Compromised-account investigation

When to use

Use this guide when you need to investigate a suspected identity compromise and prepare evidence-backed containment options.

What you need

Replace these bracketed values before you copy the prompt.

• userRequired

  Suspected compromised identity.

• time windowOptional

  Optional bounded investigation window.

• indicatorOptional

  Optional alert, IP, application, or observed behavior.

Information used

Stackyapper uses only the Apps and permissions available to the current user.

• Identity securityRequired
• User directoryIf available
• Mailbox settingsIf available
• Groups and accessIf available
• Directory devicesIf available
• Security findingsIf available
• Service ticketsIf available
• DocumentationIf available

Expected output

• Incident timeline
• Indicators and evidence
• Affected scope
• Severity and confidence
• Containment and recovery plan

Steps

1. Collect relevant identity alerts, incidents, and sign-in evidence.
2. Review current account, mailbox, group, and device context for suspicious changes.
3. Correlate other security findings, tickets, and approved incident runbooks.
4. Separate confirmed indicators from suspicion and propose containment steps requiring approval.