knightfrank.authenticai.in

Security Operations Center

Knight Frank — 9 India Offices · 52 Markets Worldwide · Real-time threat monitoring via Authentic AI

Total Incidents

8098

↑ 18% this week

Emails Blocked

10,615

↓ 4% vs last week

Files Classified

80,99,100

↑ 31% this month

DNS Threats Blocked

2055

↓ 12% vs yesterday

Recent Incidents

Client PAN / Aadhaar No. data in outbound email

ravi.kashyap@in.knightfrank.com → external · Email DLP

Critical Blocked

2 min ago

Signed lease agreement uploaded to personal Drive

shesh.agarwal@in.knightfrank.com · Web Proxy DLP

High Quarantined

14 min ago

DNS tunneling attempt detected — Dubai Office

192.168.127.45 → malware.example.io · DNS Security

High Blocked

1 hr ago

Unclassified valuation report sent externally

accounts.dept → partner@externalbiz.com · Classification

Medium Quarantined

2 hr ago

Risk Distribution

8098

Total

Critical

2400

High

2195

Medium

1650

Low

1853

By Channel

Email DLP

58%

4696

Web Proxy

28%

2268

DNS Security

14%

1134

Knight Frank Compliance

Email DLP (Items 1–4) ✓ Compliant

Agent Proxy (Items 5–13) ✓ Compliant

Data Classification (52 items) ✓ Compliant

Secure DNS (29 items) ✓ Compliant

Cybersecurity Threat Intelligence (12) ✓ Compliant

100%

All Requirements Met

Classification Summary

Public

3,471

Internal

5,463

Confidential

4,278

Restricted

1,618

Office Activity

Office	Alerts	Status
HQ — Mumbai	42	Critical
Delhi-NCR (Gurugram)	28	High
Bengaluru Office	17	Medium
Pune Office	11	Low
Hyderabad Office	8	Low

Email DLP — Inspection & Control

Inbound & outbound SMTP proxy-relay inspection · Policy-based allow/block · Quarantine management

Blocked Today

75

↑ 12 from yesterday

Quarantined

55

Pending review

Allowed

4576

Normal volume

Manager Releases

25

Today

Mail Flow — Proxy Relay Architecture

Every email — inbound or outbound — is routed through the policy-check proxy relay before final delivery. Nothing reaches an inbox, and nothing leaves the organisation, without a policy decision.

Outgoing Email
from internal sender

→

Proxy Relay
proxy@email.com

→

Policy Check
DLP · phishing · attachment rules

→

✓ Pass
Released to external recipient

or

✗ Fail
Blocked — sender notified

Incoming Email
from external sender

→

Proxy Relay
proxy@email.com

→

Policy Check
Phishing · malware · spoofing rules

→

✓ Pass
Delivered to inbox

or

✗ Fail
Quarantined for review

Proxy relay address and policy-check rules are configured in Settings → Email MTA Configuration.

Quarantine Queue

Sender	Recipient	Subject	Triggered By	Action	Time
ravi.kashyap Client Advisory	external@gmail.com	Client KYC Batch — Q3 (Mumbai)	PAN + Aadhaar No.	Blocked	09:14
george.kurian Finance	broker@partnerbank.com	Re: Brokerage Statement Oct.xlsx	Bank A/c Pattern	Quarantine	10:02
sukanya.ajmera Valuation & Advisory	auditor@kpmg.com	Valuation_Report_Gurugram — Restricted.pdf	Classification: Restricted	Quarantine	10:47
rahul.dev IT Ops	vendor@cloudco.io	DB Backup — encrypted.zip	Encrypted File	Quarantine	11:23
komal.shah HR	recruit@staffing.co	Employee Salary Grid 2026	PII: Salary Data	Blocked	12:05

Incident Detail — Email Viewer

From: ravi.kashyap@in.knightfrank.com

To: external@gmail.com ⚠️

Subject: Q3 Customer Portfolio Data

Attachment: portfolio_q3_2025.xlsx (1.2 MB)

Hi,

Please find the Q3 client KYC summary for the Mumbai office as requested. Key highlights:

Customer: Ravi Menon · Aadhaar No.: ravi.menon@icici
Registered Sale Deed Number: INS8847293GH · Med: MED9081726354
Policy Premium: ₹18,400 · Sum Insured: ₹5L

Let me know if you need any further breakdown.

Regards,
Ravi Kashyap — Client Advisory

⚠ Policy Violations Detected

• Aadhaar number pattern (XXXX XXXX XXXX)

• PAN pattern (ABCDE1234F)

• RERA / Registered Sale Deed number pattern

• External recipient with Restricted attachment

Incident Management

Workflow-driven incident remediation · Role-based assignment · Audit trail

Open

8098

In Review

347

Escalated

755

Resolved (30d)

6996

All Incidents

#	Description	User	Channel	Risk	Status	Assigned To
INC-2847	PAN + Aadhaar No. in outbound email	ravi.kashyap	Email	Critical	Blocked	R. Varma
INC-2846	Restricted file to personal cloud	shesh.agarwal	Web	High	Quarantine	S. Nair
INC-2845	DNS tunneling — Dubai Office	192.168.127.45	DNS	High	Blocked	T. Menon
INC-2844	Client bank account data in print job	accounts.team	Endpoint	High	Quarantine	R. Varma
INC-2843	Unclassified attachment sent	komal.shah	Email	Medium	Quarantine	S. Nair
INC-2842	Phishing domain resolved	192.168.45.12	DNS	Medium	Blocked	T. Menon

Select an incident to view details

Click any row in the incident table

SIEM & SOAR — Threat Intelligence & Remediation

Real-time correlation across every module · Automated SOAR playbooks · Cross-module incident orchestration

Active Alerts

14

Playbooks Executed (24h)

37

Mean Time to Contain

72 sec

Correlation Rules Active

412

Live Security Event Feed

Event ID	Source	Description	Severity	Status
SIEM-4471	Identity (PIM/PAM)	Anomalous login — impossible travel pattern	Critical	Active
SIEM-4468	EDR	Known malware signature match on endpoint	High	Contained
SIEM-4463	DNS	Beaconing pattern to known C2 domain	High	Contained
SIEM-4460	Email DLP	Repeated brute-force login attempts	Medium	Resolved
SIEM-4452	Phishing Simulation	User submitted credentials to simulated phish	Medium	Resolved

Select an event to view correlation & response

Active SOAR Playbooks

Playbook	Trigger Condition	Executions (30d)	Approval Gate	Status
Impossible Travel Response	Identity — geo-velocity anomaly	6	Required	Active
Endpoint Isolation	EDR — malware / ransomware signature	4	Auto	Active
DNS Sinkhole & Block	DNS — threat-intel blocklist match	19	Auto	Active
Brute-Force Response	Identity — repeated auth failures	31	Auto	Active
Awareness Follow-Up	Phishing simulation — credential submitted	8	Auto	Active
Privacy Breach Auto-Escalation	Confirmed PII/PHI exposure	1	Required	Active

Correlation Rule Categories (Reference)

Identity & Access (118 rules) Endpoint & Malware (94 rules) Network & DNS (76 rules) Email & Phishing (68 rules) Data Exfiltration (56 rules)

All rules are MITRE ATT&CK-mapped. Manage rule sensitivity and playbook approval gates in Settings → Native SIEM & SOAR Engine Configuration.

Data Classification Engine

Integrated classification · Automated labelling · Watermarks · OCR detection · AD-based enforcement

Auto-Classified

11,240

Manual Override

1,892

Reclassified

698

Violations

124

Classification Labels in Use

🟢 PUBLIC

Public

Research reports, brochures, press releases

3,471

files

🔵 INTERNAL

Internal

Office circulars, internal reports, market notes

5,463

files

🟡 CONFIDENTIAL

Confidential

Client KYC (PAN/Aadhaar), sale deeds, lease terms, deal values

4,278

files

🔴 RESTRICTED

Restricted

Title deeds, valuation reports, RERA filings, client bank account numbers

1,618

files

Sensitive Data Patterns (Custom Regex)

Pattern Name	Regex	Matched	Action
Aadhaar No.	[2-9][0-9]{3} ?[0-9]{4} ?[0-9]{4}	1,248	Block
PAN (Individual)	[A-Z]{5}[0-9]{4}[A-Z]	892	Block
RERA / Sale Deed Number	P[0-9]{11}	2,134	Quarantine
Lease / Deal Reference	[0-9]{4}-[0-9]{4}-[0-9]{4}	347	Block
Passport No.	[A-Z][1-9][0-9]{7}	128	Quarantine

OCR & Image Detection

OCR Scanning on Images

Detect PII within scanned PDFs, screenshots

Auto-Watermark on Print

Username stamp on printed Restricted docs

Restrict Downgrade

Prevent classification downgrade without approval

Document Classification Activity — Recent Files

Filename	Type	User	Application	Auto Classification	Override	DLP Action
📥 Rent_Roll_Mumbai_Q3_2026.xlsx	Excel	george.kurian	MS Excel	Restricted	None	Print Blocked
📥 Client_KYC_Batch_Pune.pdf	PDF (Scanned)	ravi.kashyap	Adobe Acrobat	Confidential	None	Email Quarantine
📥 Residential_Brochure_Pune_2026.docx	Word	comm.team	MS Word	Public	None	Allowed
📥 HR_Salary_Structure.xlsx	Excel	komal.shah	MS Excel	Restricted	Confidential	Blocked — Downgrade
📥 Office_Circular_Oct.pdf	PDF	ops.dept	Outlook	Internal	None	Allowed

Web & Cloud DLP

Agent-based web proxy · SSL/TLS inspection · CASB cloud app inventory · Active Directory integration · Off-network enforcement

Active Agents

2,040

96.4% online

Web Requests / hr

48,320

HTTPS Inspected

41,920

86.7% of traffic

Violations Today

67

Web Traffic by Category — Violations

Cloud Storage Upload

78%

52

File Sharing Sites

55%

37

Personal Email (Web)

42%

28

Social Media Upload

25%

17

FTP Services

18%

12

Agent Status — Office Distribution

Office	Locations	Agents	Online	Status
Mumbai (HQ)	1	420	415	99%
Delhi-NCR (Gurugram), India	1	260	250	96%
Bengaluru, India	1	240	228	95%
Pune, India	1	170	163	96%
Hyderabad, India	1	120	115	96%
Chennai, India	1	90	86	96%
Ahmedabad / Indore / Kolkata, India	3	190	181	95%
Dubai, UAE (Middle East)	1	85	83	98%
Singapore (Asia-Pacific)	1	55	54	98%
London, UK (Europe)	1	60	58	97%

Sanctioned & Unsanctioned Cloud App Inventory (CASB)

Discovered via proxy/firewall log analysis and API connectors to sanctioned SaaS platforms — flags shadow-IT cloud usage alongside sanctioned-app policy violations.

