A rarely used account.
An unexpected source of sign-ins.
Ten minutes after deploying Vigil Alerts at St Johnstone FC, the team identified a rarely used account being logged into from a data centre IP address.
St Johnstone FC
Sign-ins from a data centre IP
10 min
The account that needed a closer look
The account was hardly used. After deployment, Vigil Alerts brought attention to sign-in activity associated with a data centre IP address, giving the team a specific account and connection to investigate.
Why the context mattered
A sign-in record is more useful when the team can relate it to how an account is normally used. Here, the combination of limited normal use and the source of the connection made the activity worth reviewing.
A data centre IP address does not, on its own, establish that an account has been compromised. The finding provided a lead for the team to investigate rather than a conclusion about who was accessing the account.
10 minutes
The activity was identified ten minutes after Vigil Alerts was deployed. That timing describes this deployment; it is not a guaranteed detection time for every tenant or event.
Review sign-ins in your own environment.
Vigil Alerts helps engineers review Microsoft 365 sign-ins with account, IP address and location context. It can be self-hosted or supplied as a dedicated hosted installation.
Discuss a demonstration