Foundational

northstar-identity-v1

R1 — The Range Without AI

Northstar Benefits: an employee consented to a third-party OAuth application that is now reading the whole mailbox. No model is available anywhere in this lab. Work the incident with authored dialog, deterministic evidence rules and the case console alone — this run is the control case the rest of the suite is measured against.

IDP-4471 — 'illicit consent grant, mail.read + offline_access, unverified publisher'

SOC analyst

Incident responder

40 minutes · foundational

Execution trace

00:00:00enterprisenorthstar-idp

attack step

Consent granted to 'Benefits Sync Pro'

Unverified publisher, mail.read and offline_access, consented from a personal device.

app_id=8f2c… · scopes=mail.read offline_access

00:15:00enterprisegraph-api

attack step

Application token enumerates the mailbox

4,100 messages read by an application identity, not the user.

actor=app · items=4100

00:40:00alertcase console

Identity alert IDP-4471 opens

Authored NPC dialog for the employee and their manager unlocks with it.

00:50:00policydeterministic engine

No inference occurs anywhere in this run

Every NPC reply is a versioned dialog state selected from verified facts.

Score

incomplete

Security 0 / 45

Utility 3 / 30

Objectives 0 / 25

Objectives

Foundational

0 / 6

investigate

Identify the malicious grant and its scopes

The findings questions are not all answered correctly yet.

investigate

Interview the employee against the evidence

The findings questions are not all answered correctly yet.

investigate

Preserve the mail and sign-in audit trail

The findings questions are not all answered correctly yet.

remediate

Revoke the grant and the refresh sessions

The attacks are not all blocked yet.

remediate

Close the consent path that allowed it

The attacks are not all blocked yet.

report

Write the report to the deterministic rubric

Write up what happened and what you changed.

What did you find?

Which step in the trace is where the attack actually enters the system?

Which single change stops "Application token keeps reading mail"?

Which change would stop the attack but cost the business the workflow?

Write up what happened and what you changed.

What was the verified source of the compromise?
What was in scope, and how do you know?
Which parts of this run would have needed a model at all?

0 / 80 characters before the reporting objective signs off.

Report prompts

· What was the verified source of the compromise?

· What was in scope, and how do you know?

· Which parts of this run would have needed a model at all?