Autopsy vs Active Monitoring

Autopsy vs active monitoring

Petra offers two main ways to use the product: a one-time historical review called Autopsy, and ongoing active monitoring. Understanding the difference helps you choose the right option for each tenant and set the right expectations.

What is Autopsy?

Autopsy is a one-time, historical look back at a Microsoft 365 tenant. Petra gathers and analyzes about six months of activity from the tenant's logs, flags current or past attackers, surfaces how attackers got in and what they accessed, and produces a client-ready PDF report—usually within 24 to 48 hours. You don't get live, ongoing alerts with Autopsy; you get a single report that summarizes what happened in the past. This is useful for assessing a new client, investigating a suspected breach, or getting a security snapshot without committing to continuous monitoring yet.

To run an Autopsy, you need Global Admin access to the tenant and the tenant must have Unified Audit Logs enabled. It's best to choose a tenant that has been active for at least 90 days and has a reasonable amount of user activity so the analysis has enough data to be meaningful.

What is active monitoring?

Active monitoring (sometimes referred to as "Active" or "Monitoring" in the product) means Petra is continuously watching the tenant. New incidents are detected as they happen or shortly after, and you can get notified by email, webhook, or other channels you configure. You can investigate incidents, take remediation actions (like locking an account or resetting a password), and use the reporting hub and tenant dashboard on an ongoing basis. This is the mode for tenants you want to protect day to day.

Choosing and switching

When you first onboard a tenant, you may start with Autopsy to get the historical report, then move that tenant to active monitoring so you get ongoing protection. Some tenants might stay in Autopsy-only mode if you only needed a one-time assessment. Your onboarding flow and tenant settings will reflect whether each tenant is in Autopsy or active monitoring, so you can see at a glance how each one is being used.