azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b7bc3f4d2503cd86ef2d9dc7dc24f18e7b861edd
claudetools/session-logs/2026-06-06-howard-lighthouse-risky-user-alerts.md
Howard Enos 5a9fe1bc6c sync: auto-sync from HOWARD-HOME at 2026-06-06 16:15:15 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-06 16:15:15
2026-06-06 16:15:28 -07:00

9.7 KiB
Raw Blame History

Session Log — 2026-06-06 — Howard — Lighthouse Risky-User Alert Triage

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Investigated a burst of Microsoft 365 Lighthouse alert emails Howard received at howard@azcomputerguru.com, using the remediation-tool skill (read-only, investigator tier). Acquired a Graph read token for the ACG partner tenant and searched Howard's mailbox: found 35 "Risky user" alerts (severity High) plus one Lighthouse billing/invoice email, all from m365-noreply@microsoft.com, all dated June 5 2026, delivered in a single 2-minute burst (2026-06-05 22:18-22:20 UTC). Pulled the full HTML body of one alert and parsed all of them to extract per-tenant detail.

Every alert was generated by the same rule: "SAMPLE - Alert on risky user" — a Microsoft built-in Lighthouse sample alert rule (the "SAMPLE -" prefix is Microsoft's). The 35 alerts spanned 15 client tenants. Concluded this is a sample-rule backfill / risk-detection wave firing portfolio-wide, not 35 simultaneous live breaches. Flagged the accounts worth real triage: ACG-controlled admin accounts showing risky in client tenants ("Computer Guru" @ MVAN + Valley Wide, "Mike Swanson" @ JR Kennedy), and service/shared accounts (GTIMail + Shoretel @ Glaz-Tech, "remote" @ IMC, On-Prem Dir Sync svc acct @ Russo, Accounting @ Sonoran Green, Orders VWP @ Valley Wide).

Howard then asked when the rule was applied and by whom. Began a per-tenant riskyUsers pull (Identity Protection) for the priority accounts — extracted all 15 tenant GUIDs straight from the alert email bodies — but Howard interrupted/redirected to the rule-provenance question before that ran. Pivoted to provenance investigation.

Attempted to determine rule provenance through every read-only path the tool can reach, all of which dead-ended: (1) Entra directory audit log for the ACG tenant returned no Lighthouse alert-rule events (Lighthouse does not log there; only SaaSAlerts.Fortify SP grants matched "alert"), and only retains 30 days (back to 5/6). (2) Lighthouse rule config via Graph is unavailable — the investigator app lacks ManagedTenants.Read.All. (3) Unified Audit Log via the Exchange tier (Search-UnifiedAuditLog over a 180-day window) returned HTTP 401; a follow-up Get-OrganizationConfig probe also 401'd, confirming the Security Investigator app has no Exchange/audit RBAC role in our OWN partner tenant (we only grant it Exchange Admin in client tenants for breach checks).

Reported the blocker and presented three unblock options to Howard: check the Lighthouse portal directly (Alerts -> Alert rules -> rule detail shows created/modified-by), run Search-UnifiedAuditLog himself in an interactive admin EXO session, or have Claude grant the investigator SP the "View-Only Audit Logs" role in the ACG tenant (a privilege change, deferred pending explicit go). Session ended awaiting his choice.

Key Decisions

  • Classified the 35 alerts as a SAMPLE-rule backfill / risk-detection wave rather than 35 live incidents, based on: the literal "SAMPLE -" Microsoft template name, the single 2-minute portfolio-wide burst, and many flagged accounts being non-interactive service/shared accounts.
  • Narrowed recommended triage to ACG admin accounts and service accounts rather than all 35 users — those are the ones where a real risk flag actually matters.
  • Extracted tenant GUIDs from the alert email bodies (each contains "Tenant ID:") instead of resolving 15 domains separately — faster and avoids name-to-domain guessing for tenants whose display name is not a domain.
  • Did NOT grant the investigator app an Exchange/audit role in the ACG tenant to unblock the UAL search — that is a privilege change in our own tenant and requires explicit user approval.
  • Kept the entire session read-only: did not mark any emails read, ran no remediation, made no riskyUser state changes.

Problems Encountered

  • Windows /tmp path mismatch broke a Python HTML-stripper that read from a Git-Bash-written /tmp file (Windows Python resolved a different /tmp). Resolved by piping the HTML to Python via stdin instead of a temp file.
  • Entra directoryAudits rejected an activityDateTime filter older than 30 days ("Minimum allowed time ... is 5/6/2026"). Resolved by setting the filter start to 2026-05-06.
  • Search-UnifiedAuditLog via EXO REST returned an empty body, then HTTP 401. Diagnosed with a trivial Get-OrganizationConfig probe (also 401) -> root cause is the investigator SP having no Exchange RBAC role in the ACG partner tenant (blanket 401, not cmdlet-specific). Reported as a blocker rather than worked around.

Configuration Changes

  • session-logs/2026-06-06-howard-lighthouse-risky-user-alerts.md — created (this log).
  • No repo code/config changes. No M365 changes (read-only session).

Credentials & Secrets

None discovered or created. Tokens acquired via remediation-tool get-token.sh (investigator = Graph read; investigator-exo = EXO read) for the ACG tenant; cert/secret auth from the SOPS vault entry msp-tools/computerguru-security-investigator.sops.yaml. Tokens cached at /tmp/remediation-tool/{tenant}/{tier}.jwt (TTL 55 min).

