How can we help?

Suspicious or unauthorized activity should be investigated promptly and systematically. Potential security incidents may involve unexpected account access, unauthorized configuration changes, unusual integration activity, or operations that appear inconsistent with established permissions. Polyosync Enterprise governance and audit information may help administrators investigate relevant recorded events. However, the available audit information should be considered alongside the organization's broader security procedures. Examples of activity requiring investigation 1. Unexpected changes to user permissions. 2. Unrecognized administrative activity. 3. Unusual access attempts. 4. Unexpected modifications to business configuration. 5. AI operations outside their intended responsibilities. 6. External integration activity that cannot be explained. 7. Unexpected changes to important business records. 8. Repeated authorization failures. 9. Sensitive actions performed without the expected oversight. 10. Activity associated with an account that should no longer have access. Recommended investigation process Step 1: Assess the potential impact. Determine whether the activity involves sensitive information, important business operations, or an active security risk. Step 2: Follow the organization's incident response procedures. If unauthorized access is suspected, prioritize appropriate containment measures. Step 3: Identify the affected workspace. Determine which Enterprise business environment is involved. Step 4: Establish the timeframe. Record when the suspicious activity was observed and when it may have started. Step 5: Review available audit information. Look for relevant recorded events and their associated details. Step 6: Review access permissions. Check the relevant user roles, memberships, and recent authorization changes. Step 7: Examine operational execution records. If AI Employees, automations, or business processes were involved, review their available execution results. Step 8: Check external integrations. Where relevant, review the connected provider's own security and activity information. Step 9: Preserve relevant evidence. Avoid unnecessary changes that could make the original incident harder to investigate. Step 10: Apply corrective actions. Depending on the circumstances, this may involve reviewing permissions, revoking compromised credentials, changing configurations, or suspending affected operations. Step 11: Document the investigation. Record findings, actions taken, and any remaining risks. Step 12: Contact Polyosync Support when appropriate. Provide the affected environment, relevant timestamps, error information, and a clear description of the suspected issue. What if a user account is suspected of being compromised? Follow the organization's security procedures for protecting the account and restricting unauthorized access. Review related integrations and other systems that may be affected. Should passwords or tokens be included in a support request? No. Never include passwords, API keys, access tokens, refresh tokens, or other authentication secrets in ordinary support communications. Does the absence of an audit event prove that no incident occurred? No. Audit coverage depends on the implemented event collection and retention mechanisms. An investigation should not rely exclusively on the presence or absence of one log entry. Recommended approach Prioritize containment when there is an active risk, preserve relevant evidence, and investigate the incident using multiple available sources. Security incidents should be handled through an established organizational response process.