CCNA Identity Threat Detection And Response Questions

Endpoint agents capture process creation events, including command-line arguments, so a BIOC matching 'whoami' execution by a domain user requires this process execution telemetry. Network or authentication logs lack the command-level visibility the rule depends on.

Monitoring the target process name for lsass.exe with suspicious access rights directly satisfies the stem's endpoint telemetry criterion. Credential dumping requires a source process opening LSASS with rights such as PROCESS_VM_READ, so correlating target image and granted access mask detects the technique regardless of the dumping tool used.

Microsoft Entra ID logs supply Cortex XDR with cloud authentication telemetry — sign-in events, conditional access outcomes and risky sign-in detections — that endpoint sensors cannot observe. This satisfies the stem's hybrid-environment constraint by correlating identity-layer anomalies with endpoint activity, exposing credential abuse and lateral movement that would otherwise remain invisible.

Tuning the analytics rule to recognise the new server as an authorised script execution source suppresses the false positive without disabling detection entirely. This satisfies the best-practice constraint of resolving the alert while preserving security coverage, since the service account's legitimate automated behaviour is now baselined rather than ignored.

The User View aggregates an identity's authentication events, directory changes, and related activity into a chronological timeline. For a compromised service account used to create a domain admin, it shows the authentication sequence and the subsequent directory modification in order. This identity-centric lens is exactly what the analyst needs to reconstruct the attack path.

Identity Analytics exclusions or entity classifications remove known service accounts from behavioural risk scoring, so their high-volume automated authentications no longer inflate user risk scores. This directly satisfies the requirement to prevent false-positive risk elevations without disabling analytics for genuine interactive accounts.

BIOC rules analyse command-line arguments and process ancestry behaviourally, so they flag reconnaissance such as net group "Domain Admins" /domain regardless of binary signatures, matching the stem's requirement to detect native-utility enumeration without relying solely on static signatures.

Incident Response > Alerts with an Analytics category filter isolates UBA-generated identity analytics alerts, satisfying the requirement to inspect identity-specific behavioural detections rather than all alert types. Cortex XDR surfaces user behaviour analytics findings within the Analytics category, so filtering there returns exactly the compromised-credential identity alerts the administrator needs.

Credential stuffing produces many failed authentications spread across accounts and source IPs; analytics rules correlating high-frequency failures across multiple accounts from distributed IPs surface this pattern. This satisfies the stem's need to detect the attack's defining distribution characteristic.

Cloud identity provider sign-in logs, such as Microsoft Entra ID, record authentication events, risky sign-ins and conditional access outcomes. Ingesting them gives Cortex XDR the identity telemetry needed to detect and investigate credential-based attacks under ITDR.

The Identity Analytics dashboard consolidates identity telemetry and presents users ranked by accumulated risk indicators, including authentication anomalies and privilege changes. It is purpose-built for the user-centric risk overview the administrator needs, unlike incident or endpoint views that organize data around alerts or hosts.

Cortex XDR's identity analytics aggregates behavioural analytics alerts into each user's risk score, weighting both the severity assigned to each triggered alert and how many alerts fired. This directly satisfies the stem's requirement for metrics included in the calculation, since alert volume and severity are the core inputs driving the score.

The Broker VM is deployed on-premises to collect syslog, WMI and Active Directory logs, then forwards them to Cortex XDR for ITDR analysis. It satisfies the requirement to ingest directory and identity telemetry that cloud-only collection cannot reach directly.

Entra ID sign-in and audit logs supply cloud authentication events, including conditional access outcomes, MFA results, and application access. Ingesting them through the Cortex XDR cloud identity connector lets the platform correlate cloud sign-ins with on-premises activity. Without this telemetry, the analyst cannot see cloud-side identity attacks or link them to Active Directory logons.

Identity provider integration data enriches Cortex XDR with directory attributes, including group memberships and role assignments. This information lets the analyst determine whether the authenticated user holds privileged roles that would elevate the risk of the unfamiliar device login. Without this enrichment, the analyst would see the authentication event but lack the context needed to judge its impact.

Cortex XDR supports automated response actions triggered by alert criteria, including integrations with identity providers such as Active Directory or Azure AD. Configuring the response playbook to disable the user account upon a confirmed credential-compromise alert achieves hands-free containment, immediately revoking the attacker's access without waiting for an analyst to intervene manually.

Windows Security Event ID 4769 records Kerberos service ticket requests, including the target SPN and encryption type, which exposes Kerberoasting against high-privilege SPNs. Broker VM collection ensures these domain controller events reach Cortex XDR, satisfying the requirement for detecting service ticket requests.

