Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

Are your tenants at risk?

No, we are not wading into the housing debate. We’re talking about mail tenants. Whether you have one tenant or one hundred, it is crucial to know who has access and what applications are integrated.

That second point is critical. Threat actors are using ostensibly legitimate (but in reality, compromised) applications to commandeer mail tenants–either with the goal of exfiltrating data or in the case of a recent attack identified by Microsoft, to run extensive spam campaigns.

We have customers with hundreds of mail tenants that previously needed to log in to each one individually in order to identify and investigate potential issues. But even if you only have one tenant housing your users, consider that our average customer (and maybe you reading this) has over 300 integrated third-party applications per tenant and hundreds, if not thousands of user mailboxes. Tenants are the hub for your organization’s communication and collaboration, so there needs to be an effective way to gain complete visibility into their activity.

The apartment puns write themselves, so forgive the headline, but Abnormal Security’s answer to tenant visibility concerns is the TenantBase Knowledge Base and the Security Posture Management Add-On. While the latter provides insight into high-impact changes to critical configurations such as tenant Conditional Access policies (CAPS), today we will take a closer look at TenantBase –– the hub for tenant activity data, and a key starting point for investigating unusual tenant events.

TenantBase consolidates the data captured in AppBase and PeopleBase into a comprehensive activity timeline—highlighting when a new application is installed or a user is added to a given tenant. Beyond this, TenantBase also surfaces the Tenant ID (with a link to the tenant) and the date a tenant was spun up so teams can directly access tenants from the Abnormal portal to correct issues.

Let’s dig in a bit deeper and take a look at exactly what information TenantBase provides. As mentioned, TenantBase provides a list of each tenant currently living in your cloud email environment along with a user and integrated app count–whether that means a single tenant for all users, multiple tenants for different business units, or multiple subsidiaries managed in one Abnormal portal.

• Drilling down a bit deeper, though, into a particular tenant, you will be met with:

• A granular timeline of tenant events (including apps installed and users registered to the tenant)

• Tenant creation date and time

• Tenant country

• Tenant domain

• Tenant ID (which links directly to the tenant’s admin authentication page)

If an Abnormal user wants to drill down into any of the configuration changes or other activities undertaken by a given user, each item in the timeline provides links to associated applications and users to cross-reference events in AppBase and PeopleBase.

As an example of a TenantBase use case using the above screenshot, let’s say that user Renee West’s account was found to have been compromised, and it is now critical to investigate recent user activity. Assuming the Enterprise Main tenant houses VIP mailboxes and other sensitive data, Renee’s recent installation of the Spoof Force application raises red flags (if only because of the name “Spoof Force,” but we’ll set that aside).

Now, with TenantBase, security teams can drill into the Spoof Force AppBase profile to learn more about this application.

This is only the beginning for TenantBase. While understanding the applications and users is a crucial starting point, Abnormal continues to enhance visibility into tenant administrators, policies, and other key configurations to help protect what effectively amounts to the scaffolding for your entire cloud email security deployment.

Want to learn more about TenantBase? Request a personalized demo today.