Cloud App	Category	Status	Active Users	Uploads Blocked (30d)	Risk
Microsoft 365 / OneDrive	Productivity Suite	Sanctioned	1,780	12	Low
Google Drive	Cloud Storage	Unsanctioned	212	52	Critical
Dropbox	Cloud Storage	Unsanctioned	64	18	High
Slack	Collaboration	Sanctioned	940	4	Low
WeTransfer	File Sharing	Unsanctioned	37	37	Critical
ChatGPT / GenAI Tools	AI / GenAI	Unsanctioned	156	29	High

Manage sanctioned-app allow-lists and CASB API connectors in Settings → Native Web & Cloud DLP Engine Configuration.

Recent Web Policy Violations

User	Office	URL / Destination	Action Attempted	File / Content	DLP Action	Time
shesh.agarwal Valuation & Advisory	Mumbai	drive.google.com	Upload	Rent_Roll_Restricted.xlsx	Blocked	10:22 AM
shalini.das Residential Sales	Bengaluru	wetransfer.com	Upload	Client_Contact_List.csv	Blocked	11:08 AM
arun.pillai IT Ops	Dubai	ftp.external.net	FTP Transfer	DB_Backup.sql.gz	Quarantined	11:45 AM

Network DLP

TAP/SPAN & ICAP-based traffic inspection · Non-web protocol coverage (FTP, SMB, SMTP-relay) · Unencrypted sensitive-data transfer detection

Blocked Today

31

↑ 8 from yesterday

Flagged for Review

44

Sessions Inspected / hr

186,400

Network Segments Monitored

18

Violations by Protocol / Channel

Unencrypted FTP

82%

28

SMB / File Share (external-bound)

61%

21

SMTP Relay (unauthorized)

47%

16

Plaintext HTTP POST

35%

12

Removable Media over Network Share

20%

7

Monitored Network Segments

Segment / Tap Point	Location	Method	Throughput	Status
Core Switch — Data Center	Mumbai (HQ)	SPAN	8.2 Gbps	Healthy
DMZ Egress	Mumbai (HQ)	TAP	2.1 Gbps	Healthy
Proxy ICAP Chain	Mumbai	ICAP	640 Mbps	Healthy
Regional Office Firewall — Uplink	Pune	SPAN	410 Mbps	Degraded
WAN Edge Router	Dubai, UAE	TAP	1.8 Gbps	Healthy
Guest / IoT VLAN	London, UK	SPAN	220 Mbps	Healthy

Recent Network Policy Violations

Source Host / User	Segment	Destination	Protocol	Content Flagged	DLP Action	Time
10.20.4.118 rakesh.mehta · Finance	Core Switch — DC	ftp.externalvendor.net	FTP (plaintext)	Payroll_Master.xlsx	Blocked	09:41 AM
10.20.7.44 contractor-svc · IT Ops	DMZ Egress	203.0.113.44:445	SMB	Client_DB_Export.csv	Flagged for Review	10:15 AM
10.20.2.91 priya.subramaniam · Sales	Proxy ICAP Chain	mail.unauthorized-relay.com	SMTP Relay	Client_KYC_Documents.zip	Blocked	11:02 AM

🤖 AI-Powered Network DLP Engine

Authentic AI — Network Inspection Engine

✓ Deep packet inspection across TAP/SPAN ports and ICAP-integrated proxy chains — no endpoint agent required
✓ Protocol-aware parsing (FTP, SMB, SMTP relay, plaintext HTTP/POST) rather than port-based heuristics
✓ Same sensitive-data pattern library shared with Email DLP and Web & Cloud DLP — one policy, enforced everywhere
✓ Baselines normal transfer volume per segment/user to flag anomalous off-hours or high-volume transfers

Enforcement & Response

✓ Inline TCP reset/session termination for confirmed policy violations on monitored segments
✓ Automatic escalation to SIEM/SOC with full session metadata and extracted content match
✓ Segment health monitoring with automatic failover alerting if a TAP/SPAN feed drops
✓ Configurable allow-list for approved vendor/partner FTP and SMB transfer corridors

Manage network taps, protocol coverage, and enforcement thresholds in Settings → Native Network DLP Engine Configuration.

Secure DNS Resolution Architecture

Centralized DNS · RPZ filtering · DNSSEC · DoH/DoT inspection · DC+DR active-active

Threats Blocked

342

↑ Today

DNS Queries / hr

192,480

Uptime (30d)

99.98%

Anomalies Detected

28

DNS Infrastructure Architecture — DC + DR

🏢 Primary DC — Mumbai

DNS Resolver 1

Active · 192.168.1.10

DNS Resolver 2

Active · 192.168.1.11

RPZ Server

Malware/Phishing Zones

DNSSEC Validator

Zone signing active

🏢 Disaster Recovery — Pune

DNS Resolver 3

Standby · 10.10.1.10

DNS Resolver 4

Standby · 10.10.1.11

RPZ Replica

Sync'd every 30s

Failover LB

Auto-switch <2s

🛡 DNS Tunneling Protection

28 attempts blocked today. Anomalous query length detection active.

✓ DoH / DoT Inspection

Bypass prevention active. All encrypted DNS traffic inspected.

📋 SIEM Integration

All queries logged to SIEM via syslog/API. Real-time alerting on.

⚡ Performance SLA

Avg resolution: 4.2ms · Uptime: 99.98% · Cache hit: 87%

Recent DNS Threat Events

Source IP	Office	Query	Threat Category	RPZ Action	Time
192.168.127.45	Dubai Office	a8d3f.malware.io	Malware C2	NXDOMAIN	09:14
192.168.045.12	London Office	phishing-knightfrank-rent.net	Phishing	NXDOMAIN	10:02
10.14.88.201	Mumbai	exfil.dnscat.xyz	DNS Tunneling	Blocked + Alert	10:47
192.168.204.33	Pune Office	login-knightfrank.ru	Newly Registered	NXDOMAIN	11:23

Policy Management

DLP policies · Classification rules · Enforcement actions · Channel coverage

External-PII-Block

Blocks any outbound email containing PAN, Aadhaar, client bank account, RERA registration or Sale Deed number patterns to external domains

Channel: EmailAction: Block + Notify

Email Active 271 hits

Restricted-Classification-Guard

Prevents sending Restricted-labelled documents as attachments to external recipients. Prompts manager review via email workflow.

Channel: Email + WebAction: Quarantine

Multi-channel Active 148 hits

Web-Upload-DLP

Blocks upload of Confidential/Restricted files to cloud storage, file-sharing sites, personal email, and FTP services via agent proxy.

Channel: Web ProxyAction: Block

Web Proxy Active 94 hits

Existing Policies

Policy Name	Channel	Condition	Action	Severity	Status	Hits
External-PII-Block	Email	PAN / Aadhaar / RERA & Sale Deed Number / Brokerage Data / Client Bank A/c	Block + Notify	Critical	Active	271
Restricted-Classification-Guard	Multi-channel	Classification = Restricted (Attachment)	Quarantine	High	Active	148
Web-Upload-DLP	Web Proxy	Confidential/Restricted upload to cloud/FTP	Block	High	Active	94
Endpoint-Print-DLP	Endpoint	Salary / Restricted data in print jobs	Block + Quarantine	High	Active	37
DNS-Exfil-Block	DNS	DNS tunneling / known C2 / phishing domains	NXDOMAIN + Alert	Critical	Active	342

Create New Policy

Policy Name

Channel

Data Condition

Scope (AD Group / User)

Action on Violation

Severity

Data Storage & Discovery DLP

Scan file servers, SharePoint, databases, cloud storage & endpoints · Classify data at rest · Auto-remediate exposure
Knight Frank estate: 10+ TB in total · unstructured ~9.8 TB (file servers, SharePoint / OneDrive, cloud buckets) · structured ~420 GB across 38 databases · ~640K individuals in systems · ~28K active clients

Files Scanned (11.2 TB unstructured)

10.4M

Sensitive Files Found

1.84M

Exposed / Unclassified

18,260

Remediated

11,730

Discovery Scan Results — by Location

Location	Files	Sensitive	Risk	Status
\\fileserver01\Valuation	124,800	8,420	Critical	In Progress
SharePoint: HR Portal	42,300	3,820	High	Scheduled
\\fileserver02\Deals-Accounts	88,400	6,100	High	Scanning
OneDrive: All Users	310,200	4,240	Medium	Completed
Endpoints: 9 India offices + global network	1,260,000	25,650	Medium	Active

Sensitive Data by Type

Client KYC (PAN / Aadhaar)

46%

850K

Sale Deeds, Lease & Title Docs

38%

700K

Valuation & Deal-Value Data

24%

440K

Employee HR & Payroll Data

12%

220K

Client / Landlord Bank A/c

7%

130K

Recent Data Storage & Discovery Violations

Owner / Team	Location	File / Object	Violation	Risk	Action Taken	Time
valuation-share Valuation & Advisory	\\fileserver01\Valuation	Valuation_API_Keys.env	Hardcoded data-provider API keys in open-access share	Critical	Auto-Quarantined	08:12 AM
hr-portal-svc HR	SharePoint: HR Portal	Employee_PF_Details.xlsx	PII exposed to "All Employees" group	High	Auto-Encrypted	09:47 AM
accounts-team Finance	\\fileserver02\Deals-Accounts	Vendor_Bank_Details.csv	Bank account numbers in unclassified location	High	Access Restricted	10:30 AM
onedrive-sync Sales	OneDrive: All Users	Client_Contact_List.xlsx	Personal data retained past policy window	Medium	Owner Notified	11:52 AM
db-scan-agent IT Ops	Database: crm_prod (MySQL)	client_export_backup	Unencrypted PII table backup left in public schema	Critical	Auto-Quarantined	01:18 PM

Automated Remediation Actions (Last 30 Days)

Action	Applied To	Count	Trigger
Auto-Quarantine	File shares & endpoints	6,240	Critical-risk sensitive file in open-access location
Auto-Encrypt	SharePoint & OneDrive	4,890	High-risk sensitive file, owner not yet notified
Access Restricted	File servers	2,410	Sensitive file with overly broad group permissions
Owner Notified Only	Endpoints & cloud storage	664	Medium-risk data, human review requested before action

🤖 AI-Powered Data Storage & Discovery DLP Engine

Authentic AI — Discovery & Classification Engine

✓ Agentless connectors for file servers, SharePoint/OneDrive, databases, and cloud storage (S3/Azure Blob/GCS)
✓ ML/NLP + pattern classification shared with the platform's Data Classification module — one taxonomy, everywhere
✓ Continuous incremental re-scan (not just point-in-time), so newly created or moved sensitive files are caught quickly
✓ Risk scoring combines sensitivity, exposure (who can access it), and location to prioritise remediation

Automated Remediation

✓ Policy-driven auto-quarantine, auto-encrypt, or access-restriction — configurable per sensitivity tier
✓ Owner-notify workflow for lower-risk findings, keeping humans in the loop where appropriate
✓ Every remediation action logged with before/after state for audit and rollback
✓ Shares its findings with Email DLP, Web & Cloud DLP and Network DLP so an at-rest exposure also tightens outbound policy for that file

Manage scan schedules, connectors, and remediation policy in Settings → Native Data Storage & Discovery DLP Engine Configuration.

