Scanning for excessive logins – ITDR identifies suspicious patterns such as unusual or excessive login attempts, which may indicate credential abuse.

Analyzing access management logs – ITDR tools analyze identity-related logs, including authentication and authorization events, to detect threats tied to user behavior and access anomalies.

Device security and signature matching are not core functions of ITDR; they fall under endpoint protection and traditional threat detection respectively.