Simple definition
ITDR comprises detection and response capabilities focused on threats to identities, privileges and authenticated sessions.
Purpose and use
It seeks to identify account theft, abnormal use of permissions and movement enabled by compromised identities.
How does it work?
Authentication events and directory changes are correlated with devices, access activity and risk context to guide investigation.
Key points
- Example: a new privileged assignment and an unusual sign-in on the same account trigger a coordinated review.
- Verify the change actor, active sessions and resources actually accessed before deciding on response.
Points to watch
An unfamiliar sign-in is not automatically hostile. Collection and response actions depend on the integrated directories, services and licenses.
In short
ITDR connects identity signals with action to limit account compromise.