Security Live in production

Suspicious Sign-In Investigation

Pull a user's recent sign-in activity into one summary card and offer an approval-gated containment action, fully audited.

Integrates with

Entra IDOkta

The problem

When a sign-in looks off, triage means digging through logs across the identity provider, correlating locations and outcomes, then deciding whether to act. Under time pressure, that work is inconsistent from one analyst to the next.

What AscendCore does

An admin runs the investigation on a user from Slack or Teams. AscendCore pulls recent sign-ins from Okta and, where the tenant grants sign-in log access, Microsoft Entra ID (Entra sign-in history requires Entra ID P1) into one card: locations, IPs, failures, and risk signals where the tenant licenses Entra ID P2 Identity Protection. It offers an approval-gated containment action (revoke sessions, suspend sign-in, reset MFA), and even a dismissed investigation records the full report. The investigation and any action are recorded in the audit chain.

Status

Live in production. Runs against real tenants today from Slack and Teams. The Okta sign-in tier works whenever Okta is connected; the Microsoft Entra ID sign-in tier requires AuditLog.Read.All and Entra ID P1 for sign-in history, with risk signals surfaced only where the tenant licenses Entra ID P2 Identity Protection, and the card is explicit about which data it could pull. It offers an approval-gated containment action (revoke sessions, suspend sign-in, reset MFA), and even a dismissed investigation records the full report on the audit chain. The signals surfaced and containment options are configurable per customer.

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do. Chat is just the interface that triggers it.

name: suspicious-signin-investigation
trigger:
  channels: [slack, teams]
  command: investigate-signins
steps:
  - resolve_target_user
  - pull_recent_signins        # locations, outcomes, risk
  - render_summary_card
  - admin_approval             # optional containment
  - contain_if_approved
approval:
  required: true
  approvers: [it-admins, sec-team]

Ready to deploy

Run suspicious sign-in investigation from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.

See plans & pricing Browse all runbooks

More security runbooks

Live

Conditional Access Policy Review

Review current conditional-access posture, flag common gaps, and record the reviewed findings on the tamper-evident audit chain with approval; policy changes remain manual.

Live

Endpoint Containment

Lock a suspected-compromised user's Intune-managed devices and contain their account (sign-in disabled, sessions revoked) with one approval and a security-namespaced audit row.

Live

Security Alert Triage

IT-admin-initiated security triage: invoke /alert-triage on a user account when you spot suspicious activity, AscendCore proposes account suspension pending investigation, suspension executes only on explicit approval. Distinct security-event audit namespace for SOC-2 evidence separation.