# Example: User Security Investigation Report

**Status:** LOW RISK — Strong MFA posture with one open incident requiring review
**Investigation Type:** User Security Investigation (7-day)
**Date:** February 2026
**Generated by:** GitHub Copilot in Agent mode with Claude Opus 4.6
**Classification:** Example Investigation (PII Scrubbed)

---

## About This Example

This is a sanitized copy of an actual user investigation report generated by the `user-investigation` skill. All personally identifiable information has been replaced with generic placeholders. The structure, risk scoring methodology, and analysis patterns are preserved to demonstrate the investigation workflow.

---

# User Security Investigation Report

| Field | Value |
|-------|-------|
| **Subject** | Alex Johnson (`alex.johnson@contoso.com`) |
| **User ID** | `a1b2c3d4-e5f6-7890-abcd-ef1234567890` |
| **Investigation Period** | 2026-02-05 to 2026-02-12 (7 days) |
| **Report Generated** | 2026-02-12 15:32 UTC |
| **Sentinel Workspace** | la-contoso (`12345678-abcd-ef01-2345-678901234567`) |
| **Analyst** | Copilot Automated Investigation |
| **Risk Score** | 🟡 **25 / 100 — LOW** |

---

## Executive Summary

Alex Johnson (`alex.johnson@contoso.com`) is a **Security Operations Analyst** in the **Security Operations** department, based in **Seattle**. Over the 7-day investigation window (Feb 5–12, 2026), the account generated **8,827 sign-in events** across **2 countries** (US, CA) from **5 prioritized IP addresses**. One **HIGH-severity open incident** (#2450 — Defense evasion) requires immediate attention. Six additional incidents were closed as **BenignPositive**. The account has **strong MFA** including a FIDO2 passkey (device-bound, attested) and multiple Windows Hello for Business keys. Identity Protection risk was **dismissed by admin** on Feb 6. No DLP events or threat intelligence matches were found.

**Overall Assessment:** 🟡 LOW risk. The open HIGH-severity incident warrants review, but the account posture is strong with phishing-resistant credentials and consistent geographic activity.

---

## Table of Contents

1. [Key Metrics](#key-metrics)
2. [User Profile](#user-profile)
3. [MFA & Authentication Methods](#mfa--authentication-methods)
4. [Identity Protection](#identity-protection)
5. [Sign-In Anomalies](#sign-in-anomalies)
6. [IP Intelligence](#ip-intelligence)
7. [Sign-In Activity](#sign-in-activity)
8. [Registered Devices](#registered-devices)
9. [Audit Log Activity](#audit-log-activity)
10. [Office 365 Activity](#office-365-activity)
11. [DLP Events](#dlp-events)
12. [Security Incidents](#security-incidents)
13. [Risk Assessment](#risk-assessment)
14. [Recommendations](#recommendations)
15. [Appendix — Investigation Timeline](#appendix--investigation-timeline)

---

## Key Metrics

| Metric | Value |
|--------|-------|
| Total Sign-Ins | 8,827 |
| Successful | 8,708 (98.7%) |
| Failed | 119 (1.3%) |
| Unique Locations | 2 (US, CA) |
| Unique IPs (prioritized) | 5 |
| Unique Applications | 66+ |
| Anomalies Detected | 3 (1 Low, 2 Informational) |
| Security Incidents | 7 (1 High/Open, 6 Closed/BenignPositive) |
| Identity Protection Detections | 2 (dismissed) |
| DLP Events | 0 |
| MFA Methods Registered | 15 (FIDO2, WHfB, Authenticator, Phone, Email, Password) |

---

## User Profile

| Property | Value |
|----------|-------|
| Display Name | Alex Johnson |
| UPN | alex.johnson@contoso.com |
| Mail | alex.johnson@contoso.com |
| Job Title | SecOps Analyst |
| Department | Security Operations |
| Office Location | Seattle |
| User Type | Member |
| Account Enabled | ✅ Yes |
| Object ID | `a1b2c3d4-e5f6-7890-abcd-ef1234567890` |
| On-Premises SID | `S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-1103` |

---

## MFA & Authentication Methods

🟢 **Strong MFA posture** — Phishing-resistant credentials registered.

