[Yandex Cloud documentation](../../index.md) > [Yandex Security Deck](../index.md) > [Concepts](index.md) > Threat Detector (TD)

# Threat Detector (TD)

The [Threat Detector (TD)](threat-detector.md) module is the first line of defense of the user's cloud infrastructure in Yandex Security Deck, which automatically detects suspicious activity and notifies the user about detected threats.

Threat Detector analyzes the audit events found in the client's infrastructure and registered using [Yandex Audit Trails](../../audit-trails/index.md). The module does not require you to configure rules or involve security experts; it activates automatically when you set up your Security Deck [workspace](workspace.md).

Each time a [rule](threat-detector.md#rules) is triggered by a potential security threat, Security Deck generates an [alert](alerts.md) with detailed information about the event and recommendations for how to remove the threat. You can analyze the alert and find a solution with the help of the AI assistant, which will drill down on the problem and propose some remedies.

{% note info %}

For the Threat Detector module to function correctly, the [service account](../../iam/concepts/users/service-accounts.md) linked to the workspace [connector](workspace.md#connectors) must be [assigned](../../iam/operations/sa/assign-role-for-sa.md) the `threat-detector.worker` role or higher for the resources controlled in the workspace.

{% endnote %}

## Rules {#rules}

You can [view](../operations/td/view-rules.md) information about the Threat Detector security control rules under **Threat detection** on the **Security control rules** page.

## Exceptions to rules {#exceptions}

Exceptions allow you to flexibly configure when and for which objects Threat Detector should ignore the results of a rule check. You can [view the list of exceptions](../operations/td/manage-exceptions.md#view-exceptions-list) set for your workspace in the [Security Deck](https://center.yandex.cloud/security/) interface under **Rules and exceptions**.

#### Useful links {#see-also}

* [Security Deck workspaces](workspace.md)
* [About Alerts](alerts.md)
* [Viewing Threat Detector (TD) security control rules](../operations/td/view-rules.md)
* [Managing exceptions to the Threat Detector (TD) module's security rules](../operations/td/manage-exceptions.md)