BEC investigation and containment
Bring available Microsoft 365 user evidence into the security-ticket workflow. Use VirtuBot policy controls for supported containment actions, then verify the result and investigate what remains.
For administrators and MSP technicians evaluating suspected account compromise. Collection and automation require the configured services, permissions, policy and installed version. No response-time or security-outcome guarantee.
Business email compromise response is the work of investigating suspected email fraud, limiting unauthorized access and coordinating recovery. BEC can involve an account takeover or impersonation without access to the impersonated account. MSPControl supports the Microsoft 365 account-investigation path with user-log collection, ConnectWise attachments and VirtuBot policy controls for disabling a user, revoking sign-in sessions and resetting a password. These capabilities do not replace the wider incident-response process.
The operating workflow
Identify the customer, ticket and affected Microsoft 365 user. Distinguish a compromised account from a spoofed sender before selecting an account action. The collection and containment methods need a matching supported account.
Request the user-log collection and inspect the task result and ticket attachments. Review the collection time, errors and missing sources. Do not postpone urgent containment while waiting for a complete evidence set.
Use the configured security-ticket analysis to support the investigation. Compare the AI assessment with the available records and customer context. An AI conclusion, evidence score or confidence score is not proof that an account is compromised.
Review the independent disable-user, revoke-session and reset-password switches, their test modes and the evidence/confidence thresholds. Validate the configured VirtuBot workflow in an authorized test environment before production use.
Check the action result and resulting Microsoft account state. A submitted request, completed background task or generated ticket note is not proof of successful containment. Investigate failures and confirm the correct cloud or hybrid identity authority.
Continue with the compromised-account response guide for persistence review and safe recovery. Assign business-impact assessment and any required customer, legal or financial follow-up to the responsible people. Record decisions and unresolved gaps in the incident.
What MSPControl supports
The current MSPControl implementation provides the following collection and action paths. Successful collection, analysis and execution remain separate things to verify.
The user-log collector requests the previous seven days of sign-in and Unified Audit Log activity for the matched account. Actual records depend on the source, access, licensing and availability.
For the associated Exchange Online mailbox, the collector requests the supported rule data. This is evidence to inspect; collecting rules does not itself remove persistence or prove that a rule is malicious.
The background workflow builds separate sign-in, audit and mailbox-rule Excel files and attempts to attach them to the ticket. Review task errors and confirm that the expected files arrived.
VirtuBot policy settings expose separate controls for disabling the compromised user, revoking sign-in sessions and resetting the password, with individual test modes and evidence/confidence thresholds.
Interpretation and coverage
| Area | Supported behavior | What to verify |
|---|---|---|
| Account matching | Collection and containment resolve a supported Microsoft 365 account by user identity. | Confirm the intended customer and account. A missing match can end the operation without performing the requested work. |
| Sign-ins and audit logs | The collector requests a seven-day lookback; shared fetched data can be reused for up to 15 minutes. | Check source coverage and timestamps. A cached result is not a new live query. |
| Errors and task completion | Some source failures return empty result sets; the background task can finish with an error. | Inspect errors and actual attachments. Empty data or a completed flag is not a successful investigation. |
| AI and policy controls | Security-ticket settings include analysis, action switches, test modes and evidence/confidence thresholds. | Confirm the deployed VirtuBot configuration. A score is not a calibrated probability or an approval record. |
| Containment | The supported action methods can disable the user, revoke sign-in sessions and reset the password. | Verify execution and effective access. Application-controlled sessions may need separate revocation. |
| Recovery and persistence | Mailbox, identity and ticket documentation support the next administrative steps. | Review suspicious rules, consent, authentication methods and business impact separately; do not infer full recovery from containment. |
Configuration and next actions
Common questions
Yes, for the supported Microsoft 365 account-investigation path. The user-log workflow collects available sign-ins, audit activity and associated mailbox rules and attempts to attach separate Excel reports to a ConnectWise ticket. Review source availability and errors before drawing conclusions. BEC involving impersonation alone may not involve a compromised account to contain.
VirtuBot has configurable controls for disabling the user, revoking sign-in sessions and resetting the password, with separate test modes and evidence/confidence thresholds. Availability depends on the deployed workflow and configuration. Verify each action and the resulting Microsoft state; this is not a promise of universal or immediate containment.
No. The collector requests a seven-day lookback for sign-ins and audit activity, can reuse shared data for up to 15 minutes, and depends on available source data. Ticket attachments are not a claim of immutable storage, legal preservation, complete retention or chain of custody.
No. Missing permissions, unavailable sources or collection errors can produce empty results. Check the task error, source availability, timestamps and expected attachments. A completed task is not the same as complete evidence or a successful security outcome.
No. The disable-user method in this path selects account disabling. Mailbox rules, forwarding, authentication methods, application consent, devices and application-owned sessions need the appropriate separate review and action. Use the linked response checklist and Microsoft guidance.
No. This page describes supported evidence collection and configurable containment capabilities, not an end-to-end autonomous service. Human review, incident ownership, outcome verification and remaining recovery work are still required. No measured customer result or response-time guarantee is presented.
Self-hosted. Free license available. No credit card required.