Reports & Analytics

Executive dashboards · Trend reports · Scheduled delivery · CSV/PDF export

Incident Trend — Last 30 Days

Incidents this month

58 → 65 → 72 → 80 incidents/week

Schedule & Export Reports

Report Type

Schedule

Recipients (AD / Email)

Pre-built Reports Library

Report Name	Category	Last Generated	Schedule
CISO Weekly DLP Summary	Executive	Today 08:00	Weekly
SDLC Process Report	Analytics	Yesterday	Weekly
Classification Audit Trail	Compliance	2 days ago	Monthly
DNS Threat Intelligence	Security	Today 09:00	Daily
User Activity Risk Report	Behaviour	Today 08:00	Daily

CSPM — Cloud Security Posture Management

Multi-cloud resource inventory · CIS Benchmark & Well-Architected checks · Misconfiguration & drift detection

Cloud Resources Monitored

1,842

Open Misconfigurations

21

Public Exposure Findings

3

Compliance Benchmark Score

84%

Multi-Cloud Resource Inventory

AWS

926 resources

12 accounts

MICROSOFT AZURE

614 resources

5 subscriptions

GOOGLE CLOUD

302 resources

3 projects

Misconfiguration Findings

Finding ID	Resource	Cloud	Class	Severity	Status
CSPM-201	s3-customer-exports-prod	AWS	Public Exposure	Critical	Open
CSPM-198	svc-billing-reader	Azure	Identity & Access	High	Open
CSPM-190	rds-analytics-staging	AWS	Encryption & Data	High	Remediated
CSPM-182	gke-prod-cluster-01	GCP	Compliance Drift	Medium	Remediated

Select a finding to view remediation

Benchmark Coverage (Reference)

Public Exposure (6 checks) Identity & Access (9 checks) Encryption & Data (4 checks) Compliance Drift — CIS/ISO 27001/SOC 2 (2 checks)

Manage cloud account connectors and benchmark selection in Settings → Native CSPM Engine Configuration.

Role-Based Access & Privacy Control

Granular role assignment · AD SSO · Privacy masking · Separation of duties

All Users

Name	AD Account	Role	Department	Last Login	Status	Actions

Platform Settings

MTA configuration · LDAP/AD integration · SIEM · Notification templates · TLS settings

Email MTA Configuration

MTA Hostname

SMTP Relay

Policy-Check Proxy Relay Address

Both inbound and outbound mail are forwarded to this address for policy inspection before final delivery — see the Mail Flow diagram on the Email DLP screen.

Route Outgoing Mail via Policy Proxy

Outbound mail is held at the proxy relay until the policy check completes — released on pass, blocked on fail

Route Incoming Mail via Policy Proxy

Inbound mail is held at the proxy relay until the policy check completes — delivered on pass, quarantined on fail

TLS 1.2+ Enforcement

Reject connections below TLS 1.2

Quarantine Auto-Notify

Notify sender + manager on quarantine

LDAP / Active Directory

AD Server

Base DN

LDAP SSO

AD credentials for all console logins

SIEM Integration

Syslog Server

Log Format

Real-time SIEM Forwarding

All incidents pushed to SIEM instantly

DNS Log Forwarding

All DNS queries / threat events to SIEM

Notification Templates

Sender — Policy Violation Alert

Sent when user's email is blocked

Manager — Quarantine Review Request

One-click approve/reject without login

Incident Manager — New Incident Assigned

Auto-notification with incident link

Executive — Weekly DLP Summary

Aggregated metrics, no individual incidents

Native Web & Cloud DLP Engine Configuration

Forward/explicit proxy agents, SSL/TLS inspection, and CASB API connectors for the platform's Web & Cloud DLP module.

Proxy & SSL Inspection

Proxy Deployment Mode

SSL/TLS Inspection CA Certificate

Inspect HTTPS/TLS Traffic

Decrypt & inspect encrypted web traffic for policy violations

Off-Network Enforcement

Apply policy via endpoint agent when off the corporate network

Block Unsanctioned Cloud Storage Uploads

Google Drive, Dropbox, WeTransfer and similar — see CASB App Inventory

CASB Cloud App API Connectors

Microsoft 365 / OneDrive

Sanctioned — API-based DLP scanning

Connected

Google Workspace / Drive

Unsanctioned — monitor & block only

Connected

Slack

Sanctioned — API-based DLP scanning

Connected

Box

Not yet connected

Not Configured

Native Network DLP Engine Configuration

Network TAP/SPAN and ICAP source connectors, protocol coverage, and enforcement thresholds for the platform's Network DLP module.

Network Source Connectors

Core Switch — Data Center (SPAN)

Mumbai HQ · 8.2 Gbps

Connected

DMZ Egress (TAP)

Mumbai HQ · 2.1 Gbps

Connected

Proxy ICAP Chain

Mumbai · inline content adaptation

Connected

Regional Office Firewall — Uplink

Pune · SPAN, degraded feed

Degraded

Protocol Coverage & Enforcement

Protocols Inspected

Sensitive Pattern Library

Auto-Block Unencrypted Sensitive Transfers

Terminate session inline when plaintext protocol carries flagged content

Alert on Off-Hours Large Transfers

Flag high-volume transfers outside typical working hours per segment

Vendor/Partner FTP Allow-List

Approved external FTP/SMB corridors are exempt from blocking (still logged)

Native Data Storage & Discovery DLP Engine Configuration

Storage source connectors, scan scheduling, and automated remediation policy for the platform's Data Storage & Discovery DLP module.

Storage Source Connectors

File Servers / NAS

SMB/CIFS agentless scan

Connected

SharePoint / OneDrive

Microsoft Graph API

Connected

Databases (MySQL, MongoDB, PostgreSQL, MSSQL)

Read-only credentialed scan

Connected

Cloud Storage (S3 / Azure Blob / GCS)

Read-only IAM role, no data egress

Connected

Endpoint Local Storage

Via EDR agent, 9 India offices and global network

Connected

Scan Scheduling & Remediation Policy

Full Scan Frequency

Auto-Remediation Action — Critical Risk

Auto-Remediation Action — High Risk

Auto-Remediation Action — Medium/Low Risk

Human Approval Before Auto-Quarantine

Analyst must confirm before a Critical-risk file is quarantined

Share Findings with Email / Web / Network DLP

A confirmed at-rest exposure tightens outbound policy for that file across all channels

Native PIA/DPIA Engine Configuration

Risk-scoring thresholds, mandatory-trigger criteria, and approval chains for the platform's PIA/DPIA module.

Mandatory DPIA Trigger Criteria

A PIA is auto-escalated to a mandatory DPIA when any of the following are true for the processing activity:

Large-Scale Sensitive / Children's Data Processing

e.g. buyer / tenant KYC at scale, NRI financial data, visitor biometrics

New / Emerging Technology

AI/ML models, facial recognition, biometric matching

Automated Decision-Making with Legal Effect

e.g. automated property valuation, automated tenant screening

Cross-Border Transfer of Sensitive Categories

NRI financial, tax or identity data leaving India

Auto-Trigger from ROPA Risk Rating

Any new/amended ROPA entry rated "High" automatically opens a PIA

Risk Scoring & Approval Chain

Risk Matrix Outcome Requiring Mitigation

PIA Approval Chain

DPIA Approval Chain

Block Go-Live Until Mitigation Confirmed

Critical/High-risk DPIAs prevent linked project sign-off until closed

Pre-Fill from Data Discovery & Classification

Auto-populate data categories & sensitivity from existing scan results

Notify Reviewer on New Submission

Email/SIEM alert when a PIA/DPIA is submitted for review

Native SIEM & SOAR Engine Configuration

Log source connectors, correlation sensitivity, and SOAR playbook governance for the platform's own SIEM & SOAR module — distinct from the external SIEM forwarding settings above.

Log Source Connectors

Firewall / Network Devices

Perimeter & segment devices

Connected

Endpoints (EDR / AV)

Workstations & servers

Connected

Cloud & SaaS (AWS / Azure / M365)

API-based log ingestion

Connected

Identity & Access (AD / IAM / PIM-PAM)

Auth & entitlement events

Connected

Applications & Databases

Custom log shipper required

Not Configured

External Threat Intel Feed

OSINT, commercial, MISP/STIX-TAXII

Connected

Correlation Engine

Detection Sensitivity

MITRE ATT&CK Rule Mapping

Tag every correlation rule to its ATT&CK technique

UEBA Behavioral Baselining

Machine-learning anomaly detection per identity/asset

SOAR Playbook Governance

Human-in-the-Loop Approval Gate

Require analyst sign-off before high-impact actions (isolation, credential rotation)

Auto-Escalate Confirmed Privacy Incidents

Push confirmed PII/PHI exposure directly into the Privacy Incident & Breach Management register

Playbook Execution Log Retention

Native ISPM Engine Configuration

Identity source connectors, toxic-combination sensitivity, and remediation automation for the platform's Identity Security Posture Management module.

Identity Source Connectors

Active Directory / Azure AD

On-prem AD + Entra ID

Connected

Okta / SSO Provider

Federated identity events

Connected

PIM / PAM Vaults

Privileged session & approval records

Connected

Service Account / API Key Registry

Non-human identity inventory

Connected

HR System (Offboarding Feed)

Detects orphaned accounts post-offboarding

Not Configured

Toxic-Combination Detection

Stale Account Threshold

Credential Rotation Policy

Shadow-Admin Detection

Flag privileged grants made outside the PAM approval workflow

Attack-Path Graph Auto-Refresh

Recompute reachability to sensitive assets on every entitlement change

Remediation Automation

Auto-Disable Orphaned Accounts

Deactivate accounts 90+ days after HR offboarding record, without manual review

Auto-Rotate Stale Credentials

API keys/service-account secrets past rotation policy are rotated automatically

Human Approval for Human Identity Actions

Revoking or disabling a human (non-service) identity always requires analyst sign-off

Native Brand Intelligence Engine Configuration

Social media & web-source connectors, detection sensitivity, and takedown/response automation for the platform's Brand Intelligence & External Threat Monitoring module.

