Local agents, which reside within your network, monitor various kinds of activities and backup critical data with constant push backs to the SaaS. That data is analyzed with some overestimated forensics engine witch in tern tells you whether your security perimeter has been breached.