Risk Radar
Risk Radar Detectors use machine learning to establish behavioral baselines from audit logs - per user, device, and time of day - and then score new activity for anomalies. They help identify uncommon workstation actions, unusual sign-in locations, and spikes in activity that may indicate security issues or configuration problems.
Risk Radar also provides Posture Detectors, which assess the configuration of your environment rather than baselining activity over time.
Risk Radar detects and reports. If an attack leaves Active Directory unusable, Introduction recovers it, from a single domain controller up to the entire forest.
To open Risk Radar, navigate to System Tools / Risk Radar.
Overview
- Each detector is enabled by adding an instance. Some detectors are system-wide and support a single instance, some support multiple (e.g. per domain). Use the Add Instance link to add and configure a new instance.
- Detectors may be edited to adjust thresholds or parameters to fit the customer environment.
- The Event Spike detector runs hourly.
- All other detectors run daily at the end of the day.
System Requirements
Risk Radar Detectors rely on a local Python runtime to execute the embedded machine learning models. Before using this feature, ensure the following components are installed on the Windows server hosting the Auditor service:
- Python for Windows (version 3.10 or later)
- pandas library (
pip install pandas) - Any pandas prerequisites such as
numpyorpython-dateutilif not already present
The detectors will not execute until these components are available. If the environment is offline, packages may be installed manually using local wheels from the official Python repository.
Event Detectors
Active Directory action from an uncommon workstation
Detects when a user performs an AD action from a workstation they don’t typically use. The rule baselines each user’s common devices and flags outliers that may indicate credential misuse or lateral movement.
Categories: Active Directory, Login, Logon, Workstation
AD – Stale Identity Exposure Detector
Identifies inactive or never-used Active Directory user and computer accounts that increase attack surface over time.
Categories: Account Lifecycle, Active Directory, Attack Surface Reduction, Identity Hygiene, Inactive, Login, Logon, Stale
Burst of Failed Logins from the same User
Detects accounts with an unusually high number of failed login attempts within a short period, indicating potential brute-force or password-guessing activity.
Categories: Active Directory, Login, Logon, Spike
Burst of Failed Logins from the same Workstation
Identifies Active Directory IP sources that generate unusually high volumes of failed login attempts or target multiple user accounts within a short period, indicating potential brute-force or credential-stuffing activity.
Categories: Active Directory, Address, Login, Logon, Spike, Workstation
Empty Groups
Identifies groups that have no direct members and may no longer be needed. (Requires Recovery for Entra ID or Recovery for Active Directory)
Categories: Access Review, Active Directory, Entra, Group Hygiene, Identity Hygiene
Entra Groups With No Recently Active Members
Identifies Entra ID groups whose evaluated direct members show no observed recent activity and may no longer be needed. (Requires Recovery for Entra ID)
Categories: Access Review, Entra, Group Hygiene, Identity Hygiene
Entra ID login from an uncommon client
Detects when a user logs into Entra ID from an uncommon client. The rule compares login network address against the user’s recent history to surface possible account compromise.
Categories: Entra, Login, Logon, Sign in, Signin, Workstation
Entra ID login from an uncommon location
Detects when a user logs into Entra ID from an uncommon location or network. The rule compares login geolocation and network characteristics against the user’s recent history to surface possible account compromise or risky travel.
Categories: Entra, Location, Login, Logon, Sign in, Signin
File and Directory Permissions Modification
Identifies when new permissions grant elevated access (such as Full Control or Modify) to users or groups on a folder. Focuses on newly added “Allow” permissions that increase access, which may expose sensitive data or indicate misconfiguration or malicious activity.
Categories: File System, Mitre, T 1222
Impossible Travel Detection
Detects user logins that would require physically impossible or highly improbable travel speeds between consecutive authentication events.
Categories: Authentication, Entra, Geo Anomaly, Identity Risk, Mitre, T 1078, T 1090
Mass File Modification / Encryption Behavior Detector
Detects abnormal high-volume file modification activity within a defined time window that may indicate bulk encryption behavior (MITRE T1486).
Categories: File System, Mitre, Ransomware, T 1486
Spike in audit event counts in a given hour
Detects a sudden spike in audit event volume within a single hour. The rule compares the current hour’s count to a learned baseline, flagging surges that may indicate loops, misconfiguration, or attacks.
Categories: Spike
Stale Entra ID Accounts
Identifies Entra ID accounts with no observed activity for an extended period based on available audit data. (Requires Auditor for Entra ID and Recovery for Entra ID)
Categories: Access Review, Entra, Group Hygiene, Identity Hygiene
