- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Firewalls have never been better. Multi-factor authentication is near-universal in mid-to-large Indian enterprises. Endpoint agents monitor every laptop and server. And yet, breach dwell times in the Asia-Pacific region still average well over 100 days — attackers roam undetected inside networks that were never compromised in the traditional sense. They simply logged in.
This is the defining security challenge of 2026: attackers are no longer breaking through your perimeter; they are walking through it with legitimate credentials. The discipline built to answer this threat is Identity Threat Detection and Response (ITDR) — and most Indian enterprise security teams have not yet operationalised it.
India’s digital economy has expanded attack surface faster than security maturity. Credential-based attacks now account for the majority of confirmed breaches across BFSI, manufacturing, and healthcare sectors. The attack patterns are not new, but their scale and automation have accelerated sharply:
CERT-In’s 2024 and 2025 advisories consistently call out identity-based techniques — particularly in attacks on BFSI and critical infrastructure — as the entry vector that makes other defences irrelevant. The adversary does not need to exploit a CVE if they can buy a valid session token on a dark-web marketplace for under USD 10.
Identity Threat Detection and Response is a security discipline focused specifically on detecting the misuse of valid credentials and identity artefacts, and triggering a rapid, automated response before the attacker can achieve their objective. It sits at the intersection of identity governance, threat detection, and security operations.
It is important to distinguish ITDR from adjacent controls that are necessary but insufficient on their own:
In practice, ITDR is operationalised by enriching your SIEM with identity-context rules mapped to MITRE ATT&CK’s Credential Access and Lateral Movement tactics, then wiring automated SOAR playbooks to respond — account lockout, session revocation, firewall policy push — within the dwell window that matters.
A user authenticates from Mumbai at 09:00 IST and from a European IP at 09:45 IST. No commercial flight makes that journey. This is the simplest and most actionable ITDR signal — a stolen credential in use alongside a legitimate session. Detection requires correlating authentication timestamps with geolocation across SSO, VPN, and cloud portals in real time.
Windows Event IDs 4624 (type 3 logon) and 4625 (failed logon) in rapid succession across multiple hosts, originating from a single workstation, is a classic lateral movement fingerprint. Kerberoasting leaves a different signature: an unusually high volume of TGS-REQ requests for service accounts with weak encryption (RC4) from a single host. Both require domain controller log ingestion and MITRE ATT&CK–aligned correlation rules — not default SIEM templates.
A service account that has only ever authenticated at 02:00 during scheduled batch jobs suddenly performs interactive logons during business hours from a workstation. Behavioural baselining flags this immediately; without it, the activity is indistinguishable from legitimate administrative work. Machine-learning-based peer-group analysis is the only scalable way to establish and maintain these baselines across thousands of accounts.
An attacker who steals a refresh token for a Microsoft 365 account can access email, Teams, and SharePoint without ever re-authenticating, even after the victim changes their password — unless the refresh token is explicitly revoked. Detection requires monitoring Azure AD sign-in logs for long-lived token usage, anomalous application registrations, and OAuth consent grants to unfamiliar apps. This attack vector is especially relevant for Indian enterprises that have rapidly migrated to cloud productivity platforms without hardening cloud identity configurations.
Kerberos tickets with unusually long lifetimes, tickets issued for non-existent accounts, or authentication events that bypass standard TGT issuance are hallmarks of forged ticket attacks. These are high-fidelity, low-frequency signals — when they appear, response must be immediate. A Golden Ticket attack means at minimum one domain controller is compromised and a forest-level password reset (including the KRBTGT account twice) is required.
Implementing the detection use cases above requires more than a checklist. It requires a unified operations platform that ingests the right data sources, applies identity-aware analytics, and automates the response actions that make a 6-hour CERT-In notification window achievable. For our clients, that platform is PrahiX Ora — built by PrahiX Tech Pvt Ltd and deployed and operated by PJ Networks as our primary SecOps delivery platform.
PrahiX Ora’s SIEM ingests authentication logs from Active Directory, Azure AD, VPN concentrators, cloud SSO, FortiGate, and FortiMail — correlating events across these sources using rules mapped directly to MITRE ATT&CK Credential Access and Lateral Movement techniques. Graph-based attack storyline reconstruction links individual authentication anomalies into coherent attack chains, allowing SOC analysts to see a lateral movement campaign rather than isolated events. Tiered retention — hot, cold, and archive — supports CERT-In’s direction on 180-day in-country log retention, with archive tiers keeping evidence available for forensic investigations without inflating storage costs.
