Library
Community-shared Detection Skills. Run them as-is on commodity detections, or fork one and adapt it to your environment.
Triage impossible-travel sign-in detections by correlating the two sign-in events against VPN egress ranges, registered device identity, and MFA outcome. Escalates only when the geographic velocity cannot be explained by corporate VPN, mobile carrier NAT, or a previously registered device.
Tune impossible-travel detections from closed-case outcomes. Reads the triage report, the investigation report, and the analyst's verdict, then proposes exactly one detection change — an egress exclusion, a threshold modification, or a fork for a high-risk population — for human review.
Investigate escalated MFA-fatigue (push bombing) alerts from Entra ID sign-in logs. Reconstructs the denial-to-success timeline, attributes the source infrastructure, inspects post-authentication activity for persistence, and checks for a wider campaign before returning a verdict with recommended containment actions.
Triage MFA-fatigue (push bombing) detections from Entra ID sign-in logs, where a burst of MFA denials (sign-in error code 500121 — `status.errorCode` natively, `status_code` when normalized to OCSF) is followed by a successful login. Separates real coercion from habitual deniers by checking VIP membership, denial velocity, and the user's historical denial baseline.
Investigate escalated alerts for suspicious OAuth application consent grants. Determines whether a newly consented application is a consent phishing (illicit grant) attack by examining app provenance, requested scopes, grant velocity across the tenant, and post-consent API activity. Produces a verdict and containment recommendations.