Huntress judgement and identity

A compromised mailbox can phish contacts, re-route payments, and forward sensitive mail outside the org in minutes. The ITDR response model is sharper than EDR's for that reason.

ITDR Incident Reports share EDR's skeleton but carry event-shaped Evidence and a Timeline view that stitches events into a chronological compromise story.

Impossible travel is one of the most reliable compromise signals on the platform and one of the most reliable false-positive sources. The skill is reading the SOC's classification.

Attackers create inbox rules within minutes of getting access because rules are durable. Even after the attacker loses access, the rule keeps forwarding mail.

MFA tampering is a near-certain compromise signal because legitimate MFA changes follow a specific shape that attacker-driven changes do not match.

OAuth grants survive password resets and session revocations. An un-revoked grant lets an attacker keep reading mail and sending as the user days after you thought the compromise was fixed.

Suspicious sign-in is a family of signals, not a single pattern. The shape varies; the right response is whatever the Recommendation says.

User verification on identity incidents has a specific shape. Done badly, it becomes the social-engineering surface the attacker exploits.

Session revoke is step 1 because it stops the active attacker immediately, before anything else in the playbook matters.

Step 2 closes the door the attacker came in through. Password and MFA reset together, with a secure credential handoff.

Step 3 closes the data-exfiltration paths the attacker set up. Two mechanisms, inbox rules and mailbox-level forwarders, both need attention.

Step 4 handles persistent access that survives session revoke, password reset, and rule cleanup. OAuth tokens authenticate independently.

Step 5 audits the MFA-methods list post-reset so only legitimate methods remain. Targeted removal, not blanket cleanup.

Three signal families tell you the compromise is bigger than one identity. Recognition is the helpdesk's contribution; the response moves above the ceiling.

Auto-response can complete containment actions before you see the incident. Recognise what it did, verify it worked, then continue from the next applicable step.

The compromise playbook maps to GWS with different admin-tool paths, more forwarding mechanisms, and a user-admin overlap pattern in smaller tenants.

SIEM is the third Huntress surface, log ingestion across endpoints and SaaS, with the same SOC-managed response model you already know. Optional product, optional course.

Three ingestion mechanisms, each with its own healthy state and failure modes. Naming the mechanism first is what makes every later SIEM diagnostic short.

The SIEM Incident Report shares the skeleton you already know, with log-shaped Evidence, sometimes-derived affected entities, and Recommendations that may span surfaces.

The six-step response flow (claim, review, act, verify, close, document) applies to SIEM with different action surfaces and a wider set of senior triggers.

Five common causes of a quiet SIEM source, a mechanism-first diagnostic order, and the difference between broken and genuinely silent.

Adding a data source is routine work when a runbook covers it and senior authorisation is in place. Without either, it is an architecture decision that belongs above the helpdesk ceiling.

Four categories of in-scope SIEM work, six categories that escalate, and why the SIEM ceiling matters more than feel when the portal exposes tuning surfaces.

Four properties of a clean SOC reply, three reasons to reply, two reasons not to, and the tone that makes SIEM coordination work.

The monthly summary is the customer's most concrete evidence the service is working. Pull it from the customer's Reports view; translate the bands into security outcomes; lead with the story, not the section order.

The first few sentences a customer reads about an incident shape their entire impression of the response. Compare dramatic, vague, and correct versions of the same notification to calibrate your framing.

The wrong channel for the situation wastes the work the response did. Apply a severity-and-preference matrix to decide whether an incident notification goes by phone, email, or ticket update.

After-hours work has two opposite failure modes: waking the on-call senior for every High, or sitting on a Critical at 2am. The escalation matrix and the discipline of using it are the skill.

The closing communication is the customer's last impression of the incident. Four elements every time: what happened, what was done, what the client should do, and what was learned.

The reply-to-analyst surface exists for clarifying questions and customer-context the analyst could not see. Three patterns warrant a reply; three patterns to avoid. The skill is calibrating the moment, the framing, and the tone.

Six categories of work that always escalate regardless of how the ticket arrives, how confident the customer's IT contact sounds, or how reasonable a senior's offhanded 'just go ahead' sounds. The list is short; carrying it as a mental check is the practice.

The click-and-see reflex is the failure mode that ends helpdesk careers fastest. This lesson names it, explains why the consequences compound, and installs the ten-second pause as the alternative.

The internal signal that says 'wait, am I sure?' is faster than any external check. This lesson teaches you to treat it as an escalation trigger rather than noise to push through.

Four failure patterns show up in new-tech work on Huntress more than any others: suppressing alerts, second-guessing the SOC, isolating without comms, and closing Huntress but not the PSA. This lesson names all four so they are recognisable.

The shape of the final assessment, the categories it weights, and worked scenarios that rehearse the judgement framework one last time before the scored run.