Identity alert triage: reconstructing who, what, and how across logs

Triage starts at 02:18 UTC: reading the four identity signals

At 02:18 UTC at Meridian Space & Robotics (chronos.orbital), Threat Hunter Nyx pulls a high-priority alert from the queue: account dax.mercer@chronos.orbital authenticated from an unfamiliar residential proxy ASN and immediately requested a bulk export from the propulsion configuration repository.

Rather than closing the ticket as "user passed MFA" or immediately wiping Dax’s laptop, Nyx evaluates four structured identity signals in order: Authentication Assurance (did the login use origin-bound FIDO2, a push prompt, or a replayed session cookie?), Device Posture (did the request come from a corporate-managed MDM serial number with a healthy EDR heartbeat?), Network Origin (known corporate egress vs commercial VPN/hosting proxy), and Post-Auth Behavior (normal daily read pattern vs rapid enumeration and privilege escalation).

Why "MFA succeeded" does not automatically close the alert

A common junior SOC mistake is closing an anomalous login alert the moment they see mfaResult: SUCCESS in the IdP log. If the account used phishable MFA (such as a 6-digit TOTP code or push notification), an Adversary-in-the-Middle (AitM) reverse proxy could have relayed the user’s real MFA response and stolen the resulting session cookie.

Even when FIDO2 is enforced at login, malware on an infected endpoint can steal an already-issued session token from browser storage and replay it from another IP address without triggering a new authentication prompt. That is why Nyx compares the IP and device fingerprint at token issuance time against the IP and device fingerprint at API consumption time.

Precision vs Recall in identity detections

Detection engineering balances two measures. Recall, also called sensitivity, is TP / (TP + FN): the share of real attacks that fire an alert. Precision is TP / (TP + FP): the share of fired alerts that are real attacks. Specificity is a different measure, TN / (TN + FP): the share of benign events that stay quiet.

A rule that fires each time an engineer logs in from hotel Wi-Fi has high recall for roaming logins but low precision. The rule trains analysts to close the alert as benign. Add unmanaged device posture and a sensitive post-auth action to the network anomaly, and precision goes up. Each added condition can also lower recall, because the rule then misses attacks that do not match every condition.

Separating account actions from human intent

Logs prove what an account or token did, not which human hands were on the keyboard. By correlating the unmanaged browser fingerprint, the commercial proxy ASN, and the rapid repo cloning within 45 seconds of a push-MFA approval, Nyx confirms with high confidence that dax.mercer@chronos.orbital suffered an AitM session hijack - and escalates immediately to containment.