A security engineer receives an alert from the threat-intelligence platform containing the following information:
Which action should the security engineer take first?
Accounts for John, Ann, and Joe have exposed passwords and should have their credentials reset immediately. Disconnecting their active sessions also invalidates existing authenticated access that could be held by an unauthorized party, providing immediate containment.
Community Discussion