| # | Method | Details | Created |
|---|--------|---------|---------|
| 1 | 🟢 **FIDO2 Passkey** (device-bound) | Microsoft Authenticator - Android, attested | 2025-04-21 |
| 2 | 🟢 **Windows Hello for Business** | CONTOSO-VM | 2025-07-21 |
| 3 | 🟢 **Windows Hello for Business** | CONTOSO-LAPTOP-1 | 2021-10-14 |
| 4 | 🟢 **Windows Hello for Business** | CONTOSO-DESKTOP-1 | 2022-05-01 |
| 5 | 🟢 **Windows Hello for Business** | LAPTOP-ABCD1234 | 2022-05-30 |
| 6 | 🟢 **Windows Hello for Business** | LAPTOP-EFGH5678 | 2022-08-15 |
| 7 | 🟢 **Windows Hello for Business** | (unnamed × 3) | 2020-02 to 2020-10 |
| 8 | 🟢 **Microsoft Authenticator** | Mobile device (v6.2511.7533) | — |
| 9 | 🟢 **Microsoft Authenticator** | Mobile device (v6.2409.5953) | — |
| 10 | 🔵 **Phone** | +1 XXX-XXX-XXXX (mobile) | — |
| 11 | 🔵 **Email** | alex.johnson@gmail.com | — |
| 12 | 🔵 **Password** | Registered | 2022-02-09 |

**Summary:** 1 FIDO2 passkey (attested, device-bound), 8 Windows Hello keys, 2 Authenticator instances, phone, email, password. Primary interactive auth uses **Passkey (device-bound)** — phishing-resistant.

---

## Identity Protection

### Current Risk State

| Property | Value |
|----------|-------|
| 🟢 Risk Level | **None** |
| 🟢 Risk State | **Dismissed** |
| Risk Detail | adminDismissedAllRiskForUser |
| Last Updated | 2026-02-06 23:48 UTC |

### Risk Detections (AADUserRiskEvents)

| Date | Risk Event Type | Risk Level | Risk State | IP Address | Location | Timing |
|------|----------------|------------|------------|------------|----------|--------|
| 2026-02-07 00:03 | unfamiliarFeatures | 🟠 Medium | 🟢 Dismissed | 198.51.100.51 | Seattle, US | Realtime |
| 2026-02-07 00:03 | unfamiliarFeatures | 🟠 Medium | 🟢 Dismissed | 198.51.100.46 | Seattle, US | Realtime |

**Analysis:** Two `unfamiliarFeatures` detections from Seattle IPs (198.51.100.x range) on Feb 7. Both were **dismissed by admin** via `DismissUser` operation (confirmed in AuditLogs — IdentityProtection category). The IPs are from Seattle, consistent with user's office location.

### Risk Detections (Graph API)

✅ No active risk detections found for this user in the investigation period.

---

## Sign-In Anomalies

**Source:** `Signinlogs_Anomalies_KQL_CL` (hourly anomaly detection against 90-day baseline)

| Date | Anomaly Type | Value | Severity | Location | Hits | Baseline | Geo Novelty |
|------|-------------|-------|----------|----------|------|----------|-------------|
| 2026-02-11 22:00 | NewInteractiveIP | 203.0.113.13 | 🟡 Low | CA / Vancouver / BC | 6 | 27 IPs | None |
| 2026-02-11 22:00 | NewNonInteractiveIP | 203.0.113.13 | 🔵 Informational | CA / Vancouver / BC | 4 | 39 IPs | None |
| 2026-02-05 22:00 | NewInteractiveIP | 192.0.2.131 | 🔵 Informational | CA / Victoria / BC | 1 | 27 IPs | None |

**Analysis:**
- 🟡 `203.0.113.13` is a new IP (Example VPN Provider) seen on Feb 11 with 10 total sign-ins via **Windows App - Android**. The IP is flagged as VPN by vpnapi.io. It has 4 open ports (1443, 4000, 7443, 8443). Auth method used: **Passkey (device-bound)** — phishing-resistant, reducing token theft risk. No geographic novelty (Vancouver matches baseline).
- 🔵 `192.0.2.131` is a residential ISP IP in Victoria, BC — single interactive sign-in attempt (failed) to GitHub 1ES. Clean IP, Shodan shows only a Plex Media Server (port 32400). Likely a home network.

