Spotting suspicious logins at scale: (Alert) pathways to success

Expel outlines how they cut median investigation time for suspicious login alerts by 75% through a decision support approach that combines automation, contextual enrichment, investigation orchestration, and UI improvements; by instrumenting SOC metrics (alert pathways and investigation cycle time) they identified repetitive manual queries and automated retrieval of user authentication histograms, geolocation maps, IP/user-agent summaries, and MFA/account details, improving alert-to-close from 61% to 86% and reducing investigations from 39% to 14% (May 2019 → May 2020).