respond-compromised-account

Contain compromised accounts by integrating SIEM and behavioral data to identify threats, then revoking active sessions and credentials to restore secure access with auditable steps.

Yes, this Skill uses SOAR integrations to coordinate containment for impossible travel incidents, requiring analyst confirmation before executing any containment actions against the compromised account.

Eradicate persistence during account recovery by verifying clean endpoints, removing malicious access, and monitoring for recurrence to prevent further unauthorized activity.

Yes, this incident response workflow explicitly requires analyst confirmation before executing containment actions, ensuring human oversight when revoking sessions and credentials during a compromised account investigation.

Eradicate persistence after a phishing compromise by following the Skill's workflow to verify clean endpoints, remove malicious access tokens, and monitor for recurrence using integrated GTI and identity tooling.