PingOne Protect - Investigating a Login, End to End

Discussion prompt

Before we open PingOne Protect - Investigating a Login, End to End: without looking back, what was the main idea of PingOne DaVinci - Orchestrating Identity Flows, and what could you do by the end of it that you could not do before?

Hint: One sentence for the idea, one for the skill. If the second one is blank, that is the part to revisit.

Discussion prompt

The weak answer: "It came back high risk." That's a label. It ends the conversation and it teaches the listener nothing.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Discussion prompt

Explain A smoke alarm, not a verdict by analogy to something with no Identity & Access Management in it at all — a queue, a recipe, a map, a bank balance, whatever fits. Then say where your analogy breaks.

Hint: An analogy that never breaks is not an analogy, it is the same idea wearing a hat. Find the seam — that is the part that is actually new.

Match the pairs

From Three questions, every time — match each one to what it actually does. The descriptions have been shuffled.

• c1. What happened?
• c2. Why this score?
• c3. So what?

• b1. Which exact login event, by which user, into which app, at what time, from where.
• b2. Which predictors fired, and what each one detected. The score is the sum, not the story.
• b3. Is it genuinely suspicious, what else could explain it, and what should the business do?

Why: What happened?, Why this score?, So what? are easy to tell apart while they are sitting next to their descriptions and much harder afterwards, which is what this checks.

Predict first

A student writes this, and it looks reasonable:

The habit: open the dashboard, see HIGH, report "we have a high-risk user."

It is wrong. Say what breaks — and say it before you turn the page.

Correct: The first question back is "why?" and you have to go look — in front of whoever asked.

The habit: never say a level without saying the predictors underneath it.

Why: The first question back is "why?" and you have to go look — in front of whoever asked.

Put in order

These are the steps of The investigation loop, scrambled. Put them back in order before the next slide shows you.

1. Locate the exact risk evaluation for that login.
2. Filter down to it systematically instead of scrolling.
3. Read the risk level, the score, and the recommended action.
4. Decompose into the predictors that fired.
5. Challenge — what else could explain each signal?
6. Explain in one plain-English paragraph, ending in a recommended action.

Why: This is the order the recipe itself gives. Recalling the sequence without the slide in front of you is the difference between recognising the method and being able to run it — most of what goes wrong in practice is a step done out of turn.

Eliminate the wrong options

A user's sign-on returns HIGH risk. What is the correct next action?

3 of these 4 are wrong. Strike them one at a time, and say what rules each one out before you strike the next. The survivor is the answer.

• A. Open the event, identify which predictors fired, and consider innocent explanations before concluding anything
• B. Lock the account immediately, since HIGH is Protect's determination that the event was malicious
• C. Raise the High threshold in the risk policy, since a legitimate user reaching HIGH indicates mis-tuning
• D. Wait for a second high-risk event from the same user, since one event is never statistically meaningful

Survives elimination: A

Why: A risk level is the aggregate of predictor scores crossing a threshold you configured. It tells you enough detectors fired to be worth examining — not that an attack occurred. The investigation begins by decomposing the level into its predictors and asking what else could produce those same signals.

Check your understanding

A user's sign-on returns HIGH risk. What is the correct next action?

• A. Open the event, identify which predictors fired, and consider innocent explanations before concluding anything (correct)
• B. Lock the account immediately, since HIGH is Protect's determination that the event was malicious
• C. Raise the High threshold in the risk policy, since a legitimate user reaching HIGH indicates mis-tuning
• D. Wait for a second high-risk event from the same user, since one event is never statistically meaningful

Answer: A

Why: A risk level is the aggregate of predictor scores crossing a threshold you configured. It tells you enough detectors fired to be worth examining — not that an attack occurred. The investigation begins by decomposing the level into its predictors and asking what else could produce those same signals.

Why B tempts people

HIGH means the aggregated score crossed your configured High threshold. It is a signal to investigate, and acting punitively on it without examination is how legitimate travellers get locked out and how trust in the tool is lost.