Session-token replay reuses an existing authenticated session, so the device fingerprint and session identifier remain tied to the original device while the source IP changes. Cortex XDR identity analytics surfaces this mismatch. Legitimate travel produces new device or session context from a new network; a reused session context from two countries within minutes indicates token theft, not travel.

Analytics Rules / Thresholds under Settings > Analytics is where behavioural BIOC-style rules and their alert thresholds are defined and tuned. Configuring privileged-user thresholds there satisfies the requirement to closely monitor administrative logon sessions for anomalous behaviour in Cortex XDR.

Cortex XDR's identity analytics baselines normal Kerberos behaviour, then flags forged tickets through anomalous attributes such as excessive ticket lifetimes or SID history inconsistencies. Domain controller telemetry supplies the authentication events, so Golden Ticket manipulation surfaces without relying on endpoint signatures.

The User View aggregates identity-centric context: the user's profile, recent alerts, associated devices and identity attributes. This lets the analyst correlate an identity-based alert with the account's activity and endpoints, satisfying the need to investigate the alert's full identity context.

The join command correlates rows across separate Active Directory event datasets by matching a shared field, here the user SID or account name, linking account creation to subsequent group membership changes. This satisfies the hunt requirement of correlating two event streams into a single timeline per identity.

Cortex XDR Query Builder lets analysts query the XDR dataset directly, filtering Kerberos service ticket events and pivoting on the requesting host and process. This provides the fastest way to enumerate every host and process involved in the Kerberoasting activity, which is exactly what scoping the incident requires. It uses native Cortex XDR telemetry without external tooling.

The User View presents an identity-centric investigation context that consolidates an account's recent activity, related alerts, and directory changes such as group membership modifications. It lets the analyst review the Domain Admins addition together with the account's other behavior without switching between unrelated endpoint or network views.

Cloud identity provider authentication logs supply successful and failed sign-in events, MFA outcomes and source IPs tied to each account. Cortex XDR correlates these with endpoint telemetry to baseline normal identity behaviour and flag anomalous access, satisfying the ITDR requirement for identity-centric data sources.

A downgrade from AES to RC4 during ticket-granting requests is a recognized indicator of Kerberoasting-style activity, where attackers request service tickets with weaker encryption to crack them offline. Because modern environments negotiate AES by default, this anomaly is high fidelity and warrants investigation as probable credential abuse.

Cortex XDR's identity correlation engine stitches identity telemetry to endpoint and network events, resolving a user's activity into one unified incident timeline. This satisfies the scenario's need to see a campaign targeting a user across all three domains, rather than isolated alerts, exposing the full attack chain during triage.

XQL allows the analyst to search across all ingested data, including LDAP query events, from all endpoints. By querying for the specific attribute or query pattern, the analyst can identify other hosts that performed similar reconnaissance. The results can be aggregated and visualized to show the scope. This is the most efficient way to assess the breadth of the activity and determine if it is widespread or isolated to one workstation.

User View correlates the identity behind an alert with its risk score and the device history tied to that account, letting the analyst pivot from a single identity alert into related endpoint activity and assess whether the account's behaviour deviates from its normal baseline.

Windows Security audit events 4600 through 4799 cover logon, logoff, credential validation, Kerberos ticket activity and account lockout. Cortex XDR ITDR consumes these to detect identity attacks, so this range supplies the authentication telemetry the analyst must verify.

Pass-the-ticket injection writes a stolen Kerberos ticket into a target process and manipulates LSA handles, so process behaviour telemetry recording handle creation and memory allocation anomalies against lsass.exe exposes the injection. This satisfies the requirement to identify abnormal process behaviour tied to Mimikatz kerberos::ptt.

Impossible travel indicates that valid credentials are being used from locations that cannot be reached in the elapsed time, which strongly suggests credential misuse rather than theft of a hash or ticket. It relies on successful authentication patterns and location data, so it detects abuse of working credentials. This makes it a high-priority signal for identifying an attacker who already has valid access.

The Incident Storyline and User Timeline view correlates endpoint and cloud telemetry into one chronological narrative, letting the analyst trace every action tied to the suspicious account. It directly satisfies the requirement to review activity across endpoints and cloud services outside business hours, rather than examining isolated alerts per data source.

The Causality View links alerts and events that share a causality chain, allowing the analyst to move from authentication-related alerts to the endpoint activity generated by the same process or user session. This directly supports correlating the failed and successful logons with the subsequent file share access in one investigation context.

