IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Detection engineering — finding attacks in logs
Zara knows she cannot prevent everything. Some phish will land. Some cookie will leak. So she builds tripwires: alarms that fire when an attack from this track shows itself. Your goal: match each attack to a detection, and tune it so people trust it.
- Each attack leaves a pattern in the logs. A detection is a rule for that pattern.
- Good rules catch real attacks and stay quiet otherwise.
- Combine weak signals into one risk score, and allow-list known-good behavior.
- Link detections to automatic response, and tell every app with shared signals.
From logs to tripwires
Every sign-in, token, MFA prompt, consent grant and recovery change leaves a signal. Alone, this identity telemetry is just noise in a log (see Identity telemetry & SIEM). Detection engineering turns that noise into a small set of good detections. A detection is a rule: "this pattern means an attack, wake someone." The skill is firing on real attacks and staying quiet the rest of the time.
One detection for each attack
🌍 Impossible travel
The same account signs in from two places too far apart to travel between in that time. It is a sign that a phished session is used from the attacker's machine.
🔔 A burst of MFA denials
Many denied or ignored prompts in a short time are the mark of MFA fatigue. Six "no" taps in two minutes is someone hoping for one "yes".
🆕 New device plus a high-value act
A brand-new device that, minutes after its first sign-in, changes a payee or exports data. A new device alone is fine. New plus an immediate sensitive act is the tell.
📝 Consent to an unverified app
An OAuth grant to an app with no verified publisher, or one just registered. This is the trace of consent phishing.
🍪 Cookie used from a new IP
The same session cookie shows up from a different IP address or network. This is the mark of session hijacking, unless the session is bound.
🔑 A change to recovery
A recovery email, phone or passkey is added or swapped, most of all right after a help-desk reset or from a new device. An attacker builds this back door after a recovery attack.
Maya's account signs in from her usual city at 9 a.m. At 9:04 it signs in from another continent. Zara's rule scores it high, and the session is challenged before the attacker can touch a payee. No human read a log.
Real alerts against false alarms
Set every rule to maximum sensitivity and you catch every attack. You also bury Zara in false positives. The impossible-travel rule fires on Sam each time he opens his VPN, because it exits in another country. It is like a smoke alarm that rings whenever you fry onions: people take out the battery, and the one real fire is lost.
So detection engineering is tuning: catch the most real attacks with the fewest false alarms. Zara uses risk scoring. It combines weak signals into one severity number, instead of alerting on each. She also keeps an allow-list of known-good behavior, like Sam's VPN and Bot A's data-center IP.
From detection to automatic response
A detection that only emails a person works at human speed. That can mean hours, if Zara is asleep. So connect high-confidence detections to automatic response:
- Medium risk: step-up, meaning a fresh phishing-resistant challenge.
- High risk: revoke sessions and refresh tokens.
- Worst cases: disable the account.
The response should not stop at your own walls. CAEP shared signals (see CAEP & Shared Signals) let one detection push a signed "session revoked" event to every app at once. This is part of your ITDR practice. Detection is half the loop; response is what saves Maya.
Go deeper: Where detection ideas come from
The MITRE ATT&CK catalog lists, for each attacker technique, ways to detect and reduce it. For example, its page for MFA request generation (T1621) suggests alerting on too many MFA requests, especially from unusual IP addresses. It also suggests alerting on repeated denied or timed-out challenges. Reading these pages helps you turn a technique into a rule you can test.
Speed checks help too: too many sign-ins, too fast.
🧪 Interactive lab — enable JavaScript to play with this one.
See whether your issuer can send these signals. Validate a Shared Signals or CAEP transmitter and a sample SET with SSF Check. Then grade your session-cookie hardening (the raw material for a cookie-reuse detection) with Cookie Check.