Why C tempts people

Retuning thresholds in response to a single event, before understanding why it scored as it did, changes detection sensitivity blindly. Tuning follows analysis; it does not replace it.

Why D tempts people

A single event is entirely actionable — that is the point of per-event risk evaluation. Waiting for a second event means letting a genuine account takeover proceed while you gather evidence.

Comparison matrix

From Who knows what: refill the Knows column from what you know. The rest of the table is as it appeared.

Comparison matrix

From The two audit events: every row here is a choice with a cost. Fill the What it proves column, then say which row you would actually pick and what you give up for it.

Discussion prompt

Explain The PingOne audit page and its retention to a student a year behind you. No notation, no jargon they have not met — and it still has to be true.

Hint: If your explanation needs a symbol they have never seen, you are describing the notation rather than the idea.

Put in order

Put the moves of Following one login through the chain into the order they have to happen.

1. Start at the application: confirm the user believes they signed in, and get the rough time.
2. Move to PingFederate: confirm the authentication event and the policy path taken.
3. Check the PingOne audit log for a Risk Evaluation Created event for that user near that time.
4. Note the exact timestamp, the IP address, and the target application from that event.
5. Open Monitoring > Threat Protection and filter to that user, application, and time.
6. Open the event and read the level, score, and contributing predictors.
7. Verify you have the right event by matching the IP address against the audit entry.

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. A user's own account of when and where is evidence, and it is the cheapest evidence available.

Discussion prompt

Work backwards. The example finished here:

Verify you have the right event by matching the IP address against the audit entry.

What was it asked to do, and what must it have been given? Reconstruct the problem from its answer.

Hint: Every quantity in the result had to enter somewhere. Account for each one.

Predict first

You find the user's authentication event in CloudWatch but no risk information anywhere in the log stream. What does this most likely mean?

Answer it in your own words, now, with nothing to choose from. The options are on the next slide — and picking the right one off a list is an easier skill than producing it.

Correct: Nothing is wrong — audit events confirm an evaluation occurred, but the predictor breakdown only exists in PingOne Protect

Why: The CloudWatch pipeline retrieves PingOne audit events — authentication events, user activities, policy decisions, administrative changes. Those establish that an evaluation happened and when. The detailed risk analysis, including which predictors fired and their contribution, lives in PingOne Protect and is read through the Threat Protection dashboard.

Check your understanding

You find the user's authentication event in CloudWatch but no risk information anywhere in the log stream. What does this most likely mean?

• A. Nothing is wrong — audit events confirm an evaluation occurred, but the predictor breakdown only exists in PingOne Protect (correct)
• B. The CloudWatch pipeline is misconfigured, since risk scores are part of the standard audit event payload
• C. The risk policy was not assigned to the application, so no evaluation was performed for this login
• D. The 90-day retention window has expired for the risk portion of the event while the authentication portion remains

Answer: A

Why: The CloudWatch pipeline retrieves PingOne audit events — authentication events, user activities, policy decisions, administrative changes. Those establish that an evaluation happened and when. The detailed risk analysis, including which predictors fired and their contribution, lives in PingOne Protect and is read through the Threat Protection dashboard.

Why B tempts people

Audit events record that actions occurred; they are not a delivery mechanism for the full risk analysis. A correctly configured pipeline behaves exactly this way, so reconfiguring it would waste time.

Why C tempts people

If no evaluation had been performed, there would be no Risk Evaluation Created event at all. The scenario describes finding the authentication event, which does not by itself indicate the risk step was skipped.

Why D tempts people

Retention applies to whole events, not to portions of them. A 90-day window would remove the user event entirely rather than stripping selected fields from it.

Discussion prompt

Finding it in the dashboard — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: Go to Monitoring > Threat Protection in the PingOne admin console.