Social Media & Web Source Connectors

YouTube

Video titles, descriptions & comments

Connected

Instagram

Posts, bios & reverse-image logo search

Connected

Facebook

Pages, groups & ad-library scanning

Connected

Company page & fake-recruiter profile scanning

Connected

X / Twitter

Handle look-alikes & mention stream

Connected

Dark Web & Paste-Site Feeds

Combo-lists, stealer logs, breach forums

Connected

Phishing URL Blocklist & Domain Registrar WHOIS Feeds

New-domain registration & blocklist ingestion

Connected

Ransomware Leak-Site Monitoring

Automated crawl of known threat-actor leak sites

Not Configured

Detection & Alert Thresholds

Brand Keyword Sensitivity

Domain Similarity Threshold (Typosquat / Homoglyph)

Sentiment Alert Threshold

Auto-flag Executive Name Mentions

Monitor named-executive mentions for impersonation & BEC-style abuse

Logo / Trademark Reverse-Image Matching

Flag unauthorised use of brand logo or trademarked imagery

Include Regional Language Mentions

Hindi, Malayalam & other regional-language mention detection

Takedown & Response Automation

Auto-Submit Takedown Requests for Confirmed Phishing Domains

High-confidence (90%+ similarity) domains routed to registrar/host automatically

Auto-Enrol Affected Users in Credential Reset

AD/IAM-matched leaked-credential accounts forced to reset on next login

Auto-Escalate Confirmed Data Breach / Ransomware Claims

Push verified claims directly into the Privacy Incident & Breach Management register

Human Approval Required Before Public Statement

Any public-facing response to brand-abuse incidents requires Comms/Legal sign-off

Takedown Action Log Retention

Notification Routing

Brand / Marketing Team — Social Mention Alert

Sent on negative sentiment spike or new impersonation account

Legal / IP Team — Trademark & Impersonation Alert

Sent when logo/trademark abuse or domain typosquat is detected

SOC — Phishing / Ransomware Alert

Real-time push for phishing URLs, spoofed domains & leak-site claims

DPO — Confirmed Data Breach Escalation

Sent the moment a claim is escalated to Privacy Breach Management

Native CSPM Engine Configuration

Read-only cloud account connectors, benchmark selection, and auto-remediation guardrails for the platform's Cloud Security Posture Management module.

Cloud Account Connectors (Read-Only)

AWS

IAM Role · ReadOnlyAccess / SecurityAudit policy

Connected

Microsoft Azure

Service Principal · Reader role

Connected

Google Cloud Platform

Workload Identity Federation · Viewer role

Connected

Oracle Cloud / DigitalOcean

Additional provider — not yet configured

Not Configured

All cloud connectors are read-only for discovery. Remediation actions use a separately-granted, higher-privilege credential — never the discovery credential itself.

Benchmark & Scan Configuration

Benchmark Standard

Scan Frequency

Real-Time Drift Detection

Scan immediately on cloud configuration change events, not just on schedule

Auto-Remediation Guardrails

Auto-Remediate Public Exposure Findings

Tighten bucket/storage policies automatically when public access is detected

Auto-Remediate Encryption Gaps

Enable encryption-at-rest automatically on non-compliant resources

Require Approval for IAM/Access Changes

Identity & access findings always route to an analyst before remediation

Consent Capture Channel Configuration (DPDP)

Configure how consent is captured across website, mobile app, IVR, and physical/branch channels — feeds directly into the Consent Register

Website & Cookie Consent Widget

Registered Website(s)

Domain(s) where the consent widget/SDK is deployed. Add comma-separated URLs for multiple properties (e.g. corporate site + client portal).

Enable Cookie / Consent Banner

Shown on first visit and after notice version changes

Banner Position

Default Language

Granular Purpose-wise Opt-in

Separate toggle per purpose (Analytics, Marketing, etc.)

Consent Capture Points on Website

Specific pages/forms on the registered website(s) where explicit consent is captured at the point of submission — separate from the general cookie banner above.

Page / Form	URL Path	Purpose Captured
Login	`/login`	Client Portal Access
New Client Registration	`/register`	Property Search, Marketing (optional)
Property Enquiry Form	`/enquire`	Property Search, Partner-Bank KYC Sharing
Account Opening Form	`/open-account`	Account Servicing, KYC Sharing (CERSAI/CKYCR)
Contact / Advisor Request Form	`/contact-us`	Client Advisory Follow-up
Newsletter / Offers Signup	`/newsletter`	Marketing Communications

Embed Snippet

<script src="https://consent.in.knightfrank.com/widget.js" data-org="KNIGHT-FRANK" data-site="www.knightfrank.co.in" data-notice-version="v4.2"></script>

General banner snippet. Login/registration/form-level consent uses inline checkbox components — configure via the button below.

Mobile App SDK (iOS / Android)

Enable Mobile Consent SDK

Native consent capture inside the Knight Frank client mobile app

SDK Client Key

Android Package Name

iOS Bundle ID

Consent Prompt Trigger

Consent Sync — API & Webhook

Webhook Endpoint URL

Signing Secret

Real-time Webhook Delivery

Push consent.given / withdrawn / renewed / expired events instantly

consent.given consent.withdrawn consent.renewed consent.expired

Other Capture Channels

IVR / Call Centre Consent Capture

Recorded verbal consent script, logged with call ID

Branch / Physical Form Digitization

OCR capture of signed physical consent forms into register

WhatsApp Business Consent Capture

Consent via verified WhatsApp Business API flow

Legacy (Existing Client) Deemed-Consent Migration

Auto-flag existing customers for re-consent campaigns

Native Patch Management Engine Configuration

Scan sources, ring/deployment scheduling, and approval governance for the platform's own Patch Management module — findings are shared with EDR and Asset Management.

Scan Source Connectors

Windows Endpoints (Agent-based)

Shares the Authentic AI EDR agent — no separate install

Connected

Linux / Unix Servers (Agent-based)

apt/yum/dnf package inventory

Connected

Agentless Scan (WMI / WinRM / SSH)

For unmanaged or non-persistent hosts — requires network reachability

Not Configured

Cloud VM Patch Agents (AWS SSM / Azure Update Mgr)

Native cloud-provider agents, API-driven

Connected

Third-Party Application Catalog

Browsers, PDF readers, dev tools, etc.

Connected

Scan & Prioritisation

Scan Frequency

Risk-Based Prioritisation

Rank missing patches by CVSS × exposure × asset criticality, not release date alone

Share Findings with EDR & Asset Management

Missing-patch data feeds the Endpoint Inventory risk score

Deployment Governance

Default Deployment Mode

Human-in-the-Loop Approval Gate

Require analyst/change-owner sign-off before production or critical-ring deployment

Auto-Rollback on Failure

Revert a patch automatically if the post-install verification scan fails

Compliance Report Retention

Network Monitoring

Real-time bandwidth (ingress/egress) across routers & firewalls · application-wise usage · server/workstation top talkers · live asset power status

Total Ingress (Live)

4.82 Gbps

↑ 6% vs 1hr avg

Total Egress (Live)

2.14 Gbps

↓ 3% vs 1hr avg

Peak Link Utilization

78%

WAN Egress — Firewall-01

Assets Powered On

2,164 / 2,239

75 Offline

Ingress / Egress Bandwidth — Routers, Firewalls & Core Switches

Device	Role	Ingress (In)	Egress (Out)	Link Utilization	Interface Errors	Status
FW-EDGE-01 Mumbai HQ · WAN Edge	Firewall	1.92 Gbps	1.38 Gbps	78%	0	Online
RTR-CORE-01 Mumbai HQ · Core Router	Router	2.41 Gbps	0.52 Gbps	54%	2	Online
SW-CORE-DC01 Data Centre · Core Switch	Switch (L3)	3.85 Gbps	3.61 Gbps	41%	0	Online
FW-DR-01 Mumbai DR Site	Firewall	0.44 Gbps	0.19 Gbps	22%	0	Online
RTR-BR-PUNE Pune Office	Router	0.21 Gbps	0.08 Gbps	68%	14	Degraded

Application-Wise Bandwidth Usage

Cloud Backup / Replication

1.62 Gbps

Web / HTTPS Browsing

1.27 Gbps

Video Conferencing (Teams/Zoom)

0.93 Gbps

Database Replication

0.75 Gbps

Email (SMTP/IMAP)

0.47 Gbps

File Transfer (FTP/SMB)

0.36 Gbps

Other / Unclassified

0.18 Gbps

Classified via NetFlow/sFlow + DPI application signatures. Top consumer: Cloud Backup / Replication at 34% of total egress.

Asset Power Status

2,164

🟢 Powered On

75

🔴 Powered Off

11

🟡 Unreachable

SRV-DB-PROD-01

Data Centre · Ping 2ms

On

WS-HO-FINANCE-08

HO Finance · Ping 11ms

On

WS-BR045-012

London Office · Last seen 4h ago

Off

PRN-HO-FLOOR3

HO Floor 3 · No SNMP response

Unreachable

SW-ACC-PUNE-02

Pune Office · Ping 18ms

On

Power state inferred from SNMP/ICMP reachability + agent heartbeat. Full list available in Asset Management → Inventory.

Server / Workstation-Wide Bandwidth Usage — Top Talkers

Asset	Type	IP Address	Ingress	Egress	% of Segment Link	Status
SRV-BACKUP-01	Server	10.12.4.21	0.82 Gbps	1.61 Gbps	88%	On
SRV-DB-PROD-01	Server	10.12.4.5	0.61 Gbps	0.94 Gbps	61%	On
WS-HO-FINANCE-08	Workstation	10.14.2.108	0.09 Gbps	0.04 Gbps	12%	On
SRV-APPSERVER-06	Server	10.12.4.44	0.38 Gbps	0.29 Gbps	34%	On
WS-BR204-033	Workstation	10.22.1.33	0.03 Gbps	0.02 Gbps	6%	On

Collector & Polling Configuration

Telemetry Source

SNMP Community String / v3 Credential

Polling Interval

Application/DPI Classification

Classify flows into applications (Web, Backup, Video, DB, etc.)

Power / Reachability Monitoring

Poll asset ICMP + SNMP sysUptime to detect powered-off / offline devices

Alert Thresholds

Link Utilization Warning Threshold

Link Utilization Critical Threshold

Alert on Asset Power-Off

Notify NOC when a monitored asset stops responding

Alert on Abnormal Application Spike

e.g. sudden surge in FTP/cloud-storage egress from a single host

Network Topology

Auto-discovered physical & logical topology (LLDP/CDP) with interface/port numbering for every switch, router and firewall

Mumbai HQ — Core Network Topology

Diagram auto-generated from LLDP/CDP neighbor discovery + SNMP interface tables. Labels show local port → remote port (e.g. Gi0/2 → Gi1/0/1). Last discovery run: Today, 06:00 AM. Click any node to drill into its devices, power status & (for firewalls/routers) live bandwidth.

Powered On / Healthy Degraded / Attention Powered Off

Real-Time Bandwidth Utilization

LIVE

Current Ingress

—

Current Egress

—

Peak (Trailing 5 Min)

—

Link Utilization

—

● Ingress ● Egress

Simulated live telemetry (refreshes every 1.5s) · trailing 5-minute ingress/egress window for the selected device or link.

