An identity threat detection and response (ITDR) tool only detects what it can see, and what it can see shrinks quietly: a new domain controller goes live without a sensor, an identity provider connector loses its token, exclusions pile up and nobody tests whether the detections still fire. This page is a recurring health check for an ITDR tool that is already deployed. It gives you 13 metrics with formulas, data source types and red, amber and green thresholds, a sign-off cadence, a findings log and a remediation map. It is written for identity security engineers, SOC and detection engineering leads, and internal audit.
What this health check covers
The health check measures the ITDR tool as a platform: how much of the identity estate feeds it, whether the feeds are fresh, whether its detections still fire when tested, whether exclusions and tuning have eroded coverage, and whether the tool's own privileged access is controlled. It does not cover what ITDR is or how to choose one; for that, see the ITDR Guide and the ITDR Buyer's Guide. Detailed test design is in ITDR validation.
The figures support NIST SP 800-53 Rev. 5 SI-4 System Monitoring, AU-6 Audit Record Review, Analysis, and Reporting and AU-12 Audit Record Generation, NIST CSF 2.0 DE.CM-03 (personnel activity monitored), and CIS Controls v8.1 Control 8 Audit Log Management and Control 13 Network Monitoring and Defense. Detection coverage is expressed against MITRE ATT&CK techniques such as T1078 Valid Accounts, T1558.001 Golden Ticket, T1003.006 DCSync, T1556 Modify Authentication Process, T1621 Multi-Factor Authentication Request Generation and T1098 Account Manipulation. This page measures one tool; SOC-wide detection coverage and identity programme outcomes are measured separately.
Key takeaways
- Coverage starts with sensors and connectors. A domain controller or identity provider that does not feed the tool is a blind spot no detection can fix.
- Freshness matters as much as presence. A connector that reports healthy but delivers events hours late cannot support response.
- Test detections, do not assume them. Run safe, authorised simulations each quarter and count how many fire.
- Exclusions need owners and expiry dates. Unbounded exclusions for noisy service accounts are where attackers hide.
- The tool is tier 0. Its directory read accounts, response connectors and admin roles need the same scrutiny as domain admins.
How to use this template
Copy the tables into your tracker and replace text in square brackets, such as [Organisation], [ITDR owner] and [Head of SOC], with your own terms. At the first run, list every identity source that should feed the tool (on-premises directories and their domain controllers, identity providers, cloud tenants, privileged access and federation services) and keep that list as the denominator for later runs. Use only safe, authorised test methods for detection validation, agreed in advance with the SOC and change management. All thresholds are NHI Mgmt Group recommended thresholds; adjust to your risk appetite and record the values you use.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Sensor and connector health (IT-01 to IT-03) | Monthly | [ITDR owner] | [ITDR owner], escalated if red | Health export, identity source list |
| Core metrics run (IT-01 to IT-12) | Quarterly | [ITDR owner] | [Head of SOC] | Exports, test results, metric workbook |
| Detection validation exercise (IT-04, IT-05) | Quarterly | [Detection engineering lead] | [Head of SOC] | Test plan, timestamps, alerts raised or missed |
| Exclusion review (IT-08) | Quarterly | [ITDR owner] with exclusion owners | [Head of IAM] | Exclusion list with owner, reason and expiry |
| Independent re-performance | Quarterly | [Internal audit] or [Security assurance] | [Head of SOC] | Re-run of at least two metrics from raw data |
| Full annual run, adds IT-13 and response playbook exercise | Annual | [ITDR owner] | [CISO] | Exercise report, response connector test records |
| Event-driven run | After a directory change, new tenant, merger, tool upgrade or identity incident | [ITDR owner] | [Head of SOC] | Before and after figures |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| IT-01 | Identity source coverage | Identity sources connected to the tool / identity sources on the agreed list | Tool connector list against identity source register | 100% | 90% to below 100% | Below 90% |