---

## IP Intelligence

### IP Summary Table

| IP Address | ISP/ASN | Location | Sign-Ins | Success | Failed | Auth Method | VPN | Abuse Score |
|:-----------|:--------|:---------|:---------|:--------|:-------|:------------|:----|:------------|
| 🔵 20.236.10.66 | AS8075 Microsoft Corporation | Moses Lake, US | 7,434 | 7,328 | 106 | Passkey, Previously satisfied | vpnapi: VPN | N/A (timeout) |
| 🔵 52.148.138.101 | AS8075 Microsoft Corporation | Moses Lake, US | 671 | 666 | 5 | Password, Previously satisfied | vpnapi: VPN | N/A (timeout) |
| 🟢 192.0.2.234 | AS852 Example ISP | Victoria, CA | 438 | 438 | 0 | Previously satisfied | Clean | N/A (timeout) |
| 🟡 203.0.113.13 | AS209854 Example VPN Provider | Vancouver, CA | 10 | 7 | 3 | Passkey, Previously satisfied | vpnapi: VPN | N/A (timeout) |
| 🟢 192.0.2.131 | AS852 Example ISP | Victoria, CA | 1 | 0 | 1 | — | Clean | N/A (timeout) |

> ⚠️ **Note:** AbuseIPDB was unreachable during enrichment (read timeout). Abuse confidence scores are unavailable for this report.

### IP Analysis

- **20.236.10.66** and **52.148.138.101** — 🔵 Microsoft Azure datacenter IPs (Moses Lake, WA). These carry the majority of traffic (8,105 combined sign-ins, ~92%). The VPN flag is expected for Azure cloud infrastructure — this is the corporate cloud proxy or Azure Virtual Desktop egress.
- **192.0.2.234** — 🟢 Clean residential ISP IP in Victoria, BC. 438 non-interactive sign-ins (Teams Graph Service, App Service, Teams Shifts) — consistent with mobile/background app activity from home.
- **203.0.113.13** — 🟡 VPN provider in Vancouver, CA. New IP flagged as anomaly on Feb 11. Used **Windows App - Android** with passkey auth. 4 open ports (1443, 4000, 7443, 8443). Low volume (10 sign-ins). Likely a mobile VPN used for Windows App remote access.
- **192.0.2.131** — 🟢 Clean residential ISP IP in Victoria, BC. Single failed interactive sign-in to GitHub 1ES on Feb 5. Shodan shows Plex Media Server — home network. No concern.

### Threat Intelligence

✅ No IPs matched ThreatIntelligenceIndicator table entries.

---

## Sign-In Activity

### Top Applications (by sign-in count)

| Application | Total | Success | Failed | IPs | Locations |
|:------------|:------|:--------|:-------|:----|:----------|
| Microsoft 365 Security and Compliance Center | 1,807 | 1,807 | 0 | 2 | 1 (US) |
| WindowsDefenderATP | 1,801 | 1,801 | 0 | 2 | 1 (US) |
| Microsoft Edge | 913 | 818 | 95 | 3 | 1 (US) |
| Microsoft Threat Protection | 467 | 467 | 0 | 2 | 1 (US) |
| Visual Studio Code | 460 | 460 | 0 | 2 | 1 (US) |

**Analysis:** Top applications are security tools (M365 Security, Defender ATP, MTP) and developer tools (VS Code, Edge). This is consistent with a **SecOps Analyst** role. Microsoft Edge has 95 failures — mostly refresh token expiry (normal lifecycle).

### Sign-In Locations

| Location | Total | Success | Failed | IPs | Top Applications |
|:---------|:------|:--------|:-------|:----|:-----------------|
| 🔵 US | 8,341 | 8,226 | 115 | 6 | O365 Shell, M365 Security, Windows Sign In, M365 Copilot, Teams Web |
| 🔵 CA | 486 | 482 | 4 | 7 | Windows App - Android, Azure Portal, GitHub 1ES, Security Copilot, Teams Graph |

**Analysis:** 🟢 Geographic distribution is consistent and expected. US sign-ins (94.5%) originate from Azure cloud IPs (corporate infrastructure). CA sign-ins (5.5%) originate from Vancouver and Victoria, BC — matching user's office location and residential area. No unexpected countries or impossible travel detected.

