Skip to main content

Identity and access monitoring

Huntbase connects to the identity providers you already run and lets you ask governance questions across all of them from one place: who holds admin roles, who has no MFA, which accounts are dormant or suspended, who was created or removed recently, and who can reach which applications. You answer them with ready-made query templates, keep them running on a schedule, and turn the results into an access review you can hand to the people who own each system.

Identity connections are query sources. When you run a query, Huntbase asks the provider's API at that moment, so the answer reflects your directory as it is now, not a copy taken last night. Each connection's content pack also keeps a light inventory of users, groups and role assignments as entities, so they show up in hunts and the entity graph.

Connect your identity sources​

Add a connection for each provider from Connections › New connection. Each integration page lists the credential to create, the minimum read-only permissions, the tables it adds and how many query templates ship with it.

ProviderWhat you can queryIntegration page
OktaUsers and their status, roles and groups, MFA factors, app assignments, group rules and owners, sign-on and MFA policiesOkta
Microsoft Entra IDUsers, guests, sign-in activity, MFA registration, directory roles and role assignments, PIM eligibility, app role assignments, service principals, the directory audit log, access review definitionsAzure AD
Google WorkspaceUsers, administrators, 2-Step Verification, last login, groups and members, admin roles and role assignmentsGoogle Directory
Google Workspace activityAdmin and login activity reports, Gmail forwarding and delegation settingsGoogle Workspace
JumpCloudUsers, suspended users, MFA, user groups, application accessJumpCloud
DuoUsers, enrolment, last login, administrators, admin and authentication logs, phones and hardware tokensDUO
Auth0Users, MFA, roles and permissions, applications, authentication logsauth0
GitHubOrganization members and their roles, two-factor status, outside collaborators, teams, repository adminsGitHub

Keycloak and OneLogin can be connected too. OneLogin is searched with STIX patterns, which suits indicator sweeps rather than access reviews.

Questions you can answer​

Every template below is in Library › Queries. Search for its name, or narrow the list with All products and, under More filters, Category (for example compliance or inventory). Open a template and click Run in explorer to run it against your connection. See Query templates.

You can also ask in plain language. With the language on Auto, ask Scout, the investigation partner, something like Which Okta users haven't signed in for 90 days? and it picks the table and connection for you. See Chatting with Scout.

Who has admin or privileged roles​

ProviderTemplate
OktaGet Profile, Group, and Assigned Role Details for Each User
Entra IDList users with access to directory roles, Role assignments with detailed role and principal information, Find principals with multiple role assignments, List active role eligibility instances, Find highly privileged roles
Google WorkspaceList administrators, List super admin roles, List all role assignments
DuoList all administrators, Integrations granted permission to administrator methods
Auth0List users assigned to a role, All Permissions Granted to a User
GitHubList all collaborators with admin role, List all repository admins, List visible teams and repositories they have admin permissions to

To list every Okta user who holds a given admin role, run this in a query tab with SQLite:

SELECT u.login, u.status, json_extract(r.value, '$.type') AS role
FROM okta_user u, json_each(u.assigned_roles) r
WHERE json_extract(r.value, '$.type') = {{role_type}};

Enter SUPER_ADMIN, ORG_ADMIN or another Okta role type in the role_type field.

Accounts without MFA​

ProviderTemplate
Google WorkspaceList users without two-step verification
JumpCloudList Users With MFA Disabled
DuoUsers who have not yet enrolled
Auth0Users Without MFA, Admin Users Without MFA
GitHubList admin members with two factor authentication disabled
OktaList all user security factors, List factors pending activation
Entra IDList user authentication registration details

For Entra ID, this lists admins who haven't registered an MFA method:

SELECT user_principal_name, user_display_name, methods_registered
FROM azuread_user_registration_details_report
WHERE is_admin = 1 AND is_mfa_registered = 0;

Drop is_admin = 1 to see every user. For Okta, this lists active users with no active factor:

SELECT u.login, u.email
FROM okta_user u
WHERE u.status = 'ACTIVE'
  AND NOT EXISTS (
    SELECT 1 FROM okta_factor f
    WHERE f.user_id = u.id AND f.status = 'ACTIVE'
  );

Dormant accounts​

ProviderTemplateParameter
OktaList Users Who Have Not Logged In for More Than N Daysdays_inactive (default 30)
Google WorkspaceList users who have not logged in for more than N daysinactive_days (default 30)
DuoUsers who have not logged in for more than N days, Users who have never logged in, Administrators who have never logged ininactive_days (default 30)
Entra IDList users sign-in activity (last interactive and non-interactive sign-in per user)

Set the parameter to the threshold your policy uses, such as 90 days.