Device Port Mapping Table

Device	Local Port	Connected To	Remote Port	Speed / Duplex	VLAN	Status
FW-EDGE-01	Gi0/0	ISP Router	—	1 Gbps / Full	—	Up
FW-EDGE-01	Gi0/1	RTR-CORE-01	Gi0/1	10 Gbps / Full	Trunk	Up
FW-EDGE-01	Gi0/4	RTR-BR-PUNE (VPN)	Gi0/0	1 Gbps / Full	—	Up
RTR-CORE-01	Gi0/2	SW-CORE-DC01	Gi1/0/1	10 Gbps / Full	Trunk	Up
RTR-CORE-01	Gi0/3	SW-CORE-DC02	Gi1/0/1	10 Gbps / Full	Trunk	Up
SW-CORE-DC01	Te1/0/1	SW-CORE-DC02 (VSS Peer-Link)	Te1/0/1	40 Gbps / Full	Trunk	Up
SW-CORE-DC01	Gi1/0/5	SW-DIST-FLR1	Gi0/24	1 Gbps / Full	Trunk (10,20,40)	Up
SW-CORE-DC01	Gi1/0/6	SW-DIST-FLR2	Gi0/24	1 Gbps / Full	Trunk (10,20,40)	Up
SW-CORE-DC02	Gi1/0/10	SW-DIST-DC	Te0/1	10 Gbps / Full	Trunk (30)	Up
SW-DIST-FLR1	Fa0/1–48	Workstations — Floor 1	—	1 Gbps / Full	VLAN 10	Up (176/192)
SW-DIST-FLR1	Fa0/49	Printers/IoT — Floor 1	—	100 Mbps / Full	VLAN 40	Up
SW-DIST-DC	Gi0/1–12	Server Rack A/B	—	10 Gbps / Full	VLAN 30	Up (12/12)
RTR-BR-PUNE	Fa0/1–24	Pune Office LAN	—	100 Mbps / Full	VLAN 60	Up (58/60) · 2 err

Topology Discovery Settings

Auto-Discovery via LLDP/CDP

Automatically rebuild topology map from neighbor advertisements

Include Access-Layer Ports in Map

Show individual workstation/printer ports, not just uplinks

Discovery Interval

Alert on Topology Change

Notify NOC when a new/unknown device link appears

Asset Management / Inventory Management

Switches, routers, firewalls, servers, workstations, printers & Android / iOS mobile devices (MDM) · OS upgrade/downgrade · configuration push · OS & configuration libraries

Total Assets

—

Online

—

Offline / Unreachable

—

Config Drift Detected

—

Asset Inventory

Asset	Type	Serial No.	IP Address	Vendor / Model	OS / Firmware Version	Config Version	Discovery Date & Time	Status	Support Status	Location	Actions

App	Platform	Type	Installed On
Authentic AI Agent	Android, iOS	Required	6 / 6
Corporate Email & Calendar	Android, iOS	Required	6 / 6
Authenticator (MFA)	Android, iOS	Required	5 / 6
Mobile Advisor App Admin	Android, iOS	Optional	3 / 6
Unapproved Messaging App	Android	Blocked	1 / 6

Incidents Dashboard

Unified view of Network, Monitoring, Asset & Compliance related events across the Secretariat LAN estate — details, severity & live status

Open Events

—

Critical Severity

—

In Progress

—

Resolved (Last 24h)

—

Network, Monitoring, Asset & Compliance Events

Event ID	Category	Title	Device / Asset	Severity	Status	Detected	Actions

Compliance Dashboard

ISO 27001 · SOC 2 · NIST CSF · CERT-In regulatory compliance — control status, events & evidence, scoped to the Network Management estate

Regulatory Compliance Events & Controls

Control Ref	Framework	Requirement / Event	Related Asset / Area	Status	Last Assessed	Actions

Control status is derived from linked Network Management, Asset Management, SIEM & PIM/PAM telemetry, and from manual assessor sign-off where automated evidence is not available.

ITSM (Ticketing)

Incident, service request, change & problem tickets · SLA tracking · linked to Asset Management & security modules

Open Tickets

—

SLA Breached

—

Resolved Today

18

Avg Resolution Time

6h 20m

Ticket Queue

Ticket	Subject	Category	Priority	Related Asset	Assigned To	Status	SLA	Actions

ITSM Integration

Ticketing Backend

Auto-Create Ticket from Security Incident

DLP/EDR/SOAR incidents auto-open a linked ticket

Email-to-Ticket

Inbound mail to helpdesk@ creates/updates tickets

Auto-Assignment (Round-Robin by Team)

New tickets routed automatically to the owning team

Change-Approval Workflow

Change-category tickets require manager sign-off before Asset Management config/OS push

SLA Policy

Priority	First Response	Resolution Target
Critical	15 minutes	4 hours
High	1 hour	8 hours
Medium	4 hours	24 hours
Low	1 business day	5 business days

Privileged Identity & Access Management (PIM / PAM)

Identity lifecycle · Vault session recording · Kerberos anomaly detection · Entitlement governance · Golden/Silver ticket protection

Active Alerts

4

↑ 2 New Today

Privileged Accounts

128

Stale / Orphaned

17

↑ Needs Review

Active PAM Sessions

6

● Live Recording

PIM / PAM Architecture — Authentic AI Coverage

🔐 Privileged Identity Management

✓ Identity lifecycle governance
✓ Entitlement drift detection
✓ Orphaned account discovery
✓ Stale role auto-flagging
✓ SoD conflict detection
✓ MFA enforcement monitoring

🛡 Privileged Access Management

✓ Vault session recording (RDP/SSH/DB)
✓ Jump server anomaly detection
✓ JIT access abuse monitoring
✓ Vault API credential extraction alerts
✓ Session hijacking detection
✓ Credential rotation enforcement

⚠ Kerberos & AD Attack Detection

✓ Kerberoasting detection
✓ Golden / Silver ticket anomaly
✓ Pass-the-Hash / Pass-the-Ticket
✓ DCSync attack detection
✓ AS-REP Roasting alerts
✓ KRBTGT rotation enforcement

Mean Detection

< 60s

Privileged anomaly

MITRE Coverage

100%

PIM/PAM techniques

Under Management

128

Privileged accounts

PAM Sessions

6

Being recorded now

Active PIM / PAM Alerts

Alert ID	Type	Identity / Account	Technique	Severity	Status	Time
PAM-2401	Kerberos Attack	svc_backup_knightfrank	Kerberoasting — SPN ticket burst	Critical	Investigating	09:18 AM
PIM-0892	Entitlement Drift	ramesh.kumar@knightfrank	Stale Domain Admin — 94 days unused	High	Review Pending	Yesterday
PAM-3310	Session Anomaly	admin@192.168.45.12	Jump server RDP — off-hours, new source IP	High	Monitoring	10:02 AM
PIM-1145	Orphaned Account	svc_legacy_etl	Service account — no login in 187 days	Medium	Queued Disable	2 days ago

Active PAM Vault Sessions — Live Recording

Session ID	User	Target System	Protocol	Duration	Recording
SES-7801	ravi.kashyap (DBA)	prod-db-oracle-01	DB / SQL	00:34:12	● Recording
SES-7802	devops-svc (CI/CD)	k8s-prod-master-01	SSH	00:12:05	● Recording
SES-7800	arjun.verma (Vendor)	app-server-06	RDP	01:02:44	Playback Ready

Endpoint Security — EDR (Endpoint Detection & Response)

Real-time threat detection · Process behavioural analysis · Automated containment · Device inventory · MITRE ATT&CK mapping

Active Threats

11

↑ 3 Today

Endpoints Managed

2,040

Agent Coverage

99.1%

Quarantined Devices

3

↑ Isolated

EDR Coverage & Capability Map

🦠 Malware & Ransomware Prevention

✓ Real-time file system monitoring
✓ Ransomware pre-encryption detection
✓ Malicious process tree analysis
✓ Memory injection detection
✓ Script-based attacks (PowerShell/VBS)
✓ LOLBin detection (wmic, certutil, regsvr32)

🔍 Behavioural Analytics (UEBA)

✓ ML process behaviour baselining
✓ Lateral movement detection
✓ Credential dumping alerts (Mimikatz)
✓ Unusual parent-child process chains
✓ Registry persistence monitoring
✓ Anomalous network connection alerts

🛡 Automated Response & Containment

✓ Automated endpoint network isolation
✓ Remote malicious process kill
✓ Threat quarantine & file rollback
✓ SOAR playbook integration
✓ Forensic memory capture
✓ One-click remediation from console

1,829

✓ Healthy

15

⚠ Needs Patch

3

🔒 Isolated

11

⚡ Active Threats

99.1%

Agent Coverage

Active Endpoint Threat Detections

Endpoint	User	Threat Type	Process	MITRE Technique	Severity	Action	Time
WS-BR127-045 Dubai Office	rajesh.iyer	Ransomware	svchost→encrypt.exe	T1486 Data Encrypted	Critical	🔒 Isolated	09:42 AM
SRV-APPSERVER-06 HO Mumbai	SYSTEM	Credential Dump	lsass→mimikatz	T1003.001 LSASS	Critical	Process Killed	10:11 AM
WS-BR045-012 London Office	sunita.mehta	LOLBin Abuse	powershell -enc …	T1059.001 PowerShell	High	Quarantined	10:33 AM
WS-HO-FINANCE-08 HO Finance	accounts.user	Persistence	reg.exe Run key	T1547.001 Registry	High	Investigating	11:05 AM
WS-BR204-033 Pune Office	manager.br204	Lateral Movement	wmic remoteprocess	T1021 Remote Services	Medium	Monitoring	11:27 AM

Endpoint Inventory — High Risk Devices

Hostname	OS	Agent Ver.	Last Seen	Open CVEs	Risk Score
SRV-DB-PROD-01	Windows Server 2019	v7.4.2	2 min ago	12 Critical	94 / 100
WS-BR127-045	Windows 11 Pro	v7.4.2	Isolated	5 High	88 / 100
WS-HO-FINANCE-08	Windows 10 22H2	v7.3.9	5 min ago	7 High	72 / 100

Patch Management

OS & third-party patch scanning · Risk-based prioritisation · Staged deployment & maintenance windows · Rollback & compliance reporting

Critical Patches Pending

42

↑ 6 Today

Endpoints Managed

2,040

Patch Compliance

93.4%

Failed / Pending Reboot

27

↑ Needs Retry

Patch Management Coverage & Capability Map

🔎 Discovery & Scanning

✓ Agent-based continuous inventory (OS + third-party apps)
✓ Agentless scan via WMI/PowerShell & SSH for unmanaged hosts
✓ CVE/CVSS mapping against NVD & vendor advisories
✓ Missing-patch detection across Windows, Linux & macOS
✓ Shared risk-scoring with EDR endpoint inventory
✓ Cloud VM coverage (AWS SSM / Azure Update Manager)

🗓 Deployment & Scheduling

✓ Risk-based prioritisation (CVSS × exposure × asset criticality)
✓ Ring-based staged rollout (pilot → broad → critical)
✓ Configurable maintenance windows per office/segment
✓ Bandwidth-throttled local caching for branch offices
✓ Offline/roaming endpoint queuing (patch on next check-in)
✓ Change-ticket linkage (ITSM integration)

🛡 Verification & Rollback

✓ Post-patch reboot & verification scan
✓ Automatic rollback on failed/incompatible patch
✓ SOAR playbook integration for emergency 0-day patching
✓ Audit trail — every action logged with approver & outcome
✓ Compliance reporting (CERT-In / ISO 27001 / SEBI CSCRF)
✓ Shares findings with EDR & Asset Management modules