Draw it

Draw what Finding it in the dashboard just did — the shape of it, not the line-by-line working. One picture, labels only where you need them. Then check it against the steps: anything you could not draw is a step you followed rather than understood.

Predict first

A student writes this, and it looks reasonable:

The approach: set the range to today and scroll for something that looks like your event.

It is wrong. Say what breaks — and say it before you turn the page.

Correct: You are now eyeballing a list, which is neither repeatable nor defensible when someone asks how you found it.

The approach: filter by identity first, time second.

Why: You are now eyeballing a list, which is neither repeatable nor defensible when someone asks how you found it.

Predict first

A concrete run. The report is: "Someone from marketing got challenged yesterday and doesn't know why."

Commit before you compute: what does The narrowing funnel come out to? A rough magnitude and the right form is enough — the point is to have something concrete to be wrong about.

Correct: Verify the conclusion by re-applying the original User filter and confirming the story still fits.

Why: A prediction you can defend turns the computation into a check rather than a leap of faith — and an answer that contradicts it is caught on the spot. Pivoting out and back is how you avoid building a theory on a coincidence.

Predict first

A student writes this, and it looks reasonable:

The symptom: you filter by username and get zero results, though you know the user signed in.

It is wrong. Say what breaks — and say it before you turn the page.

Correct: You start re-checking PingFederate and the risk policy — an hour of work aimed at the wrong thing.

The reflex: suspect the query before you suspect the system.

Why: You start re-checking PingFederate and the risk policy — an hour of work aimed at the wrong thing.

Discussion prompt

The rule this trap just fixed:

If the user appears with a wide, simple query, the problem was your narrowing — not the data.

Now break it on purpose. Build a case that violates it and follow the consequences until something visibly fails. Where does the failure first show up — and would you have noticed it if you had not been looking?

Hint: The dangerous rules are the ones whose violation still produces an answer. If yours fails loudly, try to find one that fails quietly.

Check your understanding

You filter the risk data table by a username you copied from a chat message, and get zero results despite knowing the user signed in yesterday. What should you check first?

• A. Whether the pasted value contains a leading or trailing space, since spaces are significant characters (correct)
• B. Whether you need to wrap the username in quotation marks so it is treated as an exact phrase
• C. Whether a wildcard is required, such as appending an asterisk to match the full username
• D. Whether the risk policy was assigned to that user's group, since unassigned users produce no rows

Answer: A

Why: The dashboard's search has three documented constraints: no wildcard support, spaces are significant characters, and quotation marks are not supported. A value copied from chat very commonly carries a trailing space, which makes the query match nothing. Checking this costs seconds and explains most empty-result cases.

Why B tempts people

Quotation marks are explicitly not supported. Adding them would introduce characters into the query rather than grouping the phrase, making an empty result more likely rather than less.

Why C tempts people

Wildcards are explicitly not supported either. Appending an asterisk would add a literal character to the search value and guarantee no match.

Why D tempts people

An unassigned policy would affect which policy scored the event, not whether the user appears in the risk data table at all. Evaluations still occur and still appear.

Discussion prompt

Decomposing a HIGH — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: Open the event and list every predictor that returned **medium or…

Predict first

Two companies see identical predictor results for the same login, but one reports MEDIUM and the other HIGH. What explains this?

Commit to an answer, then rate it — certain, fairly sure, or guessing — and write the rating down before you turn the page.

Correct: They configured different predictor scores or different thresholds in their risk policies

Why: A risk level is derived, not measured. The policy assigns a numerical score to each predictor that returns medium or high, sums them, and compares the total against configured High and Medium thresholds. Identical predictor results therefore produce different levels whenever the scores or thresholds differ — which is exactly why you should quote thresholds alongside any level.

The rating matters as much as the answer: confident-and-wrong is the combination that survives revision, because nothing about it feels like it needs revisiting.

Check your understanding

Two companies see identical predictor results for the same login, but one reports MEDIUM and the other HIGH. What explains this?

