<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-identity-threat-detection
description: >-
  Build and deploy Identity Threat Detection and Response (ITDR) pipelines
  that correlate signals across IdPs, directories, and endpoints to detect
  credential compromise, session hijacking, and privilege abuse.
domain: cybersecurity
subdomain: identity-security
tags:
  - itdr
  - detection-engineering
  - siem
  - identity-monitoring
  - correlation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1528
  - T1539
  - T1550
  - T1621
---

# Implementing Identity Threat Detection

## Overview

ITDR extends traditional detection engineering to focus on identity-layer
threats. It combines IdP telemetry, directory audit logs, session analytics,
and behavioral baselines to detect credential compromise, session hijacking,
and privilege abuse in near real-time.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### ITDR Signal Pipeline

```python
ITDR_PIPELINE = {
    "ingestion": ["idp_logs", "directory_audits", "session_events", "mfa_events"],
    "normalization": ["ocsf_identity_activity", "cef_auth_events"],
    "enrichment": ["geo_ip", "threat_intel", "user_context", "device_trust"],
    "correlation": ["temporal_join", "graph_analysis", "behavioral_baseline"],
    "scoring": ["risk_score", "confidence_level", "severity_rating"],
    "response": ["alert", "block", "step_up_auth", "session_revoke"],
}
```

### Detection Categories

| Category | Signals | Response |
|---|---|---|
| Credential Theft | Impossible travel, new device + location | Step-up auth |
| Session Hijack | Token replay, cookie theft | Session revoke |
| Privilege Abuse | Admin role grant, permission escalation | Alert + review |
| Account Takeover | Password change + MFA reset | Account lock |
| Lateral Movement | Service account anomaly | Contain + investigate |

## Workflow

```
1. DESIGN     — Define ITDR detection use cases and signal sources
2. INGEST     — Configure IdP log forwarding to SIEM/ITDR platform
3. NORMALIZE  — Map identity events to common schema (OCSF)
4. ENRICH     — Add geo, threat intel, and user context
5. CORRELATE  — Build multi-signal detection rules
6. TUNE       — Reduce false positives with behavioral baselines
7. AUTOMATE   — Wire detection to response playbooks
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