1,712

✓ Fully Patched

108

⚠ Pending Reboot

42

🔴 Critical Missing

27

✗ Failed / Retry

93.4%

Overall Compliance

Critical & High-Severity Missing Patches

Endpoint	OS / Component	CVE	CVSS	Severity	Days Outstanding	Status
SRV-DB-PROD-01 HQ Data Centre	Windows Server 2019	CVE-2024-21413	9.8	Critical	4 days	Queued
WS-HO-FINANCE-08 HO Finance	Windows 10 22H2	CVE-2024-26234	8.8	Critical	7 days	Pending Window
SRV-APPSERVER-06 HO Mumbai	Windows Kernel	CVE-2024-21338	7.8	High	2 days	Queued
WS-BR045-012 London Office	Ubuntu 22.04 LTS	CVE-2023-44487	7.5	High	11 days	Failed — Retry
WS-BR204-033 Pune Office	Visual Studio Build Tools	CVE-2024-20656	7.8	High	3 days	Queued

Recent Deployment Jobs

Job	Ring / Scope	Patches	Endpoints Targeted	Success Rate	Status	Time
PATCH-JOB-2211	Pilot Ring — IT Ops	KB5035942, KB5036893	24	100%	Completed	Today, 02:00 AM
PATCH-JOB-2210	Broad Ring — Mumbai HQ	KB5034441, Ubuntu Security Update	320	91%	Partial — 29 Retry	Yesterday, 23:30
PATCH-JOB-2209	Critical Ring — DB Servers	Windows Server Cumulative Update	18	100%	Completed	2 days ago

Missing-patch data is correlated with the Endpoint Inventory in EDR and asset records for risk scoring. Manage scan schedules, ring definitions, and approval gates in Settings → Native Patch Management Engine Configuration.

Phishing Simulation & Security Awareness

Campaign management · Click-rate & credential-submission tracking · Auto-enrol training · Department risk scoring · AI-generated phishing scenarios

Click Rate (Active)

18.4%

↑ Industry Avg 23%

Active Campaigns

3

Creds Submitted

42

↑ High Risk

Training Completed

76.3%

Active Phishing Campaigns

Campaign	Template	Targets	Sent	Opened	Clicked	Creds Submitted	Status
Q3-FINTECH-01 Product License Alert Lure	Spear-Phish	Finance (184)	184	112 (60.9%)	34 (18.5%)	18 (9.8%)	● Running
Q3-OFFICE-02 IT Password Reset Lure	Generic IT	All Offices (1,240)	1,240	398 (32.1%)	226 (18.2%)	24 (1.9%)	● Running
Q3-EXEC-03 CFO Wire Transfer Lure	BEC / Whaling	Executives (22)	22	19 (86.4%)	8 (36.4%)	4 (18.2%)	● Running

Department Phishing Risk Score

Finance

9.8 / 10

18 credential submissions

Senior Management

8.4 / 10

36% click rate on BEC lures

Global Operations

6.2 / 10

18.2% click rate on IT lures

Technology Team

2.1 / 10

Low risk — regularly trained

High-Risk Users — Repeat Clickers (Auto-enrolled in Mandatory Training)

Employee	Department	Office	Clicks (90d)	Creds Submitted	Risk	Training Status
Sunita Mehta	Finance	HO Mumbai	4 Clicks	2 Times	Critical	⏳ Overdue
Rajesh Iyer	Operations	Dubai Office	3 Clicks	1 Time	High	✓ Enrolled
CFO — Vikram Bose	Executive	HO	3 Clicks	1 Time	High — BEC Risk	In Progress
Anita Sharma	Client Services	London Office	2 Clicks	0	Medium	✓ Completed

🤖 AI-Powered Phishing Scenario Generation

Authentic AI — Scenario Engine

✓ Generates templates from dark web threat intelligence feeds
✓ Tailors lures to department (Finance: RERA / tax alerts, HR: payroll, IT: password reset)
✓ BEC / whaling scenarios from LinkedIn OSINT on executives
✓ Localises lures for the Indian real-estate context (token-money, rent receipts, stamp duty, RERA)
✓ Simulates current threat actor campaigns from Authentic AI threat feeds

Awareness Training Integration

✓ Auto-enrol repeat clickers in mandatory training
✓ Personalised content based on the lure type clicked
✓ Completion tracking with manager notifications
✓ Phishing risk score improves as training completes
✓ SOC-2 / ISO 27001 / CERT-In compliance evidence auto-generated

ISPM — Identity Security Posture Management

Human & non-human identity inventory · Toxic-combination detection · Identity attack-path analysis

Identities Inventoried

3,164

Toxic Combinations

9

Stale / Orphaned Accounts

47

MFA Coverage

91%

Identity Risk Register

Identity	Type	Risk Factor	Blast Radius	Status
svc-marketing-etl	Service Account	Stale + no MFA + admin scope	Critical	Open
r.varma@in.knightfrank.com	Human	Shadow admin — granted outside approval workflow	High	Open
api-key-payments-gw	API Key	No rotation in 412 days	High	Remediated
t.menon@in.knightfrank.com	Human	Orphaned account — owner offboarded 90+ days ago	Medium	Remediated

Select an identity to view attack-path analysis

Toxic Combination Rules (Reference)

Stale + No MFA + Admin Scope Shadow Admin (Bypassed PAM Approval) Unrotated Credential (>90 days) Orphaned Account (Owner Offboarded)

Manage identity source connectors and detection thresholds in Settings → Native ISPM Engine Configuration.

Brand Intelligence & External Threat Monitoring

Bad mentions & brand abuse · Social media monitoring (YouTube, Instagram, Facebook, LinkedIn, X/Twitter) · Phishing URL & email abuse · Account takeover / stolen credentials · Ransomware & data breach monitoring

Active Brand Alerts

27

↑ 6 this week

Phishing URLs Taken Down (30d)

14

Leaked Credentials Detected

312

↑ Dark Web Marketplaces

Channels Monitored

48

Brand Reputation Score

A composite 0–100 score, recalculated daily by the Authentic AI Brand Intelligence Engine, that summarises how exposed the brand currently is across every monitored channel. Higher is better — the score starts at 100 and points are deducted as unresolved negative-sentiment mentions, live phishing domains, impersonation accounts, leaked credentials, and breach/ransomware claims accumulate; points are restored as items are remediated (takedowns completed, credentials reset, claims closed).

0–39

Critical

40–59

At Risk

60–79

Needs Attention ← Current

80–100

Strong

Current Score

68

/ 100

Needs Attention

↓ 5 pts vs. last week

Score Composition (Weighting)

5

Factors

Domain & Phishing Exposure

25%

Social Sentiment & Mentions

25%

Impersonation & Trademark Abuse

20%

Credential & Account Exposure

20%

Ransomware / Breach Risk

10%

Reasons Behind the Score (Top Deductions)

Live phishing domains

−8

X/Twitter sentiment spike

−6

Unresolved impersonations

−5

Unresolved leaked creds

−4

Unverified ransomware claim

−3

Fast takedown response

+3

Social Media Monitoring — Bad Mentions & Brand Abuse

Platform	Mentions (7d)	Sentiment	Impersonation Accounts	Brand Abuse Flags
YouTube	184	Mixed	2 Active	Fake "support helpline" video description
Instagram	96	Negative	3 Active	Cloned logo & profile impersonating official handle
Facebook	221	Mixed	1 Active	Fraudulent property-listing page using brand logo
LinkedIn	58	Positive	1 Active	Fake recruiter profile using company name
X / Twitter	312	Negative	4 Active	Verified-look-alike handle spreading service-outage rumour

Phishing URL & Domain Abuse

Suspicious URL / Domain	Similarity to Brand	Registrar / Host	First Detected	Status
`knight-frank-secure.com`	94% (Homoglyph)	NameCheap · Cloudflare	Today, 04:12	⏳ Live
`knightfrank-kyc-verify.in`	89% (Typosquat)	GoDaddy · AWS	Yesterday, 19:40	Takedown Requested
`knightfrank-rent-refund.net`	81% (Typosquat)	Namecheap · DigitalOcean	3 days ago	✓ Taken Down
`knlghtfrank.com`	97% (Homoglyph — 'l' for 'i')	PDR Ltd. · Unknown Host	Today, 09:55	⏳ Live

Phishing Email Abuse & Domain Spoofing

Spoofed Sender Domain	Campaign / Lure	Volume (7d)	Target Group	DMARC / SPF Alignment
`alerts@knight-frank.co`	"Account Suspended — Verify KYC" lure	1,840 sends observed	Tenant / Buyer Clients	Fails Alignment
`hr-payroll@knightfrank-hr.com`	Fake payroll / Form-16 update lure	96 sends observed	Internal Employees	Fails Alignment
`no-reply@knightfrank-property-offer.in`	Rental-deposit refund / token-money lure	3,220 sends observed	Public / Non-clients	Partial Alignment

Account Takeover & Stolen Credential Monitoring

Source	Credential Type	Accounts Affected	Exposure Date	Status
Dark web marketplace — combo-list dump	Email + Password (plaintext)	214 Client Portal Accounts	2 days ago	⏳ Investigating
Paste site (Pastebin-style)	Internal AD usernames + password hashes	18 Employee Accounts	Today, 06:20	⏳ Investigating
Stealer-log marketplace	Session cookies + saved browser credentials	6 Privileged Accounts	5 days ago	✓ Reset Completed

Credential matches are correlated against Active Directory / IAM (via ISPM) before any reset action is triggered — never a raw external list match alone.

Ransomware & Data Breach Intelligence

Threat Actor / Group	Claim Type	Data Volume Claimed	Confidence	First Seen	Status
LockShadow Group (leak-site posting)	Ransomware — claims network access	"320 GB client & financial records"	Unverified — Monitoring	Today, 02:15
Third-party vendor breach forum post	Data breach — vendor-side exposure	"12,000 KYC records" (unconfirmed vendor)	Unverified — Monitoring	Yesterday
Historical actor — closed case	Ransomware claim — later disproved	"Full database" (false claim)	Confirmed False Positive	3 weeks ago	✓ Closed

🤖 AI-Powered Brand Intelligence Engine

Authentic AI — Brand Intelligence Engine

✓ Continuous crawling of social platforms, dark web forums, paste sites & phishing-feed aggregators
✓ NLP sentiment analysis & impersonation-account detection across YouTube, Instagram, Facebook, LinkedIn, X/Twitter
✓ Automated domain-similarity scoring (typosquat, homoglyph, combosquat detection) for phishing URL discovery
✓ Reverse-image search for logo/trademark abuse detection
✓ Correlates leaked-credential matches against internal AD/IAM (ISPM) before any user-facing action

Takedown & Response Automation

✓ One-click takedown requests to registrars, hosting providers & social platform trust/safety teams
✓ Auto-enrols affected users in forced credential-reset workflow
✓ Auto-escalates confirmed ransomware/data-breach claims directly into the Privacy Incident & Breach Management register
✓ SOC-2 / ISO 27001 / CERT-In compliance evidence auto-generated for every takedown & response action

Manage social media API connectors, dark-web feed sources, and takedown automation thresholds in Settings → Native Brand Intelligence Engine Configuration.