| IT-02 | Domain controller sensor coverage | Domain controllers and federation servers with a healthy sensor or log feed / domain controllers and federation servers in the directory | Tool sensor health export against directory computer objects | 100% | 95% to below 100% | Below 95%, or any tier 0 server with no feed for 7 days |
| IT-03 | Event freshness | 95th percentile delay between event time and tool ingestion time, per identity source | Tool ingestion timestamps against source event timestamps | Under 15 minutes | 15 to 60 minutes | Over 60 minutes |
| IT-04 | Detection validation pass rate | Authorised test scenarios that raised the expected alert / test scenarios run in the period | Validation test log, tool alert history | 90% or above | 75% to below 90% | Below 75% |
| IT-05 | Priority technique coverage | Priority ATT&CK techniques with at least one detection that passed a test in the last 12 months / priority techniques on the agreed list | Detection inventory mapped to ATT&CK, validation log | 90% or above | 70% to below 90% | Below 70% |
| IT-06 | Alert to triage time | Median time from high-severity identity alert to first analyst action | SIEM or case management timestamps | Under 30 minutes | 30 to 120 minutes | Over 120 minutes |
| IT-07 | Alert fidelity | High-severity identity alerts closed as true positive or benign true positive / high-severity identity alerts closed | Case management closure codes | 40% or above | 20% to below 40% | Below 20% |
| IT-08 | Exclusion hygiene | Exclusions and suppressions with an owner, reason and expiry date in the future / all exclusions and suppressions | Tool exclusion export | 95% or above | 80% to below 95% | Below 80%, or any exclusion covering a tier 0 account without expiry |
| IT-09 | Posture finding ageing | Critical identity posture findings open longer than the agreed fix time / critical posture findings open | Tool posture findings export | Below 10% | 10% to 25% | Above 25% |
| IT-10 | Automated response readiness | Response actions (disable account, revoke sessions, force reset) that succeeded in their last test / response actions enabled | Response connector test records, tool action log | 100% | One action failed, with a fix date | More than one failed, one failed with no fix date, or any untested for 6 months |
| IT-11 | Tool service account hygiene | Tool directory, connector and response accounts with a named owner, least-privilege rights and a credential within rotation policy / all such accounts | Tool configuration export, directory group membership, credential age | 100% | 90% to below 100% | Below 90%, or any with domain admin equivalent rights not documented in the design |
| IT-12 | Tool admin footprint | Identities with tool admin rights compared with the approved named list, and those dormant 90 days | Tool role export, change records | Matches approved list, none dormant | Additions with a change record not yet reviewed | Any addition without a change record, or any dormant admin |
| IT-13 | Alert forwarding to SIEM or SOAR | Tool alerts received by the SIEM or SOAR / tool alerts raised, plus the longest forwarding gap | Tool alert history against SIEM ingestion | 100%, no gap over 1 hour | 99% to below 100%, or a gap over 1 hour up to 24 hours | Below 99%, or a gap over 24 hours |
IT-01 to IT-03 show whether the tool can see the estate, IT-04 and IT-05 whether its detections work, IT-06 and IT-07 whether people act on them, IT-08 and IT-09 whether tuning and posture have drifted, and IT-10 to IT-13 whether the tool itself is safe and connected. Calculation notes:
- Priority techniques (IT-05): agree the list once with threat intelligence and detection engineering; a starting set for directory environments is T1558.001 Golden Ticket, T1003.006 DCSync, T1098 Account Manipulation, T1556 Modify Authentication Process, T1621 Multi-Factor Authentication Request Generation and T1078 Valid Accounts. The joint agency guidance Detecting and Mitigating Active Directory Compromises is a useful source for the directory techniques. See the Golden Ticket, Silver Ticket and DCSync Guide and the MFA Fatigue and Bypass Guide.
- Validation (IT-04): use test methods approved by the SOC, such as honeytoken or canary account triggers and vendor-neutral simulation of sign-in anomalies, run from documented test identities. See the Honeytokens and Canary Credentials Guide.
- Fidelity (IT-07): a very high figure can mean detections are too narrow. Read it next to IT-04: high fidelity with a low pass rate means the tool is quiet, not accurate.
- Non-human identities: service accounts generate much of the noise and so collect most exclusions. Split IT-08 by human and non-human accounts and report both.
