Background of ITDR (Identity Threat Detection and Response)

There is a growing awareness of the need to manage and protect identity systems related to user authentication.

Among the threats surrounding Identity, the biggest threats are account hijacking and account impersonation.

Account credentials are the top priority for attackers trying to break into cloud environments, and at the same time, they are the information we must protect.

Credentials for “privileged accounts” are especially important for both attackers and defenders.

Once an attacker has a privileged account, they can evade detection by security tools, create new privileged accounts, and operate freely within the environment.

One of Vectra AI's CDRs, "Detect for Azure AD," is a new solution that visualizes, detects, and responds to threats within Azure AD in response to attacks specific to Azure AD.

Attacker action phase and solution coverage

Vectra AI's ITDR Solution Detect for Azure AD

Visualize all access status managed by Azure AD and detect suspicious access under unusual conditions. In addition, by detecting account behavior such as unauthorized account creation, MFA evasion, and suspicious privilege escalation, it is possible to quickly notice intrusion by attackers.

This solution has the following characteristics:

simple introduction

• About 10 minutes from installation to start of operation
• Agentless deployment

High precision detection

• Detection logic following the MITER framework
• Suppression of false positives

Operate with low load

• Automated detection, triage and prioritization ^based on Attack Signal Intelligence*
• Realization of speedy response
• Centralized management from on-premises to cloud environments

Introduction flow

Since it is provided as SaaS, the necessary processes from introduction to operation start can be completed in about 10 minutes.

Please contact us if you would like a free trial.

STEP1

Detect for Azure AD trial registration

STEP2

Creation and registration of SaaS sensors

STEP3

Checking Azure AD admin rights

STEP4

Allow Azure AD Log Access Permission

STEP5

Setup complete

Vectra AI MDR（Management Detection and Response）

Vectra MDR (Threat Detection and Response Operations) Service

Combining Vectra's detection capabilities with the human intelligence of our team of analysts, we can respond more quickly to unknown threats.

Even after product introduction, the operational burden of your own SOC will not increase.
Our team of Vectra analysts is available 24/7 with their expertise.

Vectra AI's analyst team will use Vectra AI to monitor the customer's environment on behalf of the customer, as well as propose thread hunting and product usage optimization using Vectra AI.