Account Locking in the MDR Portal

Introduction

If our analysts discover an account that is acting maliciously, or suspiciously, they can lock that user’s access the Field Effect MDR Portal. There are two levels of severity for account locking:

• Re-Authentication Required: if we discover a lower confidence indicator that someone has compromised an account, we will force the user to re-authenticate their account.  
• Account Locked:  if we discover a high-confidence indicator that someone has compromised an account, we will lock the user's account and inform organization administrators via ARO and email/SMS notification.

Account Blocking Notifications

The following images show examples of the notifications you will receive for account locking.

When Field Effect locks an account, administrators receive the following email notification:

Once Field Effect unlocks the account, administrators receive the following email notification:

The User Experience for Locked Accounts

When a user needs to re-authenticate their account, they will be logged out of their current session (if applicable) and see the following message on the login screen:

When Field Effect blocks a user account, the MDR Portal logs the user out of their current session (if applicable) and shows them the following message on the login screen.

Viewing Blocked Users

Administrators can view locked users from the User Management page.The "All Users" filter shows all locked accounts and labels them as locked, and you can also use the "Locked" filter to see only locked accounts.