All of the data Wirespeed ingests from your Integrations are transformed to OCSF and stored in our SIEM. These events are used to enrich detections on related systems, in advanced queries, as well as custom detections. Some ingested events are tagged as productivity activity (mailbox and related collaboration actions). That data powers features such as the Identity Login case monitor. If you see a timeline note that productivity logs are not available, the monitor needs more of that event volume in Wirespeed—see Case monitors and productivity logs.Documentation Index
Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
Use this file to discover all available pages before exploring further.