Identity abuse does not stay in the directory layer — it shows up as unusual east-west traffic between workstations, SMB connections to rarely accessed file servers, or new WMI-based remote execution. PrahiX Ora’s NMS provides unified observability across FortiGate firewalls, switches, wireless APs, and WAN/SD-WAN links. LLDP/CDP topology discovery and ML-based anomaly detection flag network-layer signals that correlate with identity telemetry — giving our NOC and SOC a complete picture in environments where identity attacks and network-layer movement happen simultaneously. This is particularly valuable for Indian enterprises managing multi-vendor network estates where visibility is otherwise fragmented across separate management consoles.
For manufacturing, retail, and multi-site enterprises, insider identity abuse often has a physical component — a contractor with valid network credentials accessing a server room after hours, or a terminated employee whose badge was revoked but whose domain account was not. PrahiX Ora’s video surveillance (VMS) module — supporting ONVIF, Hikvision, and Dahua cameras with integrated video analytics — allows our operations team to correlate physical access events with logical authentication anomalies under one operations view. This convergence is increasingly expected by enterprise security teams managing compliance across geographically distributed sites.
CERT-In’s 6-hour incident reporting window is demanding. Manual investigation and response cycles cannot reliably meet it. PrahiX Ora’s SOAR capability deploys pre-built playbooks with automated response actions — account lockdown via Active Directory, OAuth token revocation, session termination, and blocklist pushes directly to FortiGate — that execute within minutes of a detection trigger. For a Golden Ticket detection, a playbook can initiate domain controller isolation and escalate to the on-call incident commander simultaneously, compressing the response timeline from hours to minutes and generating the documentation artefacts required for CERT-In notification. Automation is not a convenience here — it is what makes regulatory compliance achievable.
Most organisations are not starting from zero — they have SIEM, they have MFA, they have some level of directory monitoring. The ITDR journey is about enriching and operationalising what exists, not replacing it.
Audit your SIEM data sources. Are all domain controller security logs ingested? Are VPN authentication logs, cloud SSO events, and Azure AD sign-in logs flowing? Is privileged account activity captured separately? Gaps in telemetry are gaps in detection — attackers know which log sources are typically missing and operate there deliberately.
Generic SIEM correlation rules are not sufficient for ITDR. Layer MITRE ATT&CK–mapped rules for the five use cases above, and establish behavioural baselines for privileged accounts. This step typically surfaces previously unknown misuse — service accounts being used interactively, stale admin accounts still active, and OAuth applications with excessive permissions.
For high-confidence detections — impossible travel, Golden Ticket indicators, mass failed authentication followed by success — automate the first-response action: account lockout, session revocation, SOC alert with full context. Reserve human decision-making for the triage and escalation steps, not the initial containment.
ITDR is not a set-and-forget capability. Attacker techniques evolve — particularly around cloud identity abuse and AI-assisted credential attacks. Feed threat intelligence from CERT-In advisories, MITRE ATT&CK updates, and your own incident findings back into your detection rules on a quarterly cadence.
India’s Digital Personal Data Protection Act creates explicit obligations around breach notification and data security. A credential-based breach that results in unauthorised access to personal data triggers DPDP notification requirements — and the clock starts when you know or should have known, not when you choose to investigate. ITDR, by compressing dwell time and generating real-time alerts, directly supports compliance with both the spirit and letter of DPDP obligations.
CERT-In’s 2022 directions — requiring 6-hour incident reporting for a broad range of cyber incidents — add operational urgency. An undetected identity compromise discovered days after the fact cannot meet that window. An organisation with ITDR capability, running automated detection and response, can credibly meet CERT-In timelines because the detection, containment, and evidence-collection steps are automated rather than manual.
PrahiX Ora’s SIEM, with tiered retention meeting CERT-In’s 180-day log retention direction, ensures that forensic evidence is available when regulators ask questions — not reconstructed after the fact.
PJ Networks has been operating 24/7 NOC and SOC services for Indian enterprises for over a decade. Our ITDR capability builds on that operational foundation with specific focus areas:
If your organisation cannot answer the following questions today, ITDR is a priority gap:
These are not aspirational benchmarks — they are the baseline capability that the current threat environment demands. The good news is that most Indian enterprises already have the foundational components; the gap is in integration, tuning, and 24/7 operational coverage.
PJ Networks works with Indian enterprise security teams to close these gaps without requiring a rip-and-replace of existing investments. Whether you are building ITDR capability on an existing SIEM or deploying PrahiX Ora as a unified operations platform, we bring the operational expertise and 24/7 coverage that transforms detection capability into business resilience.
To understand where your identity security posture stands today, speak with the PJ Networks team about an ITDR readiness assessment. Our security architects work with your existing environment to identify telemetry gaps, tune detection rules, and design response playbooks aligned to your compliance obligations.