Infrastructure & Servers

  • ACG partner tenant (azcomputerguru.com): tenant id ce61461e-81a0-4c84-bb4a-7b354a9a356d
  • ComputerGuru Security Investigator app id bfbc12a4-f0dd-4e12-b06d-997e7271e10c — Graph roles include AuditLog.Read.All, Directory.Read.All, IdentityRiskyUser.Read.All; does NOT have ManagedTenants.Read.All. Has NO Exchange RBAC role in the ACG tenant (EXO adminapi returns 401).
  • Client tenant GUIDs (from alert email bodies):
    • Bill Tedards 4fcbb1f4-fbf9-4548-a93e-7d14a3c091e6
    • Dataforth Corporation 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584
    • Glaz-Tech Industries 82931e3c-de7a-4f74-87f7-fe714be1f160
    • Instrumental Music Center 65adab75-f1fd-4ef9-b2b4-c24f595393e3
    • JR Kennedy Company a92594b9-c8ad-4dba-8b40-14fcd32c723c
    • Jema Enterprises, LLC 41268042-9a8e-41c2-9a3c-0775398b86cb
    • Kittle Design & Construction 3d073ebe-806a-4a5e-9035-3c7c4a264fc0
    • MVAN Enterprises, Inc 5affaf1e-de89-416b-a655-1b2cf615d5b1
    • Patient Care Advocates 463b462d-0995-4e51-9e41-82c208015c7f
    • Ridgetop Group ef111bfc-9c90-43c9-a581-f9bbfceb6517
    • Russo Law Firm bef1b190-f78f-4b1c-aa4b-fab186a30702
    • Safe Site Utility Services LLC 71b4e637-c802-4137-a812-ae50dbc839e3
    • Sonorangreenllc.com ededa4fb-f6eb-4398-851d-5eb3e11fab27
    • Valley Wide Plastering 5c53ae9f-7071-4248-b834-8685b646450f
    • cclac.net e8a0fafc-21ee-41e8-a5ba-f3a250a8a30e

Commands & Outputs

  • bash scripts/resolve-tenant.sh azcomputerguru.com -> ce61461e-81a0-4c84-bb4a-7b354a9a356d
  • bash scripts/get-token.sh <tenant> investigator / ... investigator-exo -> bearer tokens.
  • Graph mailbox search: GET /users/howard@azcomputerguru.com/messages?$search="Microsoft 365 Lighthouse alert was detected" with header ConsistencyLevel: eventual -> 35 risky-user alerts + 1 invoice.
  • Token roles decoded from JWT roles claim — confirmed AuditLog.Read.All present, ManagedTenants.Read.All absent.
  • GET /auditLogs/directoryAudits?$filter=activityDateTime ge 2026-05-06T00:00:00Z -> 88 events, services: Core Directory / Self-service Group Mgmt / Self-service Password Mgmt; only "alert" matches were SaaSAlerts.Fortify SP grants (5/7, 5/15). No Lighthouse rule events.
  • EXO Search-UnifiedAuditLog via POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand -> HTTP 401; Get-OrganizationConfig probe -> HTTP 401 (blanket no-RBAC).

Pending / Incomplete Tasks

  • AWAITING HOWARD'S CHOICE on rule provenance ("when/who applied SAMPLE - Alert on risky user"):
    • (B, fastest) Lighthouse portal -> Alerts -> Alert rules -> open the rule -> created/modified-by metadata.
    • (3) Howard runs Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-180) -EndDate (Get-Date) -FreeText "Alert on risky user" -ResultSize 500 in an interactive admin EXO session.
    • (1) Claude grants the Security Investigator SP the "View-Only Audit Logs" role in the ACG tenant (tenant-admin tier) then re-runs the UAL search via the tool — deferred, needs explicit go (privilege change in our own tenant).
  • NOT DONE (interrupted): per-tenant riskyUsers (Identity Protection) pull for the priority accounts (ACG admin + service accounts) to separate live risk from stale backfill. Tenant GUIDs already gathered above; ready to resume if asked.
  • Consideration: ACG admin accounts flagged risky in client tenants (Computer Guru @ MVAN/Valley Wide, Mike Swanson @ JR Kennedy) warrant a genuine check that our own creds are not being sprayed.
  • Housekeeping: the noisy "SAMPLE -" rule could be quieted/renamed in the Lighthouse portal so this does not re-spam Howard's inbox (portal action, not this tool).

Reference Information

  • Mailbox investigated: howard@azcomputerguru.com (ACG tenant).
  • Alert source: m365-noreply@microsoft.com; rule "SAMPLE - Alert on risky user"; type "Risky user"; severity High; detection date June 5 2026.
  • 35 risky-user alerts across 15 tenants. Full per-tenant user list captured in chat (e.g. Glaz-Tech: GTIMail, Shoretel, Dave Hill, Linda Salazar, Roxy Scott; Ridgetop: Jan Traficanti, Nicolas Blanchard, Luis Hernandez, Arsh Nadkarni, Clay Hunt; Safe Site: Lisa Stirzl, Rachel Rupp, George Brandt, Cody Kennedy, Jeff Mortenson; Valley Wide: Computer Guru, Orders VWP, Sammy Montijo, Bart Graffin; etc.).
  • Remediation skill: .claude/skills/remediation-tool/ (get-token.sh, resolve-tenant.sh, user-breach-check.sh).
  • Graph riskyUsers endpoint for resume: GET https://graph.microsoft.com/v1.0/identityProtection/riskyUsers?$top=200 (per tenant, investigator tier).
  • EXO REST: POST https://outlook.office365.com/adminapi/beta/{tenant}/InvokeCommand (needs Exchange RBAC role on the SP — absent in ACG).
Reference in New Issue View Git Blame Copy Permalink