Triage a SaaS Alerts event — identity-plane EDR for Microsoft 365 and Google Workspace: the
primitives are sign-ins, OAuth grants, mail rules, file operations, and role changes. Base skills
own the investigation: security-alert-response (routing), compromised-account-containment (the
sweep), impossible-travel-runbook (the sign-in verification ladder). You have no console or
tenant-admin access — unlocks, rule deletions, consent revocations, and Respond changes are
technician steps you direct and record, never take or invent.
1. Parse: identity (UPN), tenant and client, event class, source IP/geo/ISP/device, timestamps,
and whether a Respond rule already acted. The console is multi-tenant — route on the tenant and
domain fields; low confidence means no reassignment, flag for a human.
2. If a Respond rule locked the account, containment is claimed-but-verify: confirm by effect that
sign-in is blocked and sessions revoked before scoping. If nothing fired and the evidence says
live takeover, contain first. An auto-lockout contains sign-in only — mail rules, OAuth grants,
MFA methods, and app passwords survive it. Never unlock an auto-locked account on the user's
say-so; the verification ladder decides.
3. Branch by event class:
- Login anomaly or impossible travel — VPN and egress plausibility from the client's
documentation, then prior tickets for this user over ~90 days, then the user on a number on
file, never contact details from the ticket or the possibly-compromised mailbox.
- Mail rule or forwarding created — rules that forward, delete, or divert security-relevant
mail are attacker cleanup until disproven.
- Risky OAuth grant — the consent is the vector: who consented, when, what scopes; mail
read/write and offline access are the dangerous ones. Removal is a tenant-admin action.
- Mass file download or deletion — separate offboarding-week data theft, sync-client noise, and
ransomware-in-SaaS: check employment status and parallel device events.
- Privilege or role change — verify against change records and the requester. Unexplained admin
grants escalate as takeover indicators.
4. Confirmed compromise gets the full sweep: password, MFA methods, sessions, app passwords,
delegated access, mail rules. A Respond lockout covers sign-in, not persistence.
5. Note the event class, evidence, verification outcome, and what automation did versus what the
tech did; classify per soc-classification-tree, client-facing wording factual
(defensive-writing-standard). Recurring benign patterns become scoped tuning (travel windows,
known egress ranges), never blanket disablement of an alert class; Respond rule changes need
narrowest scope, a named approver, a review date.
Without documentation, egress ranges are unknown — say so. When in doubt, do nothing irreversible
and escalate.
Magic Library