### Sign-In Failures

| Error Code | Description | Count | Period | Applications | Location |
|:-----------|:------------|:------|:-------|:-------------|:---------|
| 700082 | Refresh token expired due to inactivity | 96 | Feb 5–12 | Microsoft Edge, Azure PowerShell | US |
| 700084 | SPA token expired (fixed lifetime) | 10 | Feb 6–11 | O365 Shell, Azure AI Studio | US |
| 65002 | Consent issue between first-party apps | 4 | Feb 10–11 | Enterprise Dashboard Project | US |
| 50097 | Device authentication required | 3 | Feb 11 | Windows App - Android | CA |
| 50074 | Strong Authentication required | 2 | Feb 10 | Azure Portal | US |

**Analysis:** 🟢 All failure types are **benign operational errors**:
- **700082/700084** (106 combined): Normal token lifecycle — refresh tokens expire after inactivity, SPA tokens have fixed lifetimes. Not indicative of attack.
- **65002** (4): First-party app consent misconfiguration for "Enterprise Dashboard Project." Administrative, not security-relevant.
- **50097** (3): Device authentication required for Windows App - Android from CA — resolved via passkey auth.
- **50074** (2): MFA challenge for Azure Portal — MFA was completed successfully.

---

## Registered Devices

| Device Name | OS Version | Trust Type | Compliant | Managed | Last Sign-In |
|:------------|:-----------|:-----------|:----------|:--------|:-------------|
| 🟢 CONTOSO-VD-0 | Windows 10.0.26100.7840 | Hybrid Joined | ✅ Yes | ✅ Yes | 2026-02-04 |
| 🟢 CONTOSO-VM | Windows 10.0.26100.7462 | Entra Joined | ✅ Yes | ✅ Yes | 2026-01-25 |
| 🔵 CONTOSO-LAPTOP-1 | Windows 10.0.22557.1 | Entra Joined | ❌ No | ❌ No | 2026-01-31 |
| ⚠️ CONTOSO-WVA-0 | Windows 10.0.19045.5608 | Hybrid Joined | ❌ No | ❌ No | 2025-03-21 |
| ⚠️ LAPTOP-ABCD1234 | Windows 10.0.22000.856 | Entra Joined | ❌ No | ❌ No | 2023-04-12 |
| ⚠️ LAPTOP-EFGH5678 | Windows 10.0.22621.1105 | Entra Joined | ❌ No | ❌ No | 2023-01-25 |
| ⚠️ CONTOSO-DESKTOP-1 | Windows 10.0.22610.1 | Entra Joined | ❌ No | ❌ No | 2022-04-28 |

**Summary:** 7 devices registered. **2 compliant/managed** (CONTOSO-VD-0, CONTOSO-VM). 5 devices are **not compliant/not managed**, of which 3 have not signed in for over 1 year (LAPTOP-ABCD1234, LAPTOP-EFGH5678, CONTOSO-DESKTOP-1) and should be reviewed for cleanup.

---

## Audit Log Activity

| Category | Result | Count | Period | Operations |
|:---------|:-------|:------|:-------|:-----------|
| 🔵 Policy | Success | 9 | Feb 6 | Update conditional access policy, Update policy |
| 🔵 Authentication | Success | 4 | Feb 6 | Validate user authentication |
| 🔵 IdentityProtection | Success | 1 | Feb 6 | DismissUser |

**Analysis:** 🔵 Audit log activity is administrative and consistent with the SecOps Analyst role:
- **9 CA policy updates** on Feb 6 — user was modifying Conditional Access policies (confirmed by incident #2424 — "Conditional Access Policy Modified by New User," closed as BenignPositive).
- **4 authentication validations** on Feb 6 — related to policy testing.
- **1 DismissUser** operation on Feb 6 — admin dismissed Identity Protection risk for a user (correlates with the `adminDismissedAllRiskForUser` status on risk detections).

