Triage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login patterns, and determines if escalation is needed.
Guide initial triage of suspicious login alerts (impossible travel, untrusted location, multiple failed logins) for Tier 1 SOC Analysts.
CASE_ID - SOAR case ID containing the alert(s)ALERT_GROUP_IDENTIFIERS - Alert group identifiers from the caseUSER_ID - The user ID if known upfrontSOURCE_IP - The source IP if known upfrontsecops-soar.get_case_full_details(case_id=CASE_ID)
secops-soar.list_events_by_alert(case_id=CASE_ID, alert_id=ALERT_ID)
Parse events to extract:
USER_ID - The user accountSOURCE_IP - The login source IPHOSTNAME - The target/source hostname (if available)secops-mcp.lookup_entity(entity_value=USER_ID)
Record: Recent activity, first/last seen, related alerts.
Use /enrich-ioc with IOC_TYPE="IP Address":
secops-mcp.lookup_entity(entity_value=HOSTNAME)
Search for login patterns over the last 96 hours:
secops-mcp.search_security_events(
text='metadata.event_type IN ("USER_LOGIN", "AUTH_ATTEMPT") AND principal.user.userid = "USER_ID"',
hours_back=96
)
Analyze for:
Use /find-relevant-case with search terms: [USER_ID, SOURCE_IP, HOSTNAME]
If IDP tools available (e.g., Okta):
Use /document-in-case with findings summary:
Suspicious Login Triage for USER_ID from SOURCE_IP:
- User SIEM Summary: [...]
- Source IP GTI: [reputation, geo]
- Login Pattern: [normal/anomalous]
- Related Cases: [...]
- Recommendation: [Close as FP | Escalate to Tier 2]
After completing this skill, you MUST report these outputs:
| Output | Description |
|---|---|
LOGIN_VERDICT | Assessment: legitimate, suspicious, or malicious |
ANOMALY_INDICATORS | What made the login suspicious (impossible travel, new device, etc.) |
RELATED_ACTIVITY | Other suspicious activity from user or source IP |
RISK_SCORE | Numerical risk assessment (0-100) based on findings |
| Finding | Recommendation |
|---|---|
| Known VPN/corporate IP + normal pattern | Close as FP |
| User confirmed travel + MFA used | Close as Benign TP |
| Malicious IP reputation | Escalate |
| Impossible travel + no MFA | Escalate urgently |
| Multiple failures then success from new IP | Escalate |
| Pattern matches user's normal behavior | Close as FP |
Impossible Travel:
Credential Stuffing:
Account Takeover:
Lateral Movement: