Security Operations & Incident Response

A new administrator API key may be part of deployment automation or an unauthorized persistent credential. API keys can be used without interactive sign-in and may not appear in normal user login reports. What to check Identify who created it, its owner, scope, expiration, storage location, last use, and associated deployment. Review audit events and...

An unexpected password reset can be a legitimate recovery action, a user mistake, or an attempt to take over an account. A reset notification alone does not show who requested it or whether access changed. What to check Review reset event source, authentication context, verification method, subsequent sign-ins, recovery contact changes, and account...

A new access key can support legitimate automation or create long-lived access outside normal interactive sign-in monitoring. The creator, permissions, and storage location determine how risky it is. What to check Review the creating identity, key scope and age, last use, associated deployment, secret storage, and activity after creation. Compare with...

A mailbox delegation can provide legitimate coverage or enable someone to read and send messages without using the mailbox owner’s password. Unexpected delegation may expose sensitive communications. What to check Check who granted access, delegate identity and permissions, approval, creation time, subsequent mailbox activity, and related sign-ins....

MFA may be disabled for a legitimate recovery, temporary exception, or attacker attempting to weaken account protection. The alert needs context about who made the change and what happened to the account afterward. What to check Review actor, approval, time, affected account, authentication method, sign-ins before and after, session changes, and...

A newly created external sharing link may be an approved collaboration or an unintended exposure of internal files. Link-based access can persist even if the original recipient changes. What to check Identify file owner and classification, link scope, expiration and download settings, creator, recipients, access logs, and business purpose. Check...

A sign-in alert for a disabled account may indicate delayed token use, an application using stale credentials, a sync issue, or an incomplete disablement. The account’s disabled status alone does not explain the event. What to check Review identity provider logs, token and session revocation, application sign-in records, service account mappings,...

A user added to a privileged group may be an approved administrator change or an unauthorized escalation. Group membership can grant access across several systems without an obvious sign-in alert. What to check Review who made the change, approval record, group scope, effective permissions, time, and actions performed afterward. Check nested groups and...