Ingext Logo Ingext

Investigations

It’s like having MDR for Microsoft 365.

You can’t install CrowdStrike or SentinelOne inside Microsoft 365. Your mail, identities and files live there, and Microsoft’s own alerts stop short of true detection.

Ingext fills that gap. Its AI SOC investigates every case through to a written verdict, like this one: real, with the company and people replaced.

Open the investigation

Read the full investigations · written by the AI SOC

Two more cases, start to finish.

Ransomware · Endpoint

Confirmed · respond now

An unsigned ransomware binary is live and unmitigated on a laptop.

A file posing as a Microsoft Edge update deleted a shadow copy and was flagged as ransomware. The investigation proved the host was still infected and that nothing had been done to stop it.

  • A stale inventory snapshot that looked safe, against the live record that wasn’t
  • An external IP that turned out to be a red herring
  • Isolate now: the response steps, in order
Open the full investigation
View full report

Unwanted software · Endpoint

Confirmed · remediated

A known-bad app store dropped a payload that was already blocklisted.

The same product had been confirmed malicious on another laptop a month earlier. The investigation traced which file dropped which, proved it hadn’t spread, and caught a bad recommendation before it was acted on.

  • Parent and payload untangled from the raw timestamps
  • No spread: every hash checked across the whole company
  • Why blocking the publisher beats blocking each new build
Open the full investigation
View full report

What every investigation does

Tested, rebuilt, and proven, before anyone acts on it.

01 · Test every claim

The first read isn’t the verdict.

Every reason given for raising the case is tested against the raw records. Here, all four held, and an inventory snapshot that looked safe turned out to be hours out of date.

View full report

02 · Rebuild the real timeline

What happened, to the second.

Summaries round events into buckets. The investigation goes back to the source records, so you see the real order: here, which file dropped which, and what was cleaned up and what wasn’t.

View full report

03 · Prove what didn’t happen

A zero you can trust.

Every “nothing found” is checked against a control that proves the search works, because a broken query and a clean result look identical. Gaps are named as gaps, never counted as clear.

View full report

Investigations as results

1,915 investigations, finished by the AI SOC.

Across five production deployments, every one ended in a written closure. 94.8% were explained and closed without an analyst; the rest reached a person with the work already done.

Closed · 94.8%
1,816
Explained and closed with the evidence. No analyst hours spent.
Escalated · 4.0%
76
Handed to a person with the investigation done and the decision framed.
Confirmed · 1.2%
23
Real attacks, proven, with the response laid out.

Every investigation ends in a headline

Not “suspicious activity detected.” What actually happened.

These are closure headlines the AI SOC wrote, sanitized. Even the ones it closed tell you exactly why.

Confirmed

  1. 01A new device in another country signed in 98 seconds after the real user, then read mail and hid a vendor’s replies
  2. 02An admin-console takeover that reset a coworker’s password and self-granted domain-wide API access
  3. 03A correct password reached Azure Resource Manager after three foreign sign-in attempts were blocked
  4. 04A live persistence and credential-theft attempt on an application server, not fully contained
  5. 05An unsigned, behaviorally-detected ransomware binary is live and unmitigated on a NOC workstation
  6. 06A disguised dropper ran on two hosts, ten days apart, with zero containment either time
  7. 07One sender in a coordinated Teams-phishing campaign from shared hosting infrastructure
  8. 08A targeted, unsuccessful credential-stuffing run against the Global Administrator’s mailbox
  9. 09A fourth host hit by the same signed-installer dropper campaign
  10. 10A browser-downloaded ransomware-classified executable, auto-contained in 3.5 minutes

Escalated

  1. 01A first MFA method was registered on a three-week-old account, minutes before SharePoint access, from an address the company does not own
  2. 02An IT support technician granted themselves access to a senior manager’s mailbox and read it
  3. 03A password-spray attempt that got the password right, and was still locked out
  4. 04Console login without MFA from abroad by an IAM user that is normally Terraform automation
  5. 05A Global Administrator self-registered an OAuth app and gave it org-wide mailbox access
  6. 06A VT-confirmed malware hash was written by Tomcat’s upload handler, and the host’s EDR policy let it sit
  7. 07A webshell drop on a WordPress site, auto-remediated in 250ms
  8. 08An alert-forwarding mailbox rule, rebuilt in OWA, now forwards outside the tenant
  9. 09Real credentials sit in a user’s own SharePoint notes file; the account itself is not compromised
  10. 10A shared mailbox tripped Microsoft’s own outbound-spam limit; who actually sent the mail is not visible here

Closed

  1. 01A continuous VPN session, read as impossible travel across 14 countries
  2. 02A single “download folder as zip” click, split into 563 audit rows
  3. 03A helpdesk-assisted MFA recovery, not a takeover
  4. 04A Veeam RPC port-sweep against domain controllers, misread as NTLM credential theft
  5. 05The endpoint agent’s own code-integrity self-check, misread as tampering
  6. 06A self-service passkey enrolment inside a tenant-wide MFA rollout
  7. 07Microsoft’s own Copilot research agent, flagged by a noisy new preview detector
  8. 08A SharePoint migration service account scanning its own archive site
  9. 09A new hire’s first day on a corporate laptop at headquarters
  10. 10A single dropped DNS packet to shared resolver infrastructure, not an outbound DoS

Think you have a problem?

Connect Microsoft 365 now and see if Ingext can help.

Microsoft keeps some of the evidence, like Entra ID sign-in logs on many plans, for as little as 7 days. Connect Ingext fast enough and we can pull that data while it still exists, analyze it, and tell you what happened.

Connect Microsoft 365Talk to us