• A. They configured different predictor scores or different thresholds in their risk policies (correct)
• B. One has a PingOne Protect license and the other only PingOne Risk, which caps the maximum level
• C. The machine-learning models have trained for different lengths of time, shifting the computed level
• D. One evaluated the event as a TRANSACTION flow type and the other as AUTHENTICATION, which scales the score

Answer: A

Why: A risk level is derived, not measured. The policy assigns a numerical score to each predictor that returns medium or high, sums them, and compares the total against configured High and Medium thresholds. Identical predictor results therefore produce different levels whenever the scores or thresholds differ — which is exactly why you should quote thresholds alongside any level.

Why B tempts people

Licensing determines which predictors are available, not how levels are computed. Since the premise states the predictor results are identical, both environments evidently ran the same predictors.

Why C tempts people

Training affects whether learned predictors fire at all and how accurately. Once the predictor results are fixed — as the premise states — the level follows from scores and thresholds arithmetic.

Why D tempts people

Flow type determines which targeted policy applies; it does not scale a score. It could indirectly select a different policy, but the mechanism would still be that policy's scores and thresholds.

Comparison matrix

From Rule-based versus learned: refill the Behaves column from what you know. The rest of the table is as it appeared.

Put in order

Put the moves of Reading a multi-predictor story into the order they have to happen.

1. List what fired: New Device, User Location Anomaly, and Anonymous Network.
2. Translate each into its question: unknown device, unusual place, connection hiding its origin.
3. Look for coherence — do these signals tell one story or three unrelated ones?
4. Name the story: this pattern is consistent with account takeover.
5. Now deliberately construct the innocent version before you commit.
6. Identify the one fact that would settle it — did the user actually travel?
7. Verify by checking that fact before escalating.

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. Write them down before interpreting.

Discussion prompt

The Poland login — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: State both hypotheses explicitly before gathering anything.

Predict first

A student writes this, and it looks reasonable:

The setup: you're demoing, you want a dramatic moment, and the event scored HIGH.

It is wrong. Say what breaks — and say it before you turn the page.

Correct: New device 'means' the attacker's machine; the VPN 'means' they're hiding — each stated as fact rather than as one reading.

The setup: you name both readings for every signal, then explain how you'd choose.

Why: New device 'means' the attacker's machine; the VPN 'means' they're hiding — each stated as fact rather than as one reading.

Put in order

These are the steps of The challenge checklist, scrambled. Put them back in order before the next slide shows you.

1. What else could explain each signal? Name at least one innocent cause per predictor.
2. Is this user's history consistent with the innocent story? Have they travelled before, changed devices before?
3. Does the IP belong to anyone else in the tenant — corporate NAT, or a hosting provider?
4. Is anything physically impossible, like geovelocity? Impossibility is the strongest evidence available.
5. What is the cheapest question that settles it, and have I asked it?

Why: This is the order the recipe itself gives. Recalling the sequence without the slide in front of you is the difference between recognising the method and being able to run it — most of what goes wrong in practice is a step done out of turn.

Discussion prompt

The challenge checklist works on the cases you have just seen. Push it to the edge: what is the most degenerate input it still handles — empty, zero, one item, everything equal — and what is the first case where it stops being true? Name the case, not just "it breaks".

Hint: Try the smallest legal input, then the largest, then the one where two things collide. Methods are specified at their edges; the middle takes care of itself.

Predict first

A HIGH-risk event shows New Device and User Location Anomaly for a user who normally signs on from one office. What is the strongest next step?

Answer it in your own words, now, with nothing to choose from. The options are on the next slide — and picking the right one off a list is an easier skill than producing it.

Correct: Check whether the same user had a recent sign-on elsewhere, since impossible travel would make the innocent explanation much harder

Why: New device plus new location is equally consistent with account takeover and with an employee travelling with a new laptop. Geovelocity is the discriminator: if the same account signed on somewhere far away shortly before, no single person could have made both, which is close to physical proof. Look for the fact that separates the hypotheses rather than assuming one.

