Lab: Investigate a compromised account
Ticket INC-4821 at Aldermoor Freight: Nora Lindqvist in accounts payable can no longer sign in, and she is suddenly a member of Finance Approvers, the group that may release payments. Nobody in Finance asked for that. On your own Monosign server you find out who did what from the audit log, contain the account, show from the Access Timeline when the access existed, and send the evidence to the auditor as a scheduled report.
Monosign University Pass 50 minIntermediate DE · EN · ES · TR Partner Administrator Security analyst
Version 1 · updated Nov 11, 2026
Hands-on lab
New
Sign in to start
Included with University Pass.
What you will learn
- Find in the audit log who performed an administrative action, and tell the actor from the affected user
- Contain a compromised account: a new password and the end of its open sessions
- Answer who had which access and when with the Access Timeline, and keep the evidence as a pinned event with a note
- Build a Report Studio report on audit events and deliver it to a reader without an account as a scheduled e-mail attachment
Lab tasks
Each task is checked automatically against the real state of your lab environment.
- 1. Find who reset Nora's password and disable that account
- 2. Give Nora a new password and end her open sessions
- 3. Show when the payment access was granted, pin the evidence and remove the access
- 4. Build an audit evidence report for the ticket and run it
- 5. Schedule the report for the external auditor as an e-mail attachment