Directory Services Protector

Analyzes identity telemetry (authentication events, access patterns, privilege use) in real time with behavioral baselines and risk scoring; leading implementations detect identity attacks in sub-second time.

Executes response actions against active identity attacks through playbooks with configurable automation: session revocation, credential reset, account isolation, inline step-up authentication or access denial at the identity provider, and follow-up policy and configuration hardening so the same attack cannot recur.

Restores the identity environment to a known-good state after an identity attack - directory object and configuration rollback, trust re-establishment, and post-incident hardening of the IAM estate.

Reconstructs an identity incident end to end (authentications, token issuance, MFA events, privilege and group changes, directory and policy modifications) into an identity-centric timeline with blast-radius context, so analysts can scope a compromise and choose the right remediation quickly. Distinct from generic SIEM case management: the pivot is the identity and the IAM objects it touched.

Detects named identity attack techniques with purpose-built detection content: password spraying, credential stuffing, pass-the-hash and pass-the-ticket, Kerberoasting, DCSync and DCShadow, golden and silver tickets, and consent phishing of OAuth applications, each mapped to MITRE ATT&CK so technique coverage can be verified against known identity attack scenarios. Complements Identity Behavioral Analytics (anomaly-based) and Identity Infrastructure Attack Detection (attacks on the IAM control plane).

Detects attacks on the IAM infrastructure itself: misuse of directory and identity provider administrator credentials, changes to token-signing certificates and federation trust, tampering with conditional access, MFA, and admin role configuration, and other signs that an identity tool has been compromised, continuously monitoring root and global administrator accounts and their configuration changes.

Exchanges identity risk signals with identity providers, IGA, PAM, endpoint, and SIEM or SOAR platforms through bidirectional integrations and the Shared Signals Framework (CAEP, RISC), so a detection can revoke a session or force step-up in the identity provider within seconds and lands in the SOC as an enriched, correlated alert instead of a siloed one.