Module
Identity & Authentication Investigation
Take an identity alert on a Microsoft Entra account, work out from the sign-in and audit logs how the attacker got in and what they left behind, and evict them so they stay out. That means more than resetting a password and hoping.
75 min
Start Identity & Authentication Investigation
Lessons
two-logs-one-session
what-risk-is-claiming
the-fifteenth-prompt
what-they-left-behind
getting-them-out