Suspicious login investigation

Investigate unusual authentication activity using source IP, account, time, geolocation, MFA, and privilege context. Recommend validation steps and avoid changing ticket status.

sec-link Updated

File contents

Suspicious login investigation

Investigate unusual authentication activity using source IP, account, time, geolocation, MFA, and privilege context. Recommend validation steps and avoid changing ticket status.

Output requirements:

  • Cite observed evidence from the ticket.
  • Mark unknown values as unavailable.
  • Return structured JSON fields when requested.
  • Do not change ticket status or execute commands.

sec-link/argus-agentic-soc-platform/tree/main/backend/skills/suspicious-login-investigation commit 985fc51160

Frequently asked questions

npx skillmds@latest add sec-link/suspicious-login-investigation