Accounts created, suspended or removed​

ProviderTemplate
Entra IDList activities related to user creation in last N days, List disabled users in Azure AD, List guest users in Azure AD
JumpCloudList Suspended Users
DuoUsers who are locked out, User statistics by status
OktaOkta Users Basic Info (status and creation date for every user)

For Okta, this lists accounts created in the last 30 days, and accounts suspended or deprovisioned in the same window:

SELECT login, status, created, status_changed
FROM okta_user
WHERE created > datetime('now', '-30 days')
   OR (status IN ('SUSPENDED', 'DEPROVISIONED')
       AND status_changed > datetime('now', '-30 days'));

For Entra ID, this lists users deleted in the last 30 days, from the directory audit log:

SELECT activity_date_time,
       json_extract(initiated_by, '$.user.userPrincipalName') AS deleted_by,
       json_extract(t.value, '$.userPrincipalName') AS deleted_user
FROM azuread_directory_audit_report, json_each(target_resources) AS t
WHERE activity_display_name = 'Delete user'
  AND activity_date_time >= date('now', '-30 days')
ORDER BY activity_date_time;

Who can reach which applications​

ProviderTemplate
OktaList Okta Applications with Assigned User Details, List Okta Applications with Assigned Group Details, List Okta Apps Assigned to a Specific User, List Okta Users Not Assigned to Any Application
Entra IDList all application role assignments granted to users, List all application role assignments granted to groups, Get application role assignments for a user
JumpCloudJumpCloud Application User Access List

Service accounts, applications and credentials​

ProviderTemplate
Entra IDAzure AD service principals basic info, List disabled service principals, List all application role assignments granted to service principals, List Owners of an Azure AD Application
Auth0Auth0 applications basic info, Grant types of a client
DuoList all integrations, Tokens and their users (hardware tokens)
1PasswordOnePassword API Credentials Basic Info (API credentials stored in your vaults)

Group membership and ownership​

Okta's Get group member details for each group, List group owners basic info and List group rules basic info, Entra ID's List users with their group memberships and List groups that can be assigned to roles, Google's List all groups and their members and List all owners of a group, and GitHub's List team members for a specific team show who is in each group and who controls it.

Keep watching​

Beta

Scheduling is currently rolling out and may not be enabled for your organization.

Run any of these templates on a clock so drift shows up without anyone remembering to look. Open the template, go to its Schedules tab and click New schedule, or schedule a query you've already run from its own Schedules tab in Explorer. A daily run of Google's List administrators or Entra ID's List users with access to directory roles, or a weekly run of the dormant-account template, gives you a record of every result over time. Scheduled runs are listed in Activity Feed › Queries with a Scheduled chip. See Schedules.

Huntbase doesn't ship watchers for identity-provider changes such as a new admin role grant or an MFA reset yet. You can browse the watcher catalog, fetch SigmaHQ rules and write your own over the telemetry you send to Huntbase.

Run a periodic access review​

Use a hunt as the working file for each review. It keeps the evidence, your decisions and the write-up together, and a new one each quarter gives you a record you can show an auditor.

  1. Start a hunt for the review, for example Q4 access review: admin roles and dormant accounts. See Start a hunt.
  2. Add the templates for the systems in scope with Add from Library…, and run them. See Query templates.
  3. Go through the rows. Tag and note the accounts to remove or downgrade, and record who signed off.
  4. Generate the report from the hunt's Report tab. To get the same sections every quarter, such as Scope, Privileged accounts, Accounts without MFA, Dormant accounts and Actions, save your own report template for the organization. See Hunt reports.
  5. Share it. Download gives you the report as a Word document or Markdown file to send to each system owner. Add owners to the hunt with the Share dialog so they can read the evidence. The tracker spreadsheet exports the tagged rows as a workbook.

Each regenerated report is kept as a new read-only version, so the version an owner signed off stays as it was. To save a playbook for next quarter, choose Save as playbook… from the hunt's ⋯ menu. Then launch it to start the next review with the same queries.

For a quick list without a hunt, Export in a query's results toolbar downloads every row as CSV or JSON. See Query workspace.

Hunt identity attacks​

Governance tells you who should have access. When you suspect someone is abusing it, use a hunt. The Huntbase Hunt Hub publishes reviewed identity hunts as hunt.md files you can import with New playbook › Import (see Hunt playbooks):

Next steps​