Skills
.Work. You
Rest

authentication-tracing

Community

Trace sign-ins and detect token reuse.

Data & Analytics#authentication#mfa#entra-id#forensic-analysis#session-id#token-reuse#signin-logs
AuthorSCStelz
Version1.0.0
Installs0

System Documentation

What problem does it solve?

This skill performs forensic analysis of Entra ID authentication flows to determine whether suspicious sign-ins reflect legitimate MFA activity or credential/token theft.

Core Features & Use Cases

  • Forensic analysis of SessionId chains to distinguish legitimate activity from credential theft.
  • IP progression and geographic anomaly assessment using Investigation JSON ip_enrichment data.
  • Step-by-step workflows for tracing interactive MFA versus token reuse across SigninLogs and AADNonInteractiveUserSignInLogs.

Quick Start

Run an authentication tracing analysis after running a user investigation to map signins to SessionId values.

Dependency Matrix

Required Modules

None required

Components

Standard package

💻 Claude Code Installation

Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.

Please help me install this Skill:
Name: authentication-tracing
Download link: https://github.com/SCStelz/security-investigator/archive/main.zip#authentication-tracing

Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
View Source Repository

Agent Skills Search Helper

Install a tiny helper to your Agent, search and equip skill from 223,000+ vetted skills library on demand.