---

## Office 365 Activity

| Service | Operation | Count |
|:--------|:----------|:------|
| 🔵 Microsoft Teams | MessageRead | 18 |
| 🔵 Exchange | MailItemsAccessed | 16 |
| 🔵 Microsoft Teams | PerformedCardAction | 12 |
| 🔵 SharePoint | FileAccessed | 11 |
| 🔵 Microsoft Teams | TeamsSessionStarted | 9 |

**Analysis:** ✅ Normal Office 365 activity — Teams messaging, email access, SharePoint file access. Low volume, no suspicious operations (no forwarding rules, no mass downloads, no external sharing).

---

## DLP Events

✅ No Data Loss Prevention events detected for this user in the investigation period.
- Checked: `CloudAppEvents` for DLP audit metadata (0 matches)

---

## Security Incidents

| # | Incident ID | Title | Severity | Status | Classification | Created | Alerts |
|---|:------------|:------|:---------|:-------|:---------------|:--------|:-------|
| 1 | 🔴 2450 | Defense evasion incident on one endpoint | **High** | **New** (Open) | — | Feb 12, 01:03 | 2 |
| 2 | 2446 | Lateral movement incident on multiple endpoints | Medium | Closed | 🟢 BenignPositive | Feb 11, 16:01 | 3 |
| 3 | 2445 | Privileged User Logon from new ASN | Medium | Closed | 🟢 BenignPositive | Feb 11, 14:59 | 1 |
| 4 | 2443 | Defense evasion incident on one endpoint | Medium | Closed | 🟢 BenignPositive | Feb 11, 01:04 | 2 |
| 5 | 2441 | New UserAgent observed in last 24 hours | Low | Closed | 🟢 BenignPositive | Feb 10, 16:58 | 1 |
| 6 | 2425 | Privileged User Logon from new ASN | Low | Closed | 🟢 BenignPositive | Feb 7, 14:59 | 1 |
| 7 | 2424 | Conditional Access Policy Modified by New User | Low | Closed | 🟢 BenignPositive | Feb 6, 20:27 | 1 |

**Analysis:**
- 🔴 **Incident #2450** (Defense evasion, HIGH, Open) — Created Feb 12 at 01:03 UTC. 2 alerts. **Not yet triaged** — requires immediate review.
- 🟢 **6 closed incidents** — All classified as **BenignPositive**. Consistent with normal SecOps activity triggering security alerts (new ASN logons from CA IPs, CA policy changes, user agent changes, endpoint defense evasion from security tooling).
- 🔵 **Incident #2424** — Owner: alex.johnson@contoso.com — user closed their own CA policy modification alert as BenignPositive, which correlates with the 9 CA policy updates in AuditLogs.

---

## Risk Assessment

### Risk Score Calculation

**Score: 🟡 25 / 100 — LOW**

| # | Factor | Weight | Evidence |
|---|--------|--------|----------|
| **Risk Factors** | | | |
| 1 | 🔴 Open HIGH incident (#2450) | +15 | Defense evasion incident, 2 alerts, not triaged |
| 2 | 🟡 New VPN IP anomaly (203.0.113.13) | +5 | VPN provider, first seen Feb 11, Low severity anomaly |
| 3 | 🟡 Stale unmanaged devices (3 devices) | +5 | 3 devices not signed in for >1 year, not compliant |
| **Mitigating Factors** | | | |
| 4 | 🟢 FIDO2 passkey (device-bound, attested) | −10 | Phishing-resistant credential used on anomaly IP |
| 5 | 🟢 Risk dismissed by admin | −5 | `adminDismissedAllRiskForUser` on Feb 6 |
| 6 | 🟢 Geographic consistency | −5 | All activity from US (Azure) + CA (Vancouver/Victoria) |
| 7 | 🟢 No TI matches | −3 | 0/5 IPs in ThreatIntelligenceIndicator |
| 8 | 🟢 No DLP events | −2 | Clean DLP posture |
| 9 | 🟢 6/7 incidents BenignPositive | −5 | Consistent closure pattern for SecOps user |
| | **Net Score** | **= 25** | Baseline 30 + 25 risk − 30 mitigating |

