Understanding and Responding to a High-Severity Credential Compromise Alert

Overview

Receiving a high-severity credential compromise alert is a serious event. Sweet Security uses multiple signals to detect potential account takeovers or misuse. Here’s how to interpret the alert and what actions you should take.

What Triggers a Credential Compromise Alert?

Credential compromise alerts are generated based on:

Unusual login activity: e.g., authentication from a new country, impossible travel, or odd hours.
Anomalous use of credentials: access to sensitive resources or API calls never performed before.
Multiple failed login attempts: brute force or credential stuffing patterns.
Use of credentials from suspicious IP addresses or breached sources.

How to Interpret the Alert Indicators

The alert notification will typically include:

User/Role Name: Who the credentials belonged to.
Source IP Address: Location/ISP of the login attempt.
Time and Date: When the event occurred.
Type of Operation: Actions attempted (e.g., accessing S3, modifying IAM).
Risk Justification: Why the activity was flagged (e.g., “first login from China,” “use of previously unseen user agent”).

Recommended Response Actions

Validate the Event
- Ask the user/team if the login or action was intentional.
- Check internal change logs or deployment schedules.
Review Access Patterns
- Compare recent activity with normal baseline for the account.
- Use Sweet Security’s audit trail for a 72-hour activity window.
Rotate or Revoke Credentials
- If compromise is suspected, immediately revoke credentials or rotate API keys and passwords.
Examine Related Resources
- Review logs for affected resources for any unauthorized changes or data exfiltration.
- Check for any new access policies or service permissions granted.
Report and Document
- Document findings and remediation steps.
- Alert security leadership as per your incident response plan.

Need More Help?

Contact Sweet Security Support and provide:

Alert ID, user/role involved, and timestamps
Any internal findings or context
Actions taken so far

Our team can assist with deeper forensics and response guidance.