Security Operations & Threat Intelligence

A sign-in alert for a disabled account may indicate delayed token use, an application using stale credentials, a sync issue, or an incomplete disablement. The account’s disabled status alone does not explain the event. What to check Review identity provider logs, token and session revocation, application sign-in records, service account mappings,...

A user added to a privileged group may be an approved administrator change or an unauthorized escalation. Group membership can grant access across several systems without an obvious sign-in alert. What to check Review who made the change, approval record, group scope, effective permissions, time, and actions performed afterward. Check nested groups and...

A new mailbox delegation or forwarding rule may be legitimate coverage or an attempt to access business messages. It can persist independently of password changes. What to check Review rule creator, delegate or recipient, scope, approval, creation time, mailbox activity, sign-ins, and provider audit records. Confirm whether messages were read, sent, or...

A login from an unmanaged device can be legitimate or indicate stolen credentials. The account may be protected by MFA while still accessing data from an endpoint outside the organization’s controls. What to check Confirm user and device context, authentication strength, access policy, data viewed or downloaded, session lifetime, and whether the device...

A new inbox rule may organize messages or secretly forward, delete, or mark security notifications as read. Rules can hide account takeover activity from the user. What to check Review rule creator and time, actions, forwarding destinations, mailbox audit logs, sign-ins, and any recent authentication changes. Check deleted items and other mailboxes...

A remote access tool may be installed for approved support or could provide an attacker with persistent control. The tool may not be managed by central endpoint policy. What to check Identify publisher, installer, account, service status, network connections, installation time, approval, and actions performed. Check whether the tool is authorized and...

An external administrator invitation may be a legitimate partner setup or an unauthorized attempt to gain persistent control. Invitations can be accepted later, after the initial alert. What to check Check inviter, invited identity and domain, role, resource scope, approval, invitation state, acceptance event, and activity after acceptance. Review...

A suspected account compromise needs prompt containment while preserving enough records to understand what happened. Deleting messages or wiping a device too early can remove useful evidence. What to check Use an approved incident contact path, record discovery time and affected account, preserve relevant sign-in and audit logs, and avoid forwarding...