ITDR Lab
Identity is the new perimeter, and an identity attack hides in one line of a noisy sign-in feed. Work a stream of decoded identity-signal events and make the call on each: benign, or name the attack — an impossible-travel session, an MFA-fatigue flood, OAuth token abuse, a dormant account waking up, a password spray, a privilege-escalation role grant, MFA tampering, or a golden-SAML forgery — then pick the containment: step-up, revoke, disable, or open an IR case. You are scored on detection rate against false positives, because flagging a benign VPN hop or a ticketed role grant is its own failure. Clear the feed clean.
The real job. More noise, a tighter clock.
Identity-signal feed
Triage as of snapshot 2026-10-14 10:00 UTC: name the identity attack (or call it benign), then pick the response.
#1
alice.tan@northwind.com
Two interactive sign-in successes ~27 minutes apart from different continents.
context: Sales rep, baseline is Chicago business hours. No travel on calendar.
#2
180 distinct accounts
One failed sign-in each against 180 different users from a single source, one password.
context: Tenant has 4,100 users. No single account is being hammered.
#3
raj.patel@northwind.com
43 MFA push notifications in 8 minutes, then one approval from a new device abroad.
context: User in Austin, phone normally registered to a managed iPhone. User later says they "tapped to stop the buzzing".
#4
dana.k@northwind.com
Authenticator removed and a new MFA method enrolled from an unmanaged device, then login.
context: No IT help-desk ticket and no self-service reset request precedes the change.
#5
omar.said@northwind.com
Sign-ins from two cities an hour apart — both from the corporate VPN egress.
context: Corp VPN back-hauls to regional gateways; geo on the IP reflects the gateway, not the user.
#6
svc-nightly-etl (service principal)
Non-interactive token used from the datacenter at the usual 02:00 batch window.
context: A service account for the nightly data pipeline; baseline is this exact pattern every night.
#7
contractor-lee (ex-vendor)
Account silent for 412 days authenticates and grants OAuth consent.
context: Offboarding should have disabled this account; it was missed.
#8
priya.n@northwind.com
User consents to a third-party app requesting broad, offline mailbox+file scopes.
context: This is an illicit-consent-grant ("OAuth phishing") — no password is stolen; the user is tricked into granting an app.
#9
mark.d@northwind.com
A standard user is added to Global Administrators at 03:10, off change-window.
context: Role changes to Global Admin require a ticket and must happen in the business-hours change window.
#10
sofia.ruiz@northwind.com
61 MFA prompts in 15 minutes — every one denied, none approved.
context: The password is clearly known to an attacker, but the user held the line and no prompt was approved.
#11
webapp-prod (service principal)
A refresh token is exchanged for a new access token from the same app and host.
context: OAuth refresh tokens are meant to be exchanged for access tokens; rotation is healthy, not replay.
#12
nina.ok@northwind.com
A user is added to an admin role during the change window with a linked ticket.
context: Role grants are allowed when ticketed, in-window, and performed by an established admin.
#13
tom.vance@northwind.com
Laptop session in New York, then a mobile sign-in in London 70 minutes later.
context: No VPN on either session; both are direct ISP egress. User has no dual-presence explanation.
Detection + containment
Call each event, then grade. So far 0/13 triaged, 0/9 attacks detected, 0 false positive(s).
How it is scored
Full credit needs BOTH the right detection and the right response — spotting the attack is half the job, the right containment is the other half.
A false positive (flagging benign activity) takes an extra hygiene bite — an identity queue that cries wolf burns the same trust as one that misses.
Harder tiers add subtler attacks and deliberate traps (VPN/CGNAT geo hops, normal token rotation, ticketed role grants, sanctioned break-glass).
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based Identity Threat Detection & Response (ITDR) lab: work a feed of ~18 decoded identity-signal events and, for each, name the identity attack (or call it benign) and pick the containment.
- Attacks seeded across the feed: impossible travel, MFA fatigue / push bombing, OAuth token abuse (illicit consent grant and token replay), dormant-account reactivation, password spray, privilege-escalation / role-grant anomaly, MFA disabled / method tampering, and golden-SAML forged assertions.
- Responses you choose from: step-up re-auth + credential reset, revoke sessions/tokens, disable the account, open an IR case, or leave a benign event alone — and full credit needs the right detection AND the right response.
- You are graded on detection rate weighed against false positives — flagging normal activity (a VPN geo hop, a normal token refresh, a ticketed role grant, sanctioned break-glass) takes an extra hygiene penalty.
- All signals are read against a fixed snapshot window, and after grading every event explains why that detection and that response are right.
Frequently asked questions
What is the ITDR Lab?
A free, in-browser Identity Threat Detection & Response exercise. You read a feed of decoded identity-signal events — sign-in geo and velocity, egress IP/ASN, device posture, MFA prompts and approvals, security-info and MFA-method changes, OAuth consent and token flows, directory role grants, and SAML assertions — and for each event you make two calls: which identity attack it is (or benign), and the correct response. You are scored on how many real attacks you detect and contain correctly versus how many benign events you wrongly flag.
Which identity attacks does it cover?
Impossible travel, MFA fatigue / push bombing, OAuth token abuse (both illicit consent grants to rogue apps and replay of stolen tokens), dormant-account reactivation, password spray, privilege-escalation / role-grant anomalies, MFA disabled or method tampering as ATO persistence, and golden-SAML forged assertions. Benign events — including deliberate false-positive traps like VPN/CGNAT geo hops, normal refresh-token rotation, ticketed in-window role grants, and sanctioned break-glass use during a declared incident — are salted throughout.
How is it graded?
Each event has one correct detection and one correct response, and full credit needs both — spotting the attack is half the job, choosing the right containment (step-up, revoke, disable, or open an IR case) is the other half. False positives — flagging a benign event as an attack — carry an extra hygiene penalty, because an identity alert queue responders cannot trust is as useless as one that misses attacks. A perfect run calls every event exactly right, benign ones included.
Does it connect to my identity provider?
No. Nothing is uploaded and no real IdP, directory or log is touched. The events are authored, realistic decoded identity-signal snapshots bundled with the page, and every call is made against a single fixed snapshot window so the feed is deterministic and never goes stale. It runs entirely in your browser — no account, no install, nothing sent anywhere.
Who is it for?
SOC analysts, identity and access engineers, and detection-and-response teams who triage sign-in risk and directory events, plus anyone prepping for a security interview who wants to feel why impossible travel means revoke, an unanswered MFA flood means step-up, a disabled MFA method means disable, and a password spray or golden-SAML event means open an IR case — and why a VPN geo hop or a ticketed role grant is not a finding at all.