Security OperationsIdentity defense workspace
Incident INC-1001CRITICALInvestigating
Active incident · Elastic / SIEM

Unusual sessions and privilege activity for Asha Mehta

Unfamiliar authentication followed by token, privilege, and sensitive-access activity

Owneranalyst-kavyaResponse in progress
  1. 1Investigate
  2. 2Review
  3. 3Execute
  4. 4Verify
  5. 5Recovered
Affected identityAsha Mehta · IDN-ASHA
Unfamiliar sign-inFrankfurt, DE · high risk
Privilege changefinance-admin · ACTIVE
Critical accessFinance Administration Portal

Evidence timeline

Elastic / SIEM
  1. Login successSuccessful login from Asha's managed laptop in BengaluruEVT-1001 · simulated-iam
  2. Login successSuccessful login from an unfamiliar device in FrankfurtEVT-1002 · simulated-iam
  3. Session createdRefresh-capable session created for the unfamiliar deviceEVT-1003 · simulated-iam
  4. Mfa anomalyThree MFA challenges failed within two minutesEVT-1004 · simulated-iam
  5. Privilege grantedFinance administrator role granted outside the normal change windowEVT-1005 · simulated-iam
  6. Sensitive asset accessPayroll export configuration was openedEVT-1006 · simulated-app
  7. Session activityUnusual session queried multiple finance recordsEVT-1007 · simulated-app