See how AirMDR closes a case.

Microsoft 365 · Sign-in alert

Sign-in from a new location: Chicago, IL

BENIGN

Sarah's calendar says she's at a marketing conference in Chicago this week. The sign-in matches, MFA cleared. Nothing to worry about.

CrowdStrike · Suspicious process

PowerShell called out to a flagged IP

MALICIOUS

A finance workstation ran PowerShell three minutes after the user opened an unknown attachment. The IP it called out to is flagged. Looks like phishing.

AWS · CloudTrail alert

S3 bucket policy changed to public read

MALICIOUS

An IAM user that hadn't been touched in 60 days suddenly opened a customer-data bucket to the internet. Nothing benign explains it.

Google Workspace · Data access

Bulk file downloads from Drive

BENIGN

Marcus is off the team on Friday. He spent this morning archiving his own drafts and moodboards before offboarding. Matches the HR ticket.

Okta · Admin action

MFA disabled on an admin account

NEEDS ATTENTION

The IT lead turned MFA off on a service account so the Zendesk integration would work. Legit reason, but nothing in the change log. Worth a two-minute confirmation.

Okta · Failed sign-in

Repeated failed sign-ins on an ex-employee's account

BENIGN

Priya left the company in June. Her old laptop's password manager is still trying to sign her in every few hours. Time to disable the account.

Google Workspace · Impossible travel

Sign-ins from New York and London, 40 minutes apart

BENIGN

Same user, but the London session hit the company's VPN. DevOps was running latency tests overnight, confirmed in their Slack thread.