Identity Threat Detection & Response (ITDR)

Attack scenario

Same account authenticates from two geolocations too far apart to have travelled between the timestamps.

UEBA risk

Risk score

Active alerts

Accounts monitored

Logins / min

Legend

User account (baseline) Identity provider (IdP) Flagged by UEBA rule Attempted / spray source

Nodes = accounts in the tenant directory. Arcs = live authentication events flowing to the IdP hub. Drag to orbit, scroll to zoom.

— not started —

No detections yet. Press Start, then trigger a scenario.

⚠️ 3D engine failed to load.

Check your connection and reload the page.