Lock an account and kill sessions
This is the first step in remediating a compromised account. Here’s how to do it in Petra. Note: only relevant if Petra Response is disabled.
Locking out the attacker
Remediating Compromised Accounts
You’ll only need to do this if Petra Response is disabled. Otherwise, a member of the Petra team will take care of it as soon as the incident occurs.
When Petra detects a compromised account, it immediately appears as an active incident and notifies you via configured notification methods, such as your PSA, Teams chat, calls, or texts.
Steps to Remediate an Account
-
Navigate to the Dashboard by clicking the Petra logo in the top left corner. You can also go to the Incidents tab in the top navigation bar.
-
The incident will appear in red. You can’t miss it.
-
In the incident detail view, you’ll see the Remediation Actions panel.
- If the account is actively compromised (unremediated), this panel is fully expanded and displays a prominent red button prompting immediate action.
-
Click Revoke Sessions and Lock Account. This will apply immediately, and works even with hybrid and on-prem synced M365 accounts.
After performing this action, Petra logs the exact time, which you can see as a confirmation checkmark in the Remediation Actions panel.
Revoking sessions and locking the account works even if the account is hybrid or on-prem synced.
-
Following the initial lockout, any auto-identified persistence mechanisms will also appear for 1-click disabling in the Remediation Actions Panel.
Automatic Remediation with Petra Response
If you have enabled Petra Response for a tenant, our security team is authorized to automatically handle critical remediation tasks for you, including:
- Locking compromised accounts
- Revoking active sessions
- Disabling identified persistence mechanisms
- Retracting phishing emails from users’ inboxes
You can enable or disable Petra Response for specific tenants:
- Navigate to the Dashboard by clicking the Petra logo in the top left corner.
- Toggle Petra Response on the bottom tenant list to authorize or de-authorize the Petra team to take immediate action when an incident occurs.
Enabling Petra Response allows our team to remediate an incident, remove persistence mechanisms, and retract phishing emails as soon as the incident occurs. We have an extremely low surfaced false-alarm rate, so business disruption is minimal. We highly recommend that everyone enables Petra Response.