[soc]2026-01-016 min read

Triaging a suspicious sign-in alert

A repeatable checklist for deciding whether an unusual sign-in is benign, risky or a confirmed compromise.

Start with context

Before touching the logs, write down what triggered the alert: the user, the time, the source IP and the rule that fired. Most false positives become obvious once you know whether the user travels, uses a VPN or recently changed devices.

Pull the sign-in history

Compare the flagged sign-in against the user’s last 24 hours. Look for new locations, new applications and failed attempts just before the success.

kql

SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName == "user@example.com"
| project TimeGenerated, IPAddress, Location, AppDisplayName, ResultType
| order by TimeGenerated desc

Decide and document

Check the IP against AbuseIPDB and VirusTotal, confirm with the user through a separate channel, then close, escalate or contain. Record each step so the next analyst can follow your reasoning.

#soc#sentinel#triage