Loom Security Cinque Integration

TL;DR

Overview

Loom Security's CINQUE is an AI-native Security Posture Management (xSPM) platform that correlates signals across CSPM, DSPM, SSPM, ISPM, and other posture domains to build behavioral "personas" for every user in an environment. CINQUE continuously baselines normal user, device, network, and application behavior, and surfaces statistically anomalous "journeys" that deviate from a persona's established baseline — such as unmanaged devices accessing sensitive applications from unexpected locations. Each anomaly includes a severity rating, a natural-language description of the deviation, and a list of correlated entities (applications, devices, users, and network/location context) along with their attributes and source systems (e.g., Entra ID). Integrating CINQUE anomaly data with Hunters provides cross-domain, risk-prioritized findings that highlight deviations in identity, device posture, network location, and application access patterns that traditional single-domain tools would miss — supporting insider threat detection, device compliance monitoring, impossible-travel/geo-anomaly detection, and zero trust verification.

Supported data types

Loom Security CINQUE Anomalies

Table name: loomsecurity_cinque_anomalies

This data type contains CINQUE's AI-generated behavioral anomaly records, each representing a statistically significant deviation from a persona's established baseline journey. Records include the anomaly's severity, a natural-language description of the deviation, and the full set of correlated entities (applications, devices, users, and network/location context) involved in the anomalous activity, along with their attributes and source systems. These events support use cases such as insider threat detection, unmanaged device access monitoring, geo-anomaly/impossible travel detection, and zero trust verification.

Expected format

Logs are expected in JSON format.

{"id": "anomaly_8827461035920471183", "title": "Unmanaged Laptop Accessing Cloud Management from Unknown Location", "severity": "high", "description": "The anomaly involves an unmanaged laptop accessing Cloud Management applications from an unknown network location, whereas the baseline shows managed laptops used only within the US on Data & Enterprise Management applications. The combination of an unmanaged device, unknown location, and access to cloud management tools is suspicious because it suggests potential unauthorized access or compromised devices operating outside of corporate controls. The statistical rarity—representing only 1.39% of the persona's activity—indicates this pattern is highly unusual and could signal an advanced persistent threat or insider misuse, particularly given the sensitive nature of cloud management systems.", "created_at": "2026-07-17 01:39:09.670079+00", "type": "anomaly", "persona_id": "persona_-1", "personaname": "Community Engagement Lead (Arkansas & Oklahoma Focus)", "entities": [{"entity_id": "app_3471928650183726491", "entityname": "Azure DevOps", "attributes": {"llm_keywords": "dev_tool,agile_management,software_engineer,cloud_platform", "source_system": "entra"}}, {"entity_id": "device_6204817350912847361", "entityname": "LAP-XK-9F2M451", "attributes": {"os_type": "Windows", "os_version": "10.0.26200.7309", "source_system": "entra"}}, {"entity_id": "network_4127396850271639482", "entityname": "4127396850271639482", "attributes": {}}, {"entity_id": "user_7284915630847261930", "entityname": "Daniel Reyes", "attributes": {"upn": "dreyes@examplecorp.com", "job_title": "Outside Consultant", "department": "Outside Consultant", "source_system": "entra"}}]}

Send data to Hunters

Hunters supports the collection of Loom Security CINQUE logs using S3.

To connect Loom Security logs:

1. Configure CINQUE (or your log forwarding pipeline) to route Loom Security CINQUE anomaly logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in this section to connect the S3 bucket to Hunters.