Telemetry-Driven Graph Enrichment: Failed Logons, Behavior Profiles and Credential Exposure
See what your domain controllers' authentication and logon events add to each identity: a 30-day behavior profile, failed logon counts (event 4625), session history and Tier 0 credential exposure.
Overview
Once events flow from your domain controllers (set this up in Telemetry Pipeline), GraphnAI adds what they show to the identity graph. Directory data alone can't tell you which accounts behave unusually, which Tier 0 credentials are exposed, or which permissions go unused.
Each kind of enrichment has its own page:
| Enrichment | Where to find it |
|---|---|
| One identity's events, alerts and sessions, with its behavior overview and investigation charts | Identity Investigation Timeline |
| Computers where a Tier 0 credential sits in memory and a lower-tier identity holds the privileges to take it | Cross-Tier Credential Exposure |
| Session and privilege edges in the graph | Graph Explorer: Session and Privilege Edges |
| Detection alerts: brute force, password spray, Kerberoasting, DCSync and more | ITDR Detection |
| Pipeline setup, audit policy and collector configuration | Telemetry Pipeline |
Behavioral Context
GraphnAI builds a behavior profile for every identity with at least 5 events in the last 30 days. The profile is rebuilt each time analytics runs: after every full sync, and after every delta sync that changed something. A delta sync with no changes leaves the profiles as they were.
Each profile holds:
- Typical hours: every hour of the day (UTC) in which the identity had at least one event.
- Hosts: up to 10 computers its events were recorded on.
- Protocols: the authentication protocols its events used, such as Kerberos, NTLM or Negotiate.
- Event count: its events in the last 30 days.
- Anomaly score: from 0.00 to 1.00. Today the score rises by 0.10 when the identity logged more than 5,000 events in 30 days. Other behavior signals aren't scored yet.
You see the profile as the Behavior overview card on the Identity Investigation Timeline. The detection rules keep their own baselines, which need at least 50 logons. See Behavioral Baselines.
The Graphne agent can answer questions about the profile. Open Graphne in the sidebar and ask, for example:
- "What's the behavior profile for [email protected]?"
- "Show the timeline for svc-backup over the last 7 days."
- "Which alerts fired for svc-sql this week?"
Failed Logon Tracking (Event 4625)
Every failed logon (event 4625, "An account failed to log on") updates the targeted identity. The counts appear in the identity's detail panel with its other properties, so you don't need a query or an alert to see them.
| Property | Label in the panel | Description |
|---|---|---|
failedAuthCount |
Failed auth count | Failed logons recorded since telemetry started. The count doesn't reset. |
failedAuthSources |
Failed auth sources | How many distinct source hosts sent them |
failedAuthSourceList |
Failed auth source list | The source hosts, by name or IP address |
lastFailedAuth |
Last failed auth | When the most recent failure happened |
When a source host's name held a credential, GraphnAI removes it before storage. It then counts in failedAuthRedactedSources (Failed auth redacted sources) instead of the source list.
What the counts tell you:
- Brute force: many failures from one source host. Someone is guessing this account's password.
- Distributed brute force: many failures from many source hosts against this account.
- Password spray: one source host in the source lists of many accounts. The Password spray alert in ITDR Detection names the source.
- Account lockout: the source list names the machine or application that sends the bad password.
The counts update as events arrive, within seconds, without waiting for a sync. They're recorded only when the event names an identity in the graph.