Updated 2026-11-13
Investigating Account Lockouts: Separate Observations from Causes #
Use an alert as a starting point and compare records with the endpoint's condition.
The original article described investigating an endpoint after an account-lockout alert. This version focuses on the investigative approach without individual operational details.
Do not infer a cause from an alert alone #
Observing a lockout and identifying its cause are different findings. Check possible explanations, including external attempts and endpoint problems, against the available evidence.
Compare the same subjects and periods #
Align the subject and timestamps when reviewing related records. Use an AI summary as an entry point, then verify the facts in the original records and the endpoint's state.
Check what changed after action #
Finishing an action does not complete the investigation. Check whether the reported behavior has subsided, and do not generalize one case to every lockout.
The lessons from the original case have been reorganized for this public article. See the BASTION introduction for current features and deployment conditions.
