Blackwall watches every Entra sign-in — successful or failed — for two triggers: a disabled account authenticating, or a sign-in from a country the user doesn't normally use. Disabled-user hits are blocked immediately, no approval needed. Geo-anomalies go to Slack as a card scoped to the exact RDAP network, not a guess, so a human can judge blast radius before anything is blocked.
There's no scenario where a disabled account should be authenticating, so that path skips approval entirely: sessions are revoked and the source IP is auto-blocked as a single address, since there's no human in the loop to judge how wide to go. Every other trigger carries real false-positive risk — employee travel looks exactly like a geo-anomaly — so it routes to Slack instead, with enough context to tell the difference without leaving the channel.
Every Entra sign-in in the lookback window — successful or failed — is checked against the two triggers above. Repeat attempts against an IP that's already blocked don't generate a new Slack post; the event is still logged, and a temporary block silently upgrades to permanent if it crosses the repeat-offense threshold.
SentinelOne agent inventory and Microsoft Defender signals (risky users, XDR alerts, device health) sync into Blackwall on their own schedules and surface on dashboards behind Entra SSO — one place to see what's offline, flagged, or at risk without switching consoles. Purely observational; nothing here writes back upstream.
A read-only mirror of Intune and Conditional Access policy, checked against Defender's vulnerability-management recommendations and mapped to the closest SentinelOne control where Defender itself is inactive. Drafts hardening changes as ready-to-review policy JSON — nothing is pushed without a human.
A standalone Railway service that reads Blackwall's own detection and policy tables through a dedicated read-only database role and posts analysis to Slack — it never blocks, dismisses, or changes anything itself. Runs on a cost-controlled pipeline: a cheaper model triages first, escalating to a stronger one only when it's warranted, under a weekly AI-call budget.
Blackwall is an internal system at YourPolicy — not a public product. It monitors Entra sign-ins, auto-blocks what has no legitimate explanation, and routes everything else through Slack for a human to decide.