Windows Security Event Logs, particularly events like 4624 with logon type 3 and NTLM authentication, record the details of network logons. Cortex XDR ingests these logs and can correlate multiple NTLM authentications from a single user across different servers, which is characteristic of pass-the-hash. This data source provides the granular authentication details needed to detect such identity-based attacks.

Windows Security Event logs record Event ID 4624 for successful logons and 4625 for failed ones, giving Cortex XDR the interactive logon telemetry ITDR needs. No other source captures both outcomes with the account, source and logon-type detail required.

Correlating authentication events by account across all ingested identity sources lets the analyst see subsequent logons from other hosts, which is exactly how credential reuse appears. This cross-source view reveals whether the same account authenticated from a new location after the credential store was accessed, confirming theft and reuse.

Response Actions and Playbooks execute automated remediation, such as disabling a compromised account in Active Directory, when high-severity ITDR alerts fire. This satisfies the stem's requirement for automated response to active credential compromise without manual analyst intervention.

The Dashboards and User Risk view aggregate identity risk signals across all users, presenting the overall posture score in one place. This centralised view lets administrators assess organisation-wide identity exposure without inspecting each user individually.

Alert Grouping and Correlation engine clusters related alerts into incidents, linking authentication anomalies to other telemetry. This lets analysts spot credential-compromise patterns across disparate sources rather than reviewing isolated alerts, directly supporting identification and investigation.

Adding the VPN egress ranges to Cortex XDR's known corporate network or location exclusions list lets the analytics engine treat sign-ins from that infrastructure as trusted, so impossible-travel logic no longer flags the shared egress IP. This directly satisfies the stem's constraint: the source IP is legitimate corporate VPN infrastructure, not attacker activity.

Automated account disablement requires an integration between Cortex XDR and the identity provider, such as Azure AD or Okta, that exposes user management actions. Without this integration, the platform cannot issue the disable command to the authoritative directory. Configuring the identity provider integration is therefore the prerequisite for orchestrating identity response actions directly from Cortex XDR.

User confirmation of no activity converts the anomaly into confirmed compromise. The sequence of unfamiliar-ASN sign-in, mail rule creation, and password reset indicates persistent access and data exfiltration staging. Revoking sessions invalidates stolen tokens, resetting credentials locks out the attacker, and removing the forwarding rule stops ongoing mail theft, addressing both access and exfiltration in the right order.

Disabling the account or forcing a password reset through the Active Directory integration revokes the compromised service account's ability to authenticate, halting lateral movement immediately. This satisfies the containment requirement without disabling the domain controller, since the action targets only the affected identity rather than the underlying host or domain infrastructure.

User View aggregates identity-related telemetry for a specific account, including authentication activity, accessed resources, and correlated alerts, giving analysts a single pane for per-user investigation. In this scenario it is the correct feature because it directly provides the consolidated timeline the manager wants analysts to use.

BIOC rules in Cortex XDR are designed to detect specific behavioral patterns, such as unauthorized processes accessing LSASS memory. By creating or leveraging a BIOC rule that monitors for known credential dumping techniques (e.g., process access to lsass.exe with specific access rights), Cortex XDR can directly alert on this activity. This capability is tailored for detecting such endpoint behaviors.

Unauthorised process memory access targeting lsass.exe directly satisfies the credential-harvesting constraint: tools such as Mimikatz open the LSASS process and read its memory to extract plaintext passwords, NTLM hashes and Kerberos tickets. Cortex XDR flags these cross-process read requests, exposing post-exploitation credential dumping that file-based indicators would miss.

Cortex XDR can isolate a compromised endpoint directly from the incident view or through an orchestrated playbook, cutting the host off from the network while preserving forensic access. This contains the identity-driven intrusion by severing the attacker's foothold on that machine.

The Incident View in Cortex XDR aggregates related alerts, identity events, endpoint process activity, and network connections into a unified timeline with causality. Because the scenario involves a suspicious authentication followed by a privileged role assignment, this view lets the analyst see whether the identity event and any subsequent endpoint or network behavior belong to the same actor and incident. It is the correct starting point for correlation before pivoting to narrower tools.

Domain controllers generate the security telemetry Cortex XDR needs, but it must be forwarded. The Broker VM acts as the collection and parsing intermediary, receiving syslog or Windows event streams, which is essential before ITDR analytics can consume that data.

Explicit-credential logons fanning out to many hosts in minutes is a classic lateral movement signature. Cortex XDR's behavioral analytics baseline normal helpdesk activity, which typically targets one or two endpoints per ticket. The velocity, breadth, and absence of a change ticket combine to elevate severity, because the pattern matches credential reuse for host-to-host propagation rather than legitimate support work.

