Identity threat detection and response (ITDR)
Detection of credential theft, privilege escalation and lateral movement, including automated response.
Where the module helps during an attack
Identity protection plays its main role in reconnaissance and privilege escalation; endpoint protection primarily addresses malicious code execution.
| Area | Level |
|---|---|
| Reconnaissance | primary role |
| Initial access | additional protection |
| Execution and persistence | context |
| Escalation and lateral movement | primary role |
| Impact | context |
| Investigation and recovery | additional protection |
Protect the accounts attackers need to progress
After accessing one workstation, attackers typically need more accounts and higher privileges. Singularity Identity focuses on this stage: credential theft, domain reconnaissance, privilege escalation and movement between systems.
The module works with Active Directory and cloud identity providers. The vendor lists Microsoft Entra ID, Okta, Ping, SecureAuth and Duo among others. On endpoints, it uses the same agent and console as Singularity Endpoint.
Identity security posture management (ISPM)
Continuous assessment of AD and cloud identity settings to identify misconfigurations and risky exposure.
Deception
Decoys and fake credentials that expose attackers during reconnaissance.
Compromised credentials
Alerts about credentials discovered in dark web leaks.
How the module works in practice
When an attacker searches a workstation for stored passwords or queries privileged groups and service accounts in the domain, the vendor says the module hides real credentials, presents decoy data and raises a console alert. This exposes the attacker's intent before they obtain what they seek.
Response can be automated. The vendor lists disabling compromised accounts, forcing password changes, terminating sessions or requiring MFA reauthentication through conditional access policies. Specific actions depend on licensing, identity provider integration and approved rules.
Endpoint integration connects identity and workstation alerts in one console. Users and devices can be isolated without switching tools.
Active Directory protection may require a component on domain controllers. We therefore verify the architecture against current vendor documentation before the pilot.
What it addresses and who it is for
The module suits organisations with hybrid identity management and smaller security teams that need to connect endpoint alerts with account activity in the domain.
- Theft and abuse of endpoint passwords and tokens.
- Active Directory reconnaissance, including privileged groups and service accounts.
- Privilege escalation and lateral movement between workstations and the domain.
- AD and cloud identity misconfigurations accumulated over time.
- Employee credentials leaked outside the organisation.
Deployment and operation with APPSEC
Identity map
Domains, controllers, cloud identity providers, privileged and service accounts, and their owners.
Assessment
An initial identity posture assessment identifies weaknesses and remediation priorities.
Pilot
We verify detections, decoys and responses on a selected part of the environment without disrupting normal operations.
Operation
Response rules, escalation and handover to identity administrators. Support within the proposal's scope.
What to check before buying
- Which components the licence includes: detection and response, posture assessment, deception and compromised credential protection.
- Supported Active Directory versions, identity providers and integration methods.
- How the module integrates with your MFA and conditional access.
- Who assesses identity alerts and who may act on accounts.
- How identity alerts reach your SIEM or Singularity AI SIEM.