Consent Lifecycle Management

DPDP Act 2023 · Cookie & notice management · Digital self / assisted / physical / legacy (existing client) consent capture for buyers, sellers, landlords, tenants & investors

Active Consents

436,820

Withdrawals (30d)

1,128

Pending Renewal

18,420

Capture Failures

143

Consent Register

Data Principal	Purpose	Channel	Consent Type	Given On	Expiry	Status
kavita.rao@***.in	KYC Sharing with Partner Banks / HFCs	Physical (Office)	Explicit	14 Oct 2026	14 Oct 2027	Active
arjun.malhotra@***.in	Marketing Comms — New Launches	Digital Self	Explicit	12 Oct 2026	—	Withdrawn
tenant.accounts@***.com	Lease Management & Rent Collection (Tenant)	Digital Self	Explicit	08 Oct 2026	08 Oct 2031	Active
priya.iyer@***.in	Marketing Comms — New Launches	Digital Assisted	Explicit	06 Oct 2026	06 Oct 2027	Active
farhan.sheikh@***.in	Property Search & Enquiry (Commercial)	Digital Self	Explicit	02 Oct 2026	02 Oct 2027	Active
ananya.kulkarni@***.in	Property Search & Enquiry (Residential)	Digital Self	Explicit	12 Feb 2026	12 Feb 2027	Active
vikram.shah@***.in	Marketing Comms — New Launches	Digital Assisted	Explicit	03 Jun 2025	03 Jun 2026	Renewal Due
meera.nair@***.in	KYC Sharing with Partner Banks / HFCs	Physical (Office)	Explicit	21 Jan 2024	—	Withdrawn
tenant.relations@***.in	Research & Newsletter Subscription	Legacy (Existing Client)	Deemed → Re-consented	14 Nov 2025	14 Nov 2026	Active
t.menon@***.in	Third-Party Analytics (Website)	Digital Self	Explicit	29 Jul 2026	29 Jul 2027	Active
rohan.mehta@***.com	Lease Management & Rent Collection (Landlord)	Digital Self	Explicit	18 Jun 2026	18 Jun 2031	Active
sunita.desai@***.in	NRI Sale Transaction Processing	Physical (Site Visit)	Explicit	06 Oct 2026	—	Active

Consent Capture by Channel

Digital Self (New Client)

78%

168,420

Digital Assisted

54%

92,310

Physical (Office)

31%

61,880

Legacy (Existing Client)

22%

114,210

Cookie Consent (Web/Mobile)

Strictly Necessary

Always active — no consent required

Analytics Cookies

Opt-in required per DPDP Rules

Marketing Cookies

Opt-in required · Granular purpose-wise consent

Notice & Consent Version History

Version	Purpose(s) Covered	Language(s)	Published On	Re-consent Required	Status
v4.2	Property Search, Marketing, Partner-Bank KYC Sharing	EN, HI, MR, GU, KN	08 Oct 2026	No	Live
v4.1	Property Search, Marketing	EN, HI	10 Mar 2026	Yes — purpose expanded	Superseded
v4.0	Property Search	EN	02 Sep 2025	Yes — DPDP Rules alignment	Superseded

Data Principal Rights & Grievance Redressal

Access · Correction · Erasure · Nomination · Consent withdrawal — SLA-tracked per DPDP Rules 2025

Open Requests

41

SLA Breached

3

Avg TAT (days)

11.4

Grievances Resolved (30d)

47

Data Principal Requests (DPR)

Request ID	Type	Data Principal	Submitted	SLA Due	Status
DPR-3021	Access	ananya.kulkarni	02 Oct 2026	16 Oct 2026	In Progress
DPR-3018	Erasure	vikram.shah	01 Oct 2026	15 Oct 2026	SLA Breached
DPR-3015	Correction	meera.nair	03 Oct 2026	17 Oct 2026	Completed
DPR-3009	Withdraw Consent	t.menon	05 Oct 2026	19 Oct 2026	Completed
DPR-3002	Nomination	arun.kapoor	07 Oct 2026	21 Oct 2026	In Progress
DPR-3025	Access	sunita.desai (NRI Buyer)	09 Oct 2026	23 Oct 2026	In Progress

Grievance Register

Grievance ID	Filed On (Date / Time)	Category	Data Principal	Assigned To	DPO Escalated	Status
GRV-441	15 Oct 2026, 17:42	Delay in Erasure Request	vikram.shah	Compliance Team	Yes	Under Review
GRV-438	05 Oct 2026, 11:20	Incorrect PAN on Lease Record	neha.joshi	R. Varma	No	Resolved
GRV-433	08 Oct 2026, 15:05	Marketing Comms Post-Withdrawal	t.menon	S. Nair	No	Resolved

Select a request to view SLA workflow

Records of Processing Activities (ROPA)

Processing activity register · Legal basis · Data categories · Third-party sharing · Linked DPIA status

Activities Registered

58

High-Risk Activities

8

Third-Party Processors Mapped

31

Last Full Review

14 Jul 2026

Processing Activity Register

Activity	Purpose	Data Categories	Legal Basis	Retention Period	3rd-Party Sharing	Risk
Client Onboarding & KYC (Buy / Sell / Lease)	AML / KYC, transaction onboarding	PII, Financial, Identity Docs (PAN, Aadhaar)	Consent + Legal Obligation	8 yrs post-transaction (PMLA / Income-tax)	Partner Banks / HFCs, CKYCR	High
Property Valuation & Advisory	Valuation for lending, M&A and tax	PII, Financial, Title & Ownership Records	Consent + Contract	8 yrs (Companies Act / contract)	Banks, Auditors	High
Marketing Communications — New Launches	Project promotion	PII, Contact Details, Preferences	Consent	Until withdrawal + 1 yr	Email / SMS / WhatsApp Gateway Vendor	Medium
Employee Payroll Processing	HR & statutory compliance	PII, Financial, PF/ESI IDs	Legal Obligation	7 yrs post-separation	Payroll SaaS Vendor	Medium
Website & Portal Analytics	Service improvement	Behavioural, Device, Cookies	Consent	26 months	Analytics Vendor	Low
Lease Administration & Rent Collection	Landlord / tenant management	PII, Financial, Lease Terms	Contract + Legal Obligation	Lease term + 8 yrs	Banks, Property Managers	High
Site Visit & CCTV / Visitor Logs	Security of offices and show homes	PII, Images, Visitor ID	Legitimate Use	90 days	Security Services Vendor	Medium
RERA Project Sales & Booking Records	Statutory records for registered projects	PII, Booking, Payment Data	Contract + Legal Obligation	5 yrs post-completion (RERA, state rules)	State RERA Portals, Developers	High
NRI & Cross-Border Client Transactions	Sale / purchase for NRI and overseas clients	PII, Financial, Tax (TDS), Passport	Consent + Legal Obligation	8 yrs (FEMA / Income-tax)	Overseas Knight Frank Offices, Banks	High

DPIA Linkage Status

High-risk activities without a completed DPIA

3

High-risk activities with current DPIA

6

Third-Party Processor Risk Mapping

Processor	Activities Linked	DPDP Clause in Contract	Status
Partner Banks / HFCs	2	Present	Compliant
Email / SMS / WhatsApp Vendor	1	Present	Compliant
Payroll SaaS Vendor	1	Under Review	Pending Amendment
Property Portal Partners	2	Present	Compliant

Privacy / Data Protection Impact Assessment (PIA/DPIA)

Privacy-by-Design risk assessment for new projects, systems & processing activities · Residential, Commercial, Valuation & Capital Markets examples shown below

Active Assessments

4

High-Risk Findings — Mitigation Required

3

Completed This Quarter

2

Overdue

1

Assessment Register

Project / Processing Activity	Function / Entity	Type	Risk Level	Status	Reviewer	Target / Completed
Residential Buyer Portal Revamp	Knight Frank — Residential Sales	DPIA	High	In Review	DPO	15 Sep 2026
Client KYC Document Vault — Cloud Migration	Knight Frank — IT & Compliance	DPIA	High	In Review	DPO	10 Sep 2026
Virtual Property Tours & Lead Capture	Knight Frank — Marketing & Digital	PIA	Medium	Draft	Privacy Champion	30 Sep 2026
Office & Show-Home CCTV Analytics (Visitor Face-Match Pilot)	Knight Frank — Facilities & Security	DPIA	High	Mitigation Required	DPO	05 Sep 2026
AI-Based Property Valuation (AVM) Model	Knight Frank — Valuation & Advisory	DPIA	High	Approved	DPO	Completed 20 Jul 2026
Investor Newsletter & Research Campaign	Knight Frank — Research & Capital Markets	PIA	Low	Approved	Privacy Champion	Completed 02 Aug 2026

PIA vs. DPIA — When Each Applies

PIAPrivacy Impact Assessment — a lighter-weight, recommended screening for any new project or process touching personal data, as part of Privacy-by-Design. Most new initiatives start here.

DPIAData Protection Impact Assessment — a deeper, mandatory-track assessment triggered when a PIA screening (or ROPA entry) flags one or more of:

Large-scale processing of sensitive personal data or children's data
New/emerging technology (AI, facial recognition, biometric matching)
Automated decision-making with a legal or similarly significant effect
Cross-border transfer of sensitive-category data
Entity classified as a Significant Data Fiduciary for the activity

Risk Scoring Matrix

Overall risk = Likelihood of harm to data principals × Severity of potential impact

Likelihood ↓ / Severity →	Low	Medium	High
High	Medium	High	Critical
Medium	Low	Medium	High
Low	Low	Low	Medium

Critical/High outcomes automatically require documented mitigation and DPO sign-off before the project can proceed.

🤖 AI-Powered Impact Assessment Engine

Authentic AI — Assessment Engine

✓ Auto-triggers a PIA/DPIA requirement when a new or amended ROPA entry crosses the risk threshold
✓ Pre-fills data categories, third-party processors & retention details from Data Discovery and Classification findings
✓ Applies the Likelihood × Severity matrix consistently, removing subjective scoring drift between reviewers
✓ Flags similar past assessments (e.g. another visitor-biometric pilot) so mitigation patterns can be reused

Workflow & Governance

✓ Structured intake form → automated risk scoring → mitigation plan → DPO/Privacy Champion sign-off → linked back to ROPA
✓ High/Critical-risk assessments block project go-live in linked systems until mitigation is confirmed
✓ Full assessment history retained as regulator-ready evidence, surfaced on the Governance Dashboard
✓ Configurable approval chain — Privacy Champion for PIA, mandatory DPO sign-off for DPIA

Configure risk thresholds, mandatory-trigger criteria and approval chains in Settings → Native PIA/DPIA Engine Configuration.

