IAM Supervisor Agent

As described on Microsoft Marketplace.

The IAM Supervisor Agent by Performanta functions as an autonomous identity security analyst, orchestrating the end-to-end investigation of compromised user accounts within your Microsoft Sentinel environment. By integrating directly with your specific Workspace and Tenant context, the agent automatically retrieves and filters "New" security incidents based on your defined severity preferences (e.g., High, Medium). It then initiates a comprehensive assessment of the target user's security posture, efficiently distinguishing between benign anomalies and genuine identity threats without manual intervention.

Beyond basic triage, the agent executes five concurrent investigation streams to build a holistic view of the user's behavior. It analyzes authentication logs for signs of compromised credentials (such as impossible travel or token theft), evaluates insider risk indicators like data exfiltration, and scrutinizes MFA logs for fatigue attacks or bypass attempts. If the user holds elevated privileges, the agent performs a specialized deep-dive into admin activities and configuration changes. Finally, it synthesizes all findings into a unified opinion, providing security teams with a validated assessment and a prioritized remediation plan.