Check your understanding

A HIGH-risk event shows New Device and User Location Anomaly for a user who normally signs on from one office. What is the strongest next step?

• A. Check whether the same user had a recent sign-on elsewhere, since impossible travel would make the innocent explanation much harder (correct)
• B. Lock the account, because new device combined with new location is the standard account-takeover signature
• C. Lower the New Device score in the risk policy, since it is clearly producing false positives for travelling users
• D. Wait to see whether the user generates further high-risk events before spending time investigating

Answer: A

Why: New device plus new location is equally consistent with account takeover and with an employee travelling with a new laptop. Geovelocity is the discriminator: if the same account signed on somewhere far away shortly before, no single person could have made both, which is close to physical proof. Look for the fact that separates the hypotheses rather than assuming one.

Why B tempts people

This pattern is genuinely common among legitimate travellers, so acting punitively on it alone produces frequent wrongful lockouts. It is a strong reason to investigate, not a conclusion on its own.

Why C tempts people

Retuning a predictor because one event was ambiguous changes detection sensitivity based on a sample of one, and would do so before you even established whether this event was a false positive.

Why D tempts people

Waiting for corroboration means allowing a genuine takeover to continue. The point of per-event evaluation is that a single event is actionable — through investigation, not necessarily through enforcement.

Comparison matrix

From Combinations tell the story: every row here is a choice with a cost. Fill the But check column, then say which row you would actually pick and what you give up for it.

Predict first

Writing the one-paragraph explanation is about to be worked. State your hypothesis first: which rule or definition decides this one, and what is the first move it forces? Then watch whether the example agrees with you.

Correct: Sentence 1 — the event. Who signed into what, when, and from where.

Why: Ground the listener in a concrete occurrence before introducing any judgment.

A hypothesis you wrote down is falsifiable; a vague sense of how it will go is not. If the example opens somewhere else, that gap is the thing worth chasing.

Discussion prompt

A worked explanation — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: "On Tuesday at 09:14, Dana signed into the customer portal from an…

Draw it

Draw what A worked explanation just did — the shape of it, not the line-by-line working. One picture, labels only where you need them. Then check it against the steps: anything you could not draw is a step you followed rather than understood.

Predict first

A student writes this, and it looks reasonable:

The report: "Geovelocity anomaly and new device predictors triggered, aggregating to a high risk classification."

It is wrong. Say what breaks — and say it before you turn the page.

Correct: The sentence describes the tool's internals rather than the event, so a business reader learns nothing actionable.

The report: "Dana signed on from Poland on a computer we've never seen, four hours after signing on from Ohio."

Why: The sentence describes the tool's internals rather than the event, so a business reader learns nothing actionable.

Sort into buckets

Some of these hold up and some are the exact mistakes this lesson is built to prevent. Sort them.

Holds up

The weak answer: "It came back high risk." That's a label. It ends the conversation and it teaches the listener nothing.; A smoke alarm going off does not mean your house is burning. It means something in the air matched what burning smells like.; Every Protect investigation answers the same three questions in the same order. If you can only remember one slide from this deck, make it this one.

Breaks

The habit: open the dashboard, see HIGH, report "we have a high-risk user."; The assumption: logs are logs, so the score must be in the log stream somewhere.

sound

These are stated as this lesson states them — each one survives the edge cases PingOne Protect - Investigating a Login, End to End puts it through.

flawed

Each of these is lifted from a trap in this deck: reasonable-sounding, and wrong in a way that only shows up once you rely on it.

Discussion prompt

Explain A dashboard is not a demo to a student a year behind you. No notation, no jargon they have not met — and it still has to be true.

Hint: If your explanation needs a symbol they have never seen, you are describing the notation rather than the idea.

Put in order

Put the moves of The five-beat investigation demo into the order they have to happen.

