SOC Sentinel detected a credential breach 4 hours before the client’s SIEM

The Challenge

The client's MSP had a functioning SIEM and a contracted MSSP covering 24/7 monitoring. On paper, the security posture looked solid. But the SIEM was configured to alert on known-bad signatures and threshold-triggered rules — it wasn't correlating identity telemetry from the IdP against endpoint behavior in real time.

When Intelligent Group proposed AiT SOC Sentinel as an oversight layer, the MSP's security lead was skeptical. "We already have a SIEM," was the initial response. The answer was simple: Sentinel doesn't replace the SIEM. It ingests independently from the same sources and cross-correlates across identity, endpoint, cloud control planes, and network egress — the data the SIEM was watching, plus the log sources it wasn't.

• SIEM coverage limited to signature-based and threshold detections
• IdP audit logs not correlated against endpoint telemetry in real time
• MSSP ticket lag: average alert-to-ticket time was 45 minutes
• No independent reconciliation layer to validate MSSP coverage
• Credential stuffing attacks increasingly bypassing perimeter rules

The Incident Timeline

At 02:14 AM, an attacker using credentials obtained from a dark-web dump began authenticating against the client's Entra ID tenant from three geographically inconsistent IP addresses simultaneously. The SIEM's impossible-travel rule had a 6-hour lookback window and was tuned to reduce alert fatigue — it didn't fire.

AiT SOC Sentinel, ingesting directly from the Entra ID audit log on a near-real-time cadence, correlated the three concurrent sign-in events against the user's baseline location, device fingerprint, and session history within 8 minutes. Sentinel flagged the session as high-confidence credential compromise and raised a critical alert to the MSP's on-call engineer at 02:22 AM.

The SIEM fired its own alert at 06:34 AM — four hours and twelve minutes after Sentinel's detection.

• 02:14 AM Attacker begins credential stuffing from 3 geolocations simultaneously
• 02:22 AM AiT SOC Sentinel raises critical alert to MSP on-call — 8 minutes after first sign-in
• 02:35 AM MSP engineer forces session revoke and locks account; no lateral movement
• 02:50 AM Attacker attempts re-authentication; blocked. Incident contained.
• 06:34 AM SIEM fires impossible-travel alert — 4 hours 12 minutes after Sentinel

The Solution

AiT SOC Sentinel was deployed three weeks before the incident. During deployment, the Intelligent Group team ingested the client's Entra ID audit log, CrowdStrike telemetry, M365 control plane events, and network egress logs into Sentinel's reconciliation engine. The baseline behavioral model for each account was built over the first 10 days of ingestion.

The credential stuffing detection that caught this attack was not a signature rule. It was a behavioral anomaly: three simultaneous sessions for the same identity from IPs that had never authenticated to this tenant before, against a baseline where that user had authenticated exclusively from two known office IPs for the past 90 days.

• Independent telemetry ingest from IdP, EDR, cloud control planes, and network egress
• Behavioral baseline model built per-identity over 10-day onboarding window
• Cross-source correlation: IdP anomaly correlated against endpoint and network silence
• Critical alert with session context to MSP on-call within 8 minutes of first anomalous sign-in
• Actionable response: specific session tokens flagged for forced revoke

Results

Without the 4-hour detection advantage, the attacker had a clear window to establish persistence and begin staging a ransomware payload. Average ransomware recovery cost for a 150-employee professional-services firm: $350K–$800K (2026 benchmark).

In Their Words

What’s Next

Following the incident, the client expanded the Sentinel deployment to include automated response actions on high-confidence credential compromise detections — no longer waiting for the on-call engineer to manually revoke sessions. Phase 2 connects Sentinel to the MSSP SLA review cycle: quarterly blind-spot reports now go directly into the MSSP renewal negotiation.

• Automated session revoke on high-confidence credential compromise
• Expanded telemetry: network proxy logs and SaaS OAuth token monitoring added
• Quarterly MSSP blind-spot reports for SLA and renewal negotiations
• SOC Sentinel self-serve tier rollout for the MSP's other mid-market clients