During identity-based investigations, analysts should primarily check for:

An identity-based investigation focuses on the activities and behaviors associated with a specific user account. The primary indicator of a compromised identity is an anomaly in how that identity is authenticated and used. Cortex XDR's Identity Analytics capabilities are designed to detect such anomalies, including impossible travel, logins from unusual locations or devices, abnormal login times, and brute-force attempts. These authentication-related events are the most direct evidence of credential misuse or account takeover, making them the principal area of focus for an analyst.