October’s Breaches Started With a Login. Would You See Yours?
Look at October 2026's incident roundups and a pattern shows up. In Denmark, attackers reached the national CPR register through an old account whose password was 123456. ASOS was breached with a stolen login. The SafePay ransomware group hit more than 600 organizations, largely through stolen passwords and brute force (CM-Alliance roundup).
None of these needed a zero-day. They needed a valid sign-in, and every sign-in leaves a record in your identity provider.
Five sign-in signals worth an alert
Password spraying. One source tries a few common passwords against many accounts, staying under lockout thresholds. LogPulse's built-in detection counts how many different accounts one IP fails against.
Brute force against one account. Many failures for a single account. When it fires, check whether a success followed: that is the part that matters.
MFA fatigue. A burst of push prompts to one user until they approve one. LogPulse flags repeated failed MFA challenges against one account.
MFA turned off or a privileged role granted. After getting in, attackers often weaken the account or give it admin rights. Both are built-in detections on the audit logs.
Legacy authentication. Old protocols such as IMAP, POP3 or SMTP with basic auth skip MFA entirely. LogPulse flags these sign-ins in Entra ID; they are worth knowing about even when they are not malicious.
Add context: who is signing in from where
A failed login is noise; a failed login from an address on a threat feed is not. LogPulse enriches sign-in events with its IOC feeds and raises the entity's risk score, so a spray from known attack infrastructure stands out from a user who forgot their password.
And because the retro-hunt checks known attack IPs 30 days back, a new indicator can show you a sign-in attempt that happened weeks ago.
Where the logs come from
Connect Microsoft Entra ID sign-in and audit logs or the Okta system log under Sources, Cloud; there is nothing to install. For servers, the LogPulse agent collects sshd and sudo from `/var/log/auth.log` or `/var/log/secure`, and the Windows Security log for domain controllers.
LogPulse does not replace MFA, a password manager or an EDR. It tells you when those controls are being tested, and whether one of them failed.
The free plan includes these detections and needs no credit card. See the full picture on Threat intelligence.