Identity Threat Detection and Response (ITDR) focuses on protecting identity systems and detecting their misuse. Kerberos is a primary authentication protocol in Active Directory; therefore, analyzing Kerberos ticket anomalies is crucial for detecting attacks like Golden Ticket or Pass-the-Ticket. Similarly, monitoring for suspicious authentication patterns, such as impossible travel, unusual login times, or brute-force attempts, is a core function of ITDR and User and Entity Behavior Analytics (UEBA) engines. These two sources provide direct evidence of potential identity compromise or abuse.