### Summary Assessment

| Factor | Finding |
|--------|---------|
| 🔴 **Open Incident** | Incident #2450 (Defense evasion, High) is open and unreviewed — requires immediate triage |
| 🟢 **Auth Method** | Phishing-resistant FIDO2 passkey (device-bound, attested) — strong credential |
| 🟢 **Identity Protection** | Risk level: None. Prior medium-risk detections dismissed by admin |
| 🟢 **Geographic Pattern** | Consistent: US (Azure cloud) + CA (Vancouver office, Victoria home) |
| 🟡 **New IP** | 203.0.113.13 (VPN provider, Vancouver) — Low severity, passkey-authenticated |
| 🟢 **Sign-In Failures** | All failures are benign (token expiry, MFA challenges) — no brute-force patterns |
| ⚠️ **Stale Devices** | 3 devices inactive >1 year — should be cleaned up |
| ✅ **DLP** | No data loss events |
| ✅ **TI** | No threat intelligence matches |
| ✅ **O365** | Normal Teams/Exchange/SharePoint usage |

---

## Recommendations

| Priority | Action | Rationale |
|----------|--------|-----------|
| ⚠️ **HIGH** | Triage incident #2450 (Defense evasion, High) | Open since Feb 12, 2 alerts, no owner assigned. Review endpoint telemetry to determine if true positive or benign SecOps tooling trigger. |
| ⚠️ **MEDIUM** | Remove stale device registrations | LAPTOP-ABCD1234 (last seen Apr 2023), LAPTOP-EFGH5678 (Jan 2023), CONTOSO-DESKTOP-1 (Apr 2022) — inactive >1 year, not compliant, not managed. Clean up to reduce attack surface. |
| 🔵 **LOW** | Review CONTOSO-LAPTOP-1 compliance | Active device (last seen Jan 31, 2026) but not compliant/managed. Enroll in Intune or verify if still in use. |
| 🔵 **LOW** | Monitor 203.0.113.13 (VPN provider) | New VPN IP from Vancouver. Confirm with user if this is an expected VPN provider. Low risk given passkey auth was used. |
| 🔵 **INFO** | AbuseIPDB enrichment incomplete | AbuseIPDB API timed out during enrichment. Re-run `enrich_ips.py` later to complete abuse confidence scores. |

---

## Appendix — Investigation Timeline

| Timestamp (UTC) | Event |
|:----------------|:------|
| 2026-02-05 00:05 | Earliest sign-in in period (20.236.10.66, US, O365 Shell) |
| 2026-02-05 00:43 | First CA sign-in (192.0.2.234, Victoria, Teams Graph) |
| 2026-02-05 06:24 | Failed sign-in from 192.0.2.131 (Victoria, GitHub 1ES) |
| 2026-02-06 20:12 | 9 Conditional Access policy updates initiated |
| 2026-02-06 20:27 | Incident #2424 created (CA Policy Modified by New User) |
| 2026-02-06 23:48 | Admin dismissed all risk for user (IdentityProtection → DismissUser) |
| 2026-02-07 00:03 | 2× unfamiliarFeatures risk detections (198.51.100.x, Seattle) — dismissed |
| 2026-02-07 14:59 | Incident #2425 (Privileged User Logon from new ASN) → Closed BenignPositive |
| 2026-02-10 16:58 | Incident #2441 (New UserAgent observed) → Closed BenignPositive |
| 2026-02-10 17:40 | 50074 — Strong Auth required for Azure Portal (MFA completed) |
| 2026-02-11 00:27 | First sign-in from new IP 203.0.113.13 (Windows App - Android, Vancouver) |
| 2026-02-11 01:04 | Incident #2443 (Defense evasion, endpoint) → Closed BenignPositive |
| 2026-02-11 14:59 | Incident #2445 (Privileged Logon new ASN) → Closed BenignPositive |
| 2026-02-11 16:01 | Incident #2446 (Lateral movement, multiple endpoints) → Closed BenignPositive |
| 2026-02-11 22:00 | Anomaly detected: NewInteractiveIP 203.0.113.13 (Low severity) |
| 2026-02-12 01:03 | 🔴 **Incident #2450** (Defense evasion, HIGH) — **OPEN, not triaged** |
| 2026-02-12 15:22 | Latest sign-in in period (20.236.10.66, US, Microsoft Edge) |

---

*Report generated by Copilot Automated Investigation • Investigation Period: 2026-02-05 to 2026-02-12 • Workspace: la-contoso*