How to collect the data
| Data source type | Used for | What to export |
|---|---|---|
| Identity source register (directories, identity providers, cloud tenants, federation services) | IT-01 | Every source that should feed the tool, with owner |
| Directory computer object export | IT-02 | All domain controllers and federation servers, including recently promoted ones |
| Tool sensor and connector health export | IT-01 to IT-03 | Status, last event time, version per sensor or connector |
| Validation test log | IT-04, IT-05 | Scenario, technique ID, test identity, time run, expected alert, result |
| Detection inventory mapped to ATT&CK | IT-05 | Detection name, technique IDs, last successful test date |
| SIEM or case management records | IT-06, IT-07, IT-13 | Alert creation, first action, closure code, forwarding timestamps |
| Tool exclusion and suppression export | IT-08 | Scope, owner, reason, created and expiry dates |
| Tool posture findings export | IT-09 | Finding, severity, first seen, status |
| Response connector test records and tool configuration | IT-10, IT-11 | Action, last test date and result, account used and its rights |
| Tool role export and change records | IT-12 | Admin role members, last sign-in, approving change |
Pull the denominators for IT-01 and IT-02 from the directory and the identity source register, never from the tool's own list of connected sources, which will always look complete.
Red flags that need action now
- A domain controller or federation server with no sensor or log feed.
- An identity provider connector that has failed authentication or stopped delivering events.
- A failed validation test for directory replication abuse or forged Kerberos tickets.
- An exclusion covering a tier 0 account or group with no expiry date.
- A tool service account with directory rights beyond its documented design, or with a credential never rotated.
- A tool admin added without a change record.
- Automated account disable or session revocation that failed its last test.
- Tool alerts not arriving in the SIEM or SOAR for more than 24 hours.
An unexplained admin addition or a new exclusion nobody owns may be attacker activity rather than drift. Handle it through the Identity Incident Response Playbook first.
Findings log
One row per red or amber result; carry open rows forward. Findings accepted as risks go to the Risk Register Template.
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-ITDR-01 | [Two domain controllers in a new site have no sensor] | IT-02 | [High] | [ITDR owner] | [date] | [Open] |
| HC-ITDR-02 | [DCSync simulation raised no alert; detection disabled during a noisy upgrade] | IT-04 | [High] | [Detection engineering lead] | [date] | [Open] |
| HC-ITDR-03 | [31% of exclusions have no expiry; most cover backup service accounts] | IT-08 | [Medium] | [ITDR owner] | [date] | [Open] |
| HC-ITDR-04 | [finding] | [metric ID] | [severity] | [owner] | [date] | [status] |
Suggested severity: High for red results on coverage, validation or the tool's own accounts, Medium for other red results, Low for amber.
Remediation map
| Finding type | Likely cause | Where to fix it |
|---|---|---|
| Source, sensor and freshness gaps (IT-01 to IT-03) | New servers or tenants outside onboarding, expired connector credentials | ITDR Guide |
| Failed tests and technique gaps (IT-04, IT-05) | Detections disabled or tuned away, new techniques not covered | ITDR validation and Detection Engineering Guide |
| Slow triage, low fidelity (IT-06, IT-07) | Alert routing, missing context, noisy rules | Identity Threat Hunting Guide and Detection Engineering Guide |
| Exclusion sprawl (IT-08) | Service account noise suppressed instead of fixed | How to assign owners to orphaned service accounts |
| Ageing posture findings (IT-09) | No owner for directory hygiene work | Active Directory ACL and Delegation Hygiene Guide |
| Response, tool accounts and admin footprint (IT-10 to IT-12) | Connectors built at deployment and never reviewed | ITDR Guide and Privileged Access Management Guide |
| Forwarding gaps (IT-13) | Integration change, expired API credential | Detection Engineering Guide |
Related guides
- ITDR Guide: what the tool should do and how it fits the identity stack.
- Identity Visibility, Posture and Threat Detection Guide: the category overview.
- Identity Security Metrics Guide: programme-level identity metrics above this tool check.
- Identity Incident Response Playbook: response when a red flag is real.
- ITDR Buyer's Guide: if repeated results point to a gap in the tool itself.
References
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls (SI-4, AU-6, AU-12)
- NIST: Cybersecurity Framework 2.0 (DE.CM-03)
- CIS: Critical Security Controls v8.1
- CISA and partner agencies: Detecting and Mitigating Active Directory Compromises
- MITRE ATT&CK: Golden Ticket
- MITRE ATT&CK: DCSync
Related NHI Mgmt Group resources: ITDR Buyer's Guide · ITDR Guide · ITDR validation · Identity Threat Hunting Guide