The Broker VM acts as the on-premises collector and forwarder, receiving IdP authentication telemetry and securely transmitting it to the Cortex XDR data lake. It satisfies the requirement for a component that securely forwards external IdP logs into the platform.

The Broker VM with User-ID integration queries Active Directory to harvest user and group metadata, forwarding it to Cortex XDR for identity-based correlation. This satisfies the ITDR requirement by supplying the directory context that alert enrichment depends on.

User View in Cortex XDR includes a timeline that displays user activity, including logins with geographic locations and timestamps. This visual representation allows analysts to quickly see the sequence and locations of authentications, making it ideal for confirming impossible travel scenarios. It aggregates identity data to highlight anomalies.

BIOCs in Cortex XDR detect behavioral patterns, including suspicious Active Directory operations such as unauthorized computer object creation by a service account. This scenario matches that category because the behavior is a sequence of directory actions rather than a known file hash or IP. BIOCs are designed for exactly this kind of technique-level detection, making them the most relevant analytic category for identifying directory object manipulation.

BloodHound enumeration generates LDAP queries against Active Directory, which Domain Controllers record as Directory Service Access events. Event ID 4662 captures object access and query patterns, exposing the reconnaissance volume and targeted permissions that Cortex XDR can alert on.

Domain controller security logs are the richest source of on-premises identity activity, capturing logon events, Kerberos ticket operations, and account changes. Cortex XDR uses these events to baseline user behavior, detect pass-the-hash, Kerberoasting, and brute-force patterns. Without domain controller telemetry, the platform lacks visibility into the authentication decisions that underpin on-premises identity threat detection.

Requesting TGS tickets for many SPN accounts is the defining Kerberoasting pattern, and LDAP enumeration of domain admins is classic post-exploitation reconnaissance. That a backup service account is doing this indicates the account's credentials were stolen and repurposed. Immediate containment, disabling or rotating the account, and hunting for the source host are the correct next steps.

Identity Analytics behaviour rules, including Kerberos anomalies such as Silver and Golden ticket activity, are configured and tuned centrally under Settings > Configurations > Analytics. Enabling the rule there lets the analyst raise high-severity alerts for abnormal ticket requests across the local Active Directory environment.

Identity Analytics baselines normal entitlement behaviour, so privilege escalation or unexpected group membership changes deviate from that baseline and raise alerts. This satisfies the identity-based threat behaviour constraint by surfacing unauthorised permission gain indicative of account compromise or insider abuse.

Behavioural analytics and ITDR ingest identity signals and map endpoint telemetry to directory accounts, satisfying the correlation requirement. Without these modules, Cortex XDR sees process and network events but cannot attribute them to Microsoft Entra ID or Active Directory user identities.

Scheduled and on-demand reporting templates directly satisfy the stakeholder communication requirement by generating incident summaries and user risk reports from Microsoft Entra ID identity findings. These exportable artefacts give auditors consistent, repeatable evidence of identity threat activity, unlike live dashboards or raw alerts, which lack the structured, shareable format compliance reviews demand.

The Analytics Alert Grouping engine correlates disparate alerts sharing entities or timing into one incident, so rapid logins from distant IPs against a single account collapse into a consolidated compromise case instead of separate notifications.

Cortex XDR's behavioral analytics baseline normal Kerberos activity and can detect anomalies such as TGTs with unusually long lifetimes or encryption types not used in the environment. These deviations are hallmarks of forged tickets. By monitoring ticket requests, the analytics engine can flag Golden Ticket activity even when legitimate credentials are not used.

Abnormal data access volume compares a user's file downloads against peer-group baselines, flagging statistically excessive retrieval that suggests exfiltration or a hijacked account. The UBA engine builds behavioural baselines per peer group, satisfying the requirement to surface anomalies indicating a compromised account.

Security group membership change events reveal privilege escalation persistence, such as adding a compromised account to Domain Admins. Monitoring these satisfies the stem's focus on Active Directory object manipulation, exposing the attacker's attempt to retain elevated access after credential compromise.

The identity analytics module collects and normalizes Windows security events, including Kerberos service ticket requests (Event ID 4769). It extracts fields such as the service name (SPN) and ticket encryption type. This directly supports identifying Kerberoasting, where attackers request service tickets with weak RC4 encryption for high-value SPNs. This data source is purpose-built for identity threat detection and provides the required evidence.

Domain Administrator accounts hold near-unrestricted rights across the directory, including credential and configuration changes, making them prime targets for privilege escalation and persistence. Monitoring their authentication patterns and group modifications surfaces anomalous behaviour that standard user accounts could never produce.