Catching the attack that starts with a valid sign-in

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

IdentityWatch reads your identity provider’s sign-in and audit logs, detects ten identity attack patterns — from password spraying to malicious OAuth consent — and lets you disable a user or revoke sessions from the incident.

2The challenge

Most intrusions now start with a valid sign-in: a sprayed password, a tired user approving the tenth MFA push, a malicious app granted access to mail. Identity providers record all of it, but few teams watch it.

The TotalHeal approach. IdentityWatch connects to your identity provider, keeps an inventory of active identities, detects identity attacks in the sign-in and audit data, and lets you disable a user or revoke sessions from the incident.

3Architecture

4How it works

1. ConnectGrant read access to the identity provider’s logs.
2. WatchEvery active identity and its sign-ins.
3. DetectSpraying, MFA fatigue, impossible travel, risky consent and more.
4. RespondDisable or revoke sessions behind your approval rules.

5Capabilities in detail

• Identity provider connectorMicrosoft Entra ID, Okta or Google Workspace sign-in and audit logs, read through the provider’s API.
• Ten identity detectionsImpossible travel, MFA fatigue, password spraying, brute force on one account, privileged role grants, suspicious OAuth consent, dormant-account sign-in, interactive sign-in by a service account, new application credentials and mailbox forwarding to an outside address — each mapped to MITRE ATT&CK.
• Identity inventoryEvery active identity seen, with its sign-in history and alerts.
• ResponseDisable a user or revoke their sessions, behind your response policy and its approvals.
• One incidentIdentity alerts join the same incidents as endpoint, network and cloud alerts when ThreatFusion XDR is present.
• Email signals (Enterprise)Microsoft 365 and Google Workspace email signals for your users — the providers’ own verdicts.

6Security and data handling

• Read-only by defaultDetections need only read access.
• Approval for impactDisabling users follows your response policy.
• AuditEvery action recorded and verifiable.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• An administrator who can grant TotalHeal read access to the identity provider’s logs

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.