chat
expand_more

Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

Discover how Abnormal uses TenantBase to provide in-depth insights into the users and applications across all of your mail tenants.
February 10, 2023

Are your tenants at risk?

No, we are not wading into the housing debate. We’re talking about mail tenants. Whether you have one tenant or one hundred, it is crucial to know who has access and what applications are integrated.

That second point is critical. Threat actors are using ostensibly legitimate (but in reality, compromised) applications to commandeer mail tenants–either with the goal of exfiltrating data or in the case of a recent attack identified by Microsoft, to run extensive spam campaigns.

We have customers with hundreds of mail tenants that previously needed to log in to each one individually in order to identify and investigate potential issues. But even if you only have one tenant housing your users, consider that our average customer (and maybe you reading this) has over 300 integrated third-party applications per tenant and hundreds, if not thousands of user mailboxes. Tenants are the hub for your organization’s communication and collaboration, so there needs to be an effective way to gain complete visibility into their activity.

Conduct a Unit Inspection with Abnormal TenantBase

The apartment puns write themselves, so forgive the headline, but Abnormal Security’s answer to tenant visibility concerns is the TenantBase Knowledge Base and the Security Posture Management Add-On. While the latter provides insight into high-impact changes to critical configurations such as tenant Conditional Access policies (CAPS), today we will take a closer look at TenantBase –– the hub for tenant activity data, and a key starting point for investigating unusual tenant events.

TenantBase consolidates the data captured in AppBase and PeopleBase into a comprehensive activity timeline—highlighting when a new application is installed or a user is added to a given tenant. Beyond this, TenantBase also surfaces the Tenant ID (with a link to the tenant) and the date a tenant was spun up so teams can directly access tenants from the Abnormal portal to correct issues.

Protect This House with TenantBase

Let’s dig in a bit deeper and take a look at exactly what information TenantBase provides. As mentioned, TenantBase provides a list of each tenant currently living in your cloud email environment along with a user and integrated app count–whether that means a single tenant for all users, multiple tenants for different business units, or multiple subsidiaries managed in one Abnormal portal.

Tenant Base1
  • Drilling down a bit deeper, though, into a particular tenant, you will be met with:
  • A granular timeline of tenant events (including apps installed and users registered to the tenant)

  • Tenant creation date and time

  • Tenant country

  • Tenant domain

  • Tenant ID (which links directly to the tenant’s admin authentication page)

If an Abnormal user wants to drill down into any of the configuration changes or other activities undertaken by a given user, each item in the timeline provides links to associated applications and users to cross-reference events in AppBase and PeopleBase.

Tenant Base2

As an example of a TenantBase use case using the above screenshot, let’s say that user Renee West’s account was found to have been compromised, and it is now critical to investigate recent user activity. Assuming the Enterprise Main tenant houses VIP mailboxes and other sensitive data, Renee’s recent installation of the Spoof Force application raises red flags (if only because of the name “Spoof Force,” but we’ll set that aside).

Now, with TenantBase, security teams can drill into the Spoof Force AppBase profile to learn more about this application.

Building a Strong Foundation with TenantBase

This is only the beginning for TenantBase. While understanding the applications and users is a crucial starting point, Abnormal continues to enhance visibility into tenant administrators, policies, and other key configurations to help protect what effectively amounts to the scaffolding for your entire cloud email security deployment.

Want to learn more about TenantBase? Request a personalized demo today.

Schedule a Demo
Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B Human Risk
Humans are the biggest concern in cybersecurity, and AI is needed to protect them. Discover how Abnormal takes an AI-native approach to protecting human behavior.
Read More
B Proofpoint Replacement Multinational Healthcare Service Provider
Global healthcare provider detects 868 missed attacks and saves 13,000+ hours annually after moving from a Proofpoint SEG to Abnormal’s AI-native solution.
Read More
B Convergence S3 Recap Blog
That’s a wrap on Season 3! Explore a few of the biggest takeaways from chapters 7-9 and learn how to watch all three sessions on demand.
Read More
B CSAM SOC
Explore key insights from the SOC Unlocked podcast on enhancing cybersecurity awareness and training. Learn how offensive tactics, insider threats, AI, and cloud security shape effective defense strategies.
Read More
B F500 Packaging Solutions Provider Proofpoint Replacement Blog
A Fortune 500 packaging leader boosted threat detection 20x and saved 6,500+ hours annually by replacing its Proofpoint SEG with Abnormal’s AI-powered solution.
Read More
B E Rate
Discover how AI-powered email protection ensures a secure digital learning environment.
Read More