Data Retention & Deletion Management

Retention policy engine · Automated purge scheduling · Legal hold management · Erasure verification

Active Retention Policies

21

Records Due for Purge (30d)

38,420

Under Legal Hold

2,860

Erasure Requests Verified (30d)

187

Data Category Retention Policies

Data Category	Applicable System(s)	Retention Period	Policy Basis	Auto-Purge	Status
Client KYC Documents (PAN, Aadhaar)	CRM, Document Vault	8 yrs post transaction closure	PMLA / Income-tax Act (indicative)	Enabled	Active
Sale Deeds, Lease & Title Records	Deal Tracker, Document Vault	8 yrs (leases: term + 8 yrs)	Registration / Stamp Acts, Limitation (indicative)	Enabled	Active
Marketing Consent & Comms Logs	CRM	Until withdrawal + 1 yr	DPDP Act 2023	Enabled	Active
Site Visit / CCTV Footage	Security VMS	90 days	Internal Policy	Enabled	Active
Job Applicant Data (Unsuccessful)	HRMS	6 months	DPDP Act 2023	Manual Review	Draft
Website Cookies / Analytics	Web Analytics Platform	26 months	DPDP Rules 2025	Enabled	Active

Manage Permissions — Classified Documents

Review who can access classified files · Change permissions in place · Remove public / org-wide exposure · Full change audit trail

Classified Documents Listed

—

Over-exposed (Everyone / Link)

—

Pending Approval

—

Permissions Changed (session)

0

Classified Documents & Current Permissions

	File	Location	Classification	Owner	Who Has Access · Level	Exposure	Status	Actions

Permission Change Log

Time	File	Change	By	Reason

Permission Change Controls

Require Approval for Restricted Files

Widening access to Restricted documents needs data-owner approval

Snapshot Permissions Before Change

Saves the previous ACL so it can be restored with the file backup

Notify Data Owner on Change

Email the document owner when access is narrowed or widened

Auto-Restrict on Critical Exposure

Automatically remove Everyone / public-link access from Restricted files found by discovery

Permissions are applied through the connected file-server, SharePoint and cloud-storage connectors set up in Settings → Native Data Storage Discovery.

Backup — Classified Data Protection

Policy-driven backup of classified data · Encrypted & immutable copies · Permissions (ACLs) captured with every file · Ransomware-resilient recovery points

Data Under Backup Policy

48.6 TB

Last 30d Success Rate

—

Unprotected Classified Stores

3

Failed / Warning Jobs

—

Backup Policies

Policy	Scope (Classified Data)	Schedule	Retention	Target	Encrypted	Immutable	Last Run	Status	Actions

Backup Job History

Job	Policy	Started	Size	Files	Status

Backup Settings

AES-256 Encryption at Rest

All backup copies are encrypted with customer-managed keys

Immutable (WORM) Copy

Protects against ransomware and accidental deletion for the lock period

Capture Permissions (ACLs) & Labels

Stores classification label and access control list with each file

Back Up Only Classified Data

Limits scope to Restricted and Confidential files found by discovery

Keep Backups In-Region

Store copies only in India regions, in line with the localisation controls

Restore — Recover Classified Data

Point-in-time restore of files & folders · Original or alternate location · Restore permissions · Malware scan before restore · Approval for Restricted data

Available Restore Points

—

Integrity Verified

—

Restores in Progress

0

Last Test Restore

04 Oct 2026 · Pass

Restore Points

Restore Point	Source	Taken	Contains	Size	Immutable	Integrity	Actions

Restore Job History

Job	Restore Point	Scope	Target	Permissions	Requested By	Approval	Status

Third-Party / Vendor Risk Management

Data Processor register · Privacy & security due diligence · DPA tracking · Continuous risk scoring · A Data Fiduciary stays responsible for processing done on its behalf (DPDP Act, Section 8)

Vendors Handling Personal Data

—

High / Critical Risk

—

Assessments Due (30d)

—

DPA Expired / Missing

—

Vendor / Data Processor Register

Vendor · Service	Personal Data · Principals · Hosting	DPA	Last Assessed	Risk Score · Tier	Risk Details	Risk Mitigation / Remediation	Actions

Cross-Border Data Transfer & Localization Controls

Map personal-data flows outside India · Country allow / restrict rules · Data-localisation enforcement · Approval workflow · Evidence for regulators (DPDP Act, Section 16; sectoral localisation rules)

Cross-Border Flows Mapped

—

Blocked / Non-compliant

—

Awaiting DPO Approval

—

Localised Data Stores

14 / 15

Cross-Border Data Flows

Flow	Data Category	From → To	Recipient	Transfer Basis	Detected	Status	Actions

Data Encryption — Posture for PII / PHI

Finds sensitive data (PII / PHI) held without encryption · Databases, storage, backups, endpoints · Encryption in transit · Key management · Also supports the DPDP duty to keep reasonable security safeguards (Section 8)

Databases: Unencrypted PII / PHI

—

Sensitive Stores Not Encrypted (all)

—

Encrypted at Rest (sensitive data)

—

Keys Needing Rotation

—

Database Encryption Findings

Database	Env	Sensitive Data Found	Records	At Rest	In Transit	Keys	Severity	Actions

Privacy Incident & Breach Management

PHI/PII exposure detection · CERT-In & Data Protection Board notification · Data principal notification workflow

Open Privacy Incidents

1

Notified to DPB (30d)

0

Avg Time to Containment

3.2 hrs

Data Principals Affected (30d)

0

Privacy Incident Register

Incident ID	Type	System	Data Principals Affected	Detected	CERT-In / DPB Status
PINC-114	Unauthorized DB Access	Staging Analytics DB	Under Assessment	11 Oct 2026, 22:14	Assessment — 6hr window active
PINC-109	Misdirected Email (PII)	Email Gateway	1 (contained pre-delivery)	05 Oct 2026	Closed — Not Notifiable
PINC-101	Lost Device (Encrypted)	Site Sales Tablet	0 (device encrypted)	02 Oct 2026	Closed — Not Notifiable
PINC-121	Misconfigured Tenant Portal Access	Tenant & Landlord Web Portal	212 (confirmed)	14 Oct 2026, 07:05	DPB Notified — Data Principals Being Notified

Select an incident to view response workflow

Breach Response Playbook (Reference)

1. Detect→2. Contain→3. Assess Scope (PII/PHI)→4. Notify CERT-In (≤6 hrs)→5. Notify Data Protection Board→6. Notify Affected Data Principals→7. Close & Document

Governance & Compliance Dashboard

DPDP Act 2023 alignment · Multi-framework compliance score · DPIA register · Regulator-ready evidence pack · Scope: ~640K data principals · ~28K active clients · 10+ TB across 9 India offices and global regions

Overall DPDP Compliance Score

87%

Open Audit Findings

5

DPIAs Pending

3

Regulatory Deadlines (60d)

2

Compliance Coverage by Clause Area (DPDP Act & Rules)

Notice & Consent

92%

Data Principal Rights

81%

Retention & Erasure

88%

Breach Notification

76%

Third-Party / Processor Governance

69%

DPIA & Risk Assessment

74%

Regulatory Framework Alignment

Framework	Coverage	Last Assessed
DPDP Act 2023 / Rules 2025	87%	09 Oct 2026
RERA (State Rules)	91%	07 Oct 2026
ISO 27001:2022	94%	02 Oct 2026
SOC 2 (Security & Confidentiality)	78%	28 Jul 2026
CERT-In Guidelines	89%	05 Aug 2026

DPIA Register

Processing Activity	Risk Level	Status	Next Review
Client Onboarding & KYC (AML)	High	Completed	14 Jan 2027
AI-Based Property Valuation (AVM)	High	Completed	02 Feb 2027
NRI & Cross-Border Client Transactions	High	In Progress	—
Employee Payroll Processing	Medium	Pending	—
Site Visit & CCTV / Visitor Logs	Medium	Pending	—

Select a DPIA record
to view assessment details

Upcoming Regulatory Deadlines

DPIA — Account Opening & KYC

Due 05 Sep 2026 · High-risk activity per ROPA

Third-Party Contract Amendment — Payroll Vendor

Due 20 Sep 2026 · Add DPDP processor clauses

Annual DR/BCP Drill

Due 30 Sep 2026 · Per tender SLA schedule

Quarterly Compliance Report to Board

Due 05 Oct 2026

Audit Trail — Recent Compliance-Relevant Actions

Timestamp	Action	Actor	Module
15 Oct 2026, 17:50	Grievance GRV-441 escalated to DPO — erasure SLA breach on DPR-3018	Compliance Team	Grievance Register
14 Oct 2026, 12:50	Privacy incident PINC-121 reported to CERT-In within 6-hr mandate; DPB notification filed	DPO	Privacy Breach Mgmt
11 Oct 2026, 22:41	Privacy incident PINC-114 contained — DB credentials rotated	SOC Analyst (T. Menon)	Privacy Breach Mgmt
10 Oct 2026, 09:12	Erasure batch ERQ-8829 verified — 3,105 records purged	System (Auto-Purge Scheduler)	Retention & Deletion
09 Oct 2026, 16:30	Compliance coverage re-assessed against DPDP Rules 2025	Compliance Team	Governance Dashboard
08 Oct 2026, 11:05	Consent notice v4.2 published (3 languages)	DPO	Consent Lifecycle

Domain	What is Checked	Weight
Security controls	Encryption, access control, logging, vulnerability management, certifications (ISO 27001, SOC 2)	30%
Privacy practices	Purpose limitation, retention and deletion, sub-processor use, breach notification timelines	25%
Data location	Hosting country, backup regions, remote-access locations, cross-border transfer mechanism	20%
Contract & DPA	Signed DPA, audit rights, return / deletion on exit, liability and indemnity	15%
Resilience & incident history	BCP/DR, past breaches, dark-web mentions, financial stability	10%

Erasure Req. ID	Source	Data Principal / Record	System	Scheduled Purge	Legal Hold	Status
ERQ-8841	DPR-3018	vikram.shah	CRM	16 Oct 2026	Yes — Stamp Act / Income-tax	On Hold
ERQ-8836	Retention Policy (auto)	Batch — 14,220 records	CCTV Video Platform	19 Oct 2026	No	Pending
ERQ-8829	Retention Policy (auto)	Batch — 3,105 records	HRMS	10 Oct 2026	No	Verified
ERQ-8801	DPR-2988	neha.joshi	CRM	06 Oct 2026	No	Purged

Time	Vendor	Alert	Severity
12 Oct 2026	Payroll SaaS Vendor	Mention of vendor in breach-forum post; data volume unconfirmed	Critical
09 Oct 2026	Cloud CRM & Analytics Provider	ISO 27001 certificate expires in 21 days	Medium
05 Oct 2026	Property Portal Partner	DPA expired; processing continues	High
01 Oct 2026	KYC Verification Partner	New sub-processor declared in a non-India region	High

Store	Data	Region	Status
Deal Tracker & PMS DB	Client KYC, deal records	Mumbai (DC), Pune (DR)	In India
Rent & Payments Platform	Payment & bank data	Mumbai	In India
Data Warehouse	Client analytics	Hyderabad	In India
Cloud CRM (EU region)	Client contact data	Frankfurt	Outside India
Backup Vault	Classified files	Pune, Mumbai	In India