Heimdall · Identity Module
Identity & Access Management
Heimdall monitors Okta, Azure AD, and AWS IAM continuously — detecting anomalies, privilege creep, and MFA gaps in real time. Average detection time for privilege escalation: 90 seconds.
How Heimdall Monitors Identity
Identity is the primary attack vector in modern breaches — compromised credentials, over-provisioned roles, and MFA gaps account for the majority of initial access events Heimdall detects. The Identity Module ingests authentication events, role assignment changes, and access policy modifications from Okta, Azure AD, and AWS IAM, establishing behavioral baselines for each user and service account.
When a user authenticates from an unusual location, a service account assumes a role it has never touched before, or a new admin assignment occurs outside a change window, Heimdall raises an alert within 90 seconds. Not because a threshold was crossed — because the behavior deviates from established pattern.
Anomaly Detection Across Identity Providers
- Okta monitoring: Authentication anomalies, failed MFA attempts, session hijacking indicators, and admin action auditing across all Okta-connected applications.
- Azure AD monitoring: Conditional access policy changes, guest account activity, privileged role assignments, and sign-in risk events correlated with Heimdall's threat intelligence.
- AWS IAM monitoring: IAM policy changes, cross-account role assumptions, root account usage, and access key activity tracked continuously across all regions.
Privilege Creep Detection
- Entitlement inventory: Heimdall maintains a real-time map of every user's effective permissions across all connected identity providers — surfacing over-provisioned accounts and unused elevated access.
- Access review automation: Periodic access reviews are generated automatically, flagging accounts that haven't used their elevated permissions in 30, 60, or 90 days.
- Lateral movement indicators: When privilege assignments change outside normal patterns — new admin rights, new role assumptions — Heimdall correlates with concurrent network and endpoint signals.
MFA Coverage and Gap Tracking
- MFA enrollment gaps: Heimdall identifies every account without MFA enrolled, segmented by application, department, and risk level — with daily reporting until remediated.
- MFA bypass detection: Legacy authentication protocol use (SMTP AUTH, IMAP, legacy NTLM) that bypasses MFA is flagged immediately.
- Phishing-resistant MFA tracking: Accounts using SMS-based MFA versus hardware keys or passkeys are distinguished, with upgrade recommendations prioritized by account risk level.
Integration with Heimdall SOC
Identity findings from the IAM module feed directly into Heimdall's incident pipeline. A privilege escalation event detected in AWS IAM will automatically correlate with concurrent endpoint behavior and network anomalies, producing a single consolidated incident rather than isolated alerts from three separate tools. Containment actions — session termination, access key rotation, account suspension — execute through Heimdall's response playbooks with your team's approval.
