaces events that look different. Not every interesting event is malicious—it might be a business trip, a new project, or a one-off action. The goal is to give you a chance to look and decide, rather than waiting until a full compromise is detected.

Where you'll see it

In the reporting hub, the "Uncommon activity" or "Interesting events" tab lists these events. You can filter by date range, tenant, or type of activity. Each event typically shows who was involved, what was unusual, and when it happened. You can open an event to see more context. Some events might later be linked to an incident if Petra determines the activity was malicious; others might be dismissed or marked as reviewed so your team knows they were looked at and considered benign.

How to use interesting events

Treat interesting events as a queue of "worth a look" items. Skim them regularly; if something looks suspicious, dig in or escalate. If it's clearly fine (e.g., user confirmed they were traveling), you can dismiss or note it so it doesn't clutter your view. Over time, reviewing interesting events helps you catch early-stage attacks and reduces the chance that something unusual slips through without anyone noticing. They're a bridge between "no alert" and "full incident"—use them to stay ahead of threats without being overwhelmed by noise.