TriageMTTR

Account Takeover Hunt

Lists the mailbox rules and recent sign-ins for a user whose mail session was flagged as compromised.

Part of Phishing report triage

Tools

Abnormal Security, Microsoft Entra ID, Slack

Outcomes

Inbox rules listed for review • New-location sign-ins summarised • Reset steps drafted for approval

Documentation

Instruction-ready detail below

When <in:email>a flagged inbox session</in:email> shows an account takeover, list the mailbox rules added in the last week, summarise sign-ins from new locations, and <slack>post</slack> the findings before anyone resets the account.

Instruction file

When <in:email>a flagged inbox session</in:email> shows an account takeover, list the mailbox rules added in the last week, summarise sign-ins from new locations, and <slack>post</slack> the findings before anyone resets the account.

Setup requirements

Tools

Abnormal Security, Microsoft Entra ID, Slack

Trigger

When an account takeover session is flagged

Setup time

20 minutes

Other automations in this workflow

Phish Campaign Hunt

Hunts the mail log for other deliveries of the same sender and link once a report is confirmed.

Phishing Report Verdict

Pulls the reported message and headers, checks the mail gateway, and returns a verdict with the evidence attached.

Proofpoint Phishing Triage

Classifies a reported message against a known threat campaign and opens one case for the campaign rather than the report.

Related workflows

Incident triage

Turns an incoming alert into one case with an owner, a severity and a first decision, so response starts while the detail is still arriving.

Log analysis

Converts a vague question about whether something happened into a scoped search with a written answer, its sources, and its limits.

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Download

Start with one instruction file.

Download the app and begin with drafts and checklists before you write anything back.

  • •Plain-language instructions
  • •Runs on your machine
  • •Works with your existing setup
  • •Reviewable activity history
Download