Blog

Stream now integrates Snowflake audit logs directly into our SaaS and cloud detection framework. By including Snowflake activity as part of SaaS-sourced signals, we give SecOps teams complete visibility into how threats unfold across the chain of services connected to the cloud. This unified view closes the gaps that attackers target to ensure Snowflake is protected not just in isolation, but as part of the bigger cloud story.

Stream’s MCP offering is live. For the first time, you can interact directly with your CloudTwin using natural language, and embed those conversations into your workflows, automation, or AI tools.

Today, we’re excited to roll out our SaaS-sourced threat detections, built to give SecOps teams complete visibility across the services powering their cloud. Stream’s SaaS detections extend our end-to-end visibility beyond all cloud layers to include SaaS as part of our commitment to delivering full-spectrum coverage in a single platform.

We just released an integration with GitHub Audit Logs! 🥳 This integration is designed to address a wide range of GitHub threats by providing deep visibility into GitHub activities and enabling real-time detection of malicious behavior through Stream’s advanced detection mechanisms. Investigate and respond to GitHub threats quickly, with the context you actually need to take the right action.

We’re grateful to share that customers rated their overall satisfaction with Stream.Security at 96.3%.

A new architecture for modern cloud defense

Most security tools show pieces of cloud activity, but miss how events and data connect across layers. Cloud context reveals the full story: how identities, configurations, behavior, and workloads interact in real time. With this visibility, security teams can detect, investigate, and respond to threats with speed and precision.

Traditional security tools focus on scanning files written to disks, but what happens when no file ever lands there? Fileless attacks bypass static analysis and disk-based detection by executing directly in memory, often through existing tools like Bash, Python, or PowerShell. Although the Linux system call has benefits for software development, especially in the cloud, including use in sandbox frameworks, containerized applications, and temporary computations, those benefits are manipulated by threat actors to carry out attacks.