Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

Discover how Abnormal uses TenantBase to provide in-depth insights into the users and applications across all of your mail tenants.
February 10, 2023

Are your tenants at risk?

No, we are not wading into the housing debate. We’re talking about mail tenants. Whether you have one tenant or one hundred, it is crucial to know who has access and what applications are integrated.

That second point is critical. Threat actors are using ostensibly legitimate (but in reality, compromised) applications to commandeer mail tenants–either with the goal of exfiltrating data or in the case of a recent attack identified by Microsoft, to run extensive spam campaigns.

We have customers with hundreds of mail tenants that previously needed to log in to each one individually in order to identify and investigate potential issues. But even if you only have one tenant housing your users, consider that our average customer (and maybe you reading this) has over 300 integrated third-party applications per tenant and hundreds, if not thousands of user mailboxes. Tenants are the hub for your organization’s communication and collaboration, so there needs to be an effective way to gain complete visibility into their activity.

Conduct a Unit Inspection with Abnormal TenantBase

The apartment puns write themselves, so forgive the headline, but Abnormal Security’s answer to tenant visibility concerns is the TenantBase Knowledge Base and the Security Posture Management Add-On. While the latter provides insight into high-impact changes to critical configurations such as tenant Conditional Access policies (CAPS), today we will take a closer look at TenantBase –– the hub for tenant activity data, and a key starting point for investigating unusual tenant events.

TenantBase consolidates the data captured in AppBase and PeopleBase into a comprehensive activity timeline—highlighting when a new application is installed or a user is added to a given tenant. Beyond this, TenantBase also surfaces the Tenant ID (with a link to the tenant) and the date a tenant was spun up so teams can directly access tenants from the Abnormal portal to correct issues.

Protect This House with TenantBase

Let’s dig in a bit deeper and take a look at exactly what information TenantBase provides. As mentioned, TenantBase provides a list of each tenant currently living in your cloud email environment along with a user and integrated app count–whether that means a single tenant for all users, multiple tenants for different business units, or multiple subsidiaries managed in one Abnormal portal.

Tenant Base1
  • Drilling down a bit deeper, though, into a particular tenant, you will be met with:
  • A granular timeline of tenant events (including apps installed and users registered to the tenant)

  • Tenant creation date and time

  • Tenant country

  • Tenant domain

  • Tenant ID (which links directly to the tenant’s admin authentication page)

If an Abnormal user wants to drill down into any of the configuration changes or other activities undertaken by a given user, each item in the timeline provides links to associated applications and users to cross-reference events in AppBase and PeopleBase.

Tenant Base2

As an example of a TenantBase use case using the above screenshot, let’s say that user Renee West’s account was found to have been compromised, and it is now critical to investigate recent user activity. Assuming the Enterprise Main tenant houses VIP mailboxes and other sensitive data, Renee’s recent installation of the Spoof Force application raises red flags (if only because of the name “Spoof Force,” but we’ll set that aside).

Now, with TenantBase, security teams can drill into the Spoof Force AppBase profile to learn more about this application.

Building a Strong Foundation with TenantBase

This is only the beginning for TenantBase. While understanding the applications and users is a crucial starting point, Abnormal continues to enhance visibility into tenant administrators, policies, and other key configurations to help protect what effectively amounts to the scaffolding for your entire cloud email security deployment.

Want to learn more about TenantBase? Request a personalized demo today.

Schedule a Demo
Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B 07 22 24 MKT624 Images for Paris Olympics Blog
Threat actors are targeting French businesses ahead of the Paris 2024 Olympics. Learn how they're capitalizing on the event and how to protect your organization.
Read More
B Cross Platform ATO
Cross-platform account takeover is an attack where one compromised account is used to access other accounts. Learn about four real-world examples: compromised email passwords, hijacked GitHub accounts, stolen AWS credentials, and leaked Slack logins.
Read More
B Why MFA Alone Will No Longer Suffice
Explore why account takeover attacks pose a major threat to enterprises and why multi-factor authentication (MFA) alone isn't enough to prevent them.
Read More
Learn how Abnormal uses natural language processing or NLP to protect organizations from phishing, account takeovers, and more.
Read More
B DK Compromise 7 11 24
Discover the top five ways hackers compromise accounts, from exploiting leaked API credentials to SIM swapping partnerships, and more. Learn how these techniques enable account takeover (ATO) and pose risks to enterprises.
Read More
B Sans Recap 7 11 24
Discover trends among modern SOC teams, including misaligned budgets, increased automation, unsatisfactory AI tools, staffing issues, and more.
Read More