security-investigator: Skill for Claude Code

Authentication Tracing - Instructions

Purpose

This skill performs forensic analysis of Entra ID authentication flows to determine whether anomalous sign-ins represent:

• Legitimate activity (VPN usage, user travel, mobile carrier routing)
• Token theft/credential compromise (stolen refresh tokens, session hijacking)

The key distinction is whether the user actively performed MFA at a suspicious location or if the authentication used a refresh token from a prior session.

---

📑 TABLE OF CONTENTS

1. Critical Workflow Rules - Start here!
2. Key Forensic Indicators - Understanding authentication signals
3. IP Enrichment Data - JSON structure reference
4. 6-Step Forensic Workflow - SessionId-based investigation
5. Real-World Example - Complete walkthrough
6. Authentication Methods Reference - Method patterns
7. Risk Escalation Criteria - High/Medium/Low classification
8. Best Practices - Summary checklist

---

⚠️ CRITICAL WORKFLOW RULES - READ FIRST ⚠️

🚨 MANDATORY CHECKPOINT: Before providing ANY risk assessment for authentication anomalies:

1. STOP - Do not improvise or use general security knowledge
2. READ the complete risk assessment framework in this document
3. QUOTE specific instruction sections in your analysis
4. VERIFY your conclusions match documented guidance before responding to user

Before executing ANY authentication tracing queries, you MUST:

1. Read the SessionId-based workflow (Steps 1-6 below) in full
2. Search the investigation JSON for IP enrichment data (ip_enrichment array) - PRIMARY DATA SOURCE
3. Follow the documented steps in order (SessionId → Authentication chain → Interactive MFA → Risk assessment)
4. Use IP enrichment context in your final risk assessment (VPN status, abuse scores, threat intel, auth patterns)