Incident Response SOP – Suspicious Login Alerts

 

Title: Incident Response SOP – Suspicious Login Alerts
Author: Patience Rusere, Technical Writer
Document Type: Internal Use Only

Purpose:
To define the standardized process for Tier 1 and Tier 2 analysts to respond to unusual login activity detected on DN Cloud Services and Remote Suite™ Admin Console.

Scope:
Applies to all security operations center (SOC) analysts and IT admins handling user authentication incidents.

Procedure:

1. Alert Triage
• Review SIEM logs for geolocation anomalies, login time irregularities, and failed attempts.
• Confirm correlation with internal threat intelligence (i.e., recent phishing campaigns).
2. User Verification
• Contact the affected user via a secure channel (not email).
• Ask for confirmation of login behavior and current device use.
3. Response Action
• If unconfirmed, force a password reset and revoke all active tokens.
• Create an incident ticket and label as “Medium – User Compromise Suspected.”
4. Documentation
• Log the incident, timestamps, responder actions, and user verification outcomes in CyberTrack.