Before
Responders manually searched several identity, authentication, mailbox, risk, and employee systems for the same user. They then reconciled sign-in locations, MFA activity, account privileges, mailbox rules, and protected-account status before handing the facts to the SOC decision-maker.
How it works
- Receive the suspected user's login and establish the recent activity window.
- Gather identity, authentication, sign-in, mailbox, risk, role, and employee records, continuing when an individual source is unavailable.
- Apply deterministic compromise rules and return the evidence, account context, and handling indicators to the downstream SOC process.
Workflow details
- Trigger and scope: A request containing the user's login starts the workflow, with optional source IP and alert time used to define a 24-hour investigation window.
- Evidence collection: The flow retrieves the account profile, MFA factors, administrative roles, recent identity-provider events, federated sign-ins, identity risk, mailbox rules, and employee context including manager, VIP status, and protected-account indicators.
- Automated qualification: Deterministic checks identify impossible travel, MFA fatigue, factors added after risk, session-token replay indicators, risky proxy or anonymized-IP access, and suspicious mailbox rules involving forwarding, deletion, or concealed financial messages.
- Context and safeguards: The assessment marks privileged, VIP, and protected accounts so downstream responders can consider containment impact; source failures allow the workflow to continue with an incomplete profile rather than stopping the assessment.
- Result delivery: The workflow returns the identity context, signal list, detailed evidence, attacker IPs, new factors, suspicious rules, travel findings, risk level, and a summary to the calling SOC process; it does not itself change an account or create an external ticket.
What changed
The evidence-gathering and qualification handoff now occurs from one request, with the 24-hour data window, compromise checks, privilege checks, protected-account matching, and supporting evidence assembled automatically. The downstream SOC still decides what response or containment action to take.
Work removed
Repeatedly searching identity profiles, MFA factors, administrative roles, recent sign-ins, risk records, mailbox rules, and employee records; comparing locations and timestamps; counting rejected MFA pushes; checking newly enrolled factors; identifying privileged or protected accounts; and copying findings into a handoff.
Expected outcome
One assessment consolidates up to eight recurring evidence-gathering checks and provides a consistent qualification package before containment decisions are made.
