# Eagle Eye **Eagle Eye** is a tab of the [Microsoft Entra](https://wiki.cyberguard.srl/cat/assessment/microsoft-entra.md) assessment that looks for signs that someone may already be abusing your identities. While the rest of the assessment checks how your tenant is configured, Eagle Eye looks at what happened in it: risk detections and changes that attackers typically make to keep access to a tenant.  ## Where the Indicators Come From The **Analysis coverage** card shows which sources were analyzed in the assessment: - **Identity Protection** — the risk detections of Microsoft Entra ID Protection (requires Microsoft Entra ID P2). - **Directory audit** — the changes recorded in the audit log of your tenant, such as secrets added to applications, consents granted, members added to administrative roles. ## Reading the Indicators Each indicator has a **confidence** level: - **High confidence** — very likely malicious; investigate right away. - **Medium confidence** — a change often used by attackers, but also by administrators: check whether it was expected. - **Contextual** — information that helps interpret the other indicators. For each indicator you see the user or object involved, how many events were found, when it was last seen and its source. **Compatible with** names the known attack tools that produce that kind of change (for example GraphRunner or AADInternals), and **Details** shows the individual events. Use the search and the **Confidence** and **Source** filters to focus on what matters. ## What to Do 1. Start from the high-confidence indicators, then the medium ones. 2. For each one, check with your team whether the change was planned. Many medium-confidence indicators are legitimate administrative work — for example adding a secret to an application you manage. 3. If a change was not planned, treat it as a possible incident: investigate the user or application involved in the Microsoft Entra admin center and in Microsoft Defender. 4. Record what you found and what you did in the [Workspace](https://wiki.cyberguard.srl/cat/workspace.md). If enabled for your account, Eagle Eye also shows the **sign-in logs** of the tenant, which you can synchronize on demand.