Threat detection: one login is not the whole story

An unfamiliar IP address is a lead, not proof of a breach. People travel, VPNs change locations and automation runs outside office hours. Effective threat detection connects a suspicious event to what happened before and after it.

Start with the evidence you can actually collect

Inventory identity sign-ins, administrative changes, cloud API activity and endpoint telemetry. For each source, record its owner, retention period and delivery delay. Confirm which events require additional logging or licensing; not every provider records every action by default.

Test delivery with a harmless, approved action, such as a test-account sign-in or a permission change in a sandbox. Check that the event arrives with a usable timestamp, actor, target and result. A dashboard that looks healthy can still have a missing data source.

Correlate a sequence, not a single anomaly

Consider an illustrative account-takeover sequence: repeated MFA denials, an unexpected approval, a new device, then a broad OAuth grant. Each event has possible benign explanations. Together, they warrant investigation.

• Join by identity and time. Normalize user IDs and timestamps before grouping events. Keep the original records available for review.
• Add context. Check device history, expected automation, approved changes and the sensitivity of the affected resource.
• Show uncertainty. A confidence score is not a verdict. Document both the evidence supporting compromise and the explanations still unresolved.
• Assign an owner. Every escalation needs someone responsible for the next decision, not merely a destination inbox.

Test your detection coverage

Run approved simulations in a test environment and confirm that expected signals produce an actionable incident. Track missed scenarios, investigation time and false positives. Tune exceptions narrowly, with an owner and review date; suppressing an entire user or service can hide the next attack.

BlackPing's Detect–Decide–Contain approach puts evidence before action: collect the signals, review the reasoning and let a named human approve containment. Start with one well-tested scenario rather than a hundred rules nobody can explain.

Further reading

Use MITRE ATT&CK (attack.mitre.org) to map detection coverage to adversary behaviors, and CISA's logging guidance (cisa.gov) to review collection and retention practices. A technique map is a planning aid, not proof that a detection works in your environment.