1. Beat 1 — the setup. "We onboarded this application. Someone signed in twenty minutes ago."
2. Beat 2 — the hunt. Find the event on screen: time range, then User, then Target Application.
3. Beat 3 — the verdict. Read the level, the score, and the threshold aloud.
4. Beat 4 — the evidence. Name each predictor that fired, in plain English.
5. Beat 5 — the judgment. Give both readings, say which you believe, and recommend an action.
6. Verify the whole run in rehearsal, with the real event, on the real screen.

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. Start with a real, recent, verifiable event.

Discussion prompt

Work backwards. The example finished here:

Verify the whole run in rehearsal, with the real event, on the real screen.

What was it asked to do, and what must it have been given? Reconstruct the problem from its answer.

Hint: Every quantity in the result had to enter somewhere. Account for each one.

Discussion prompt

Explain What the business does next by analogy to something with no Identity & Access Management in it at all — a queue, a recipe, a map, a bank balance, whatever fits. Then say where your analogy breaks.

Hint: An analogy that never breaks is not an analogy, it is the same idea wearing a hat. Find the seam — that is the part that is actually new.

Discussion prompt

Feedback categories include FALSE_HIGH_RISK, FRIENDLY_BOT, NEW_ACCOUNT_FRAUD, COMPROMISED_ACCOUNT, and AUTOMATED_ATTACK.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Discussion prompt

Run Investigation run of show with this step confiscated:

Beat 3: read level, score, threshold.

Is it still possible? If it is, say what takes its place and what it costs you. If it is not, say exactly what that step was providing that nothing else does.

Hint: A step you can drop for free was never load-bearing. If you cannot drop it, name the thing that goes wrong the moment it is gone.

Discussion prompt

Outside this lesson: where does PingOne Protect - Investigating a Login, End to End actually turn up? Name one concrete situation — a job, a piece of software someone ships, a decision somebody has to make — and say which part of Investigation run of show is doing the work in it.

Hint: Vague is the failure mode here. "Engineering" is not a situation; "deciding whether this build is fast enough to ship" is.

Eliminate the wrong options

Which demo structure best conveys the value of PingOne Protect to a mixed business and technical audience?

3 of these 4 are wrong. Strike them one at a time, and say what rules each one out before you strike the next. The survivor is the answer.

• A. Investigate one real login end to end — find it, read the verdict, name the predictors, weigh both readings, recommend an action
• B. Tour the dashboard graphs in order, explaining what each chart measures across the population
• C. Show the risk policy configuration screen and walk through every available predictor and its settings
• D. Display the highest-scoring events from the past six months to demonstrate the range of threats detected

Survives elimination: A

Why: The value of Protect is not the dashboard but what it reveals about a specific login and what should be done about it. An end-to-end investigation has a question at the start and a business decision at the end, which is what makes it a story rather than a tour — and it demonstrates the workflow the audience would actually perform.

Check your understanding

Which demo structure best conveys the value of PingOne Protect to a mixed business and technical audience?

• A. Investigate one real login end to end — find it, read the verdict, name the predictors, weigh both readings, recommend an action (correct)
• B. Tour the dashboard graphs in order, explaining what each chart measures across the population
• C. Show the risk policy configuration screen and walk through every available predictor and its settings
• D. Display the highest-scoring events from the past six months to demonstrate the range of threats detected

Answer: A

Why: The value of Protect is not the dashboard but what it reveals about a specific login and what should be done about it. An end-to-end investigation has a question at the start and a business decision at the end, which is what makes it a story rather than a tour — and it demonstrates the workflow the audience would actually perform.

Why B tempts people

A chart tour explains what the product measures but never answers a question anyone asked. It could be replaced by a screenshot, which is the test for whether something is a tour rather than a demo.

Why C tempts people

Configuration screens interest the person who will operate the tool and nobody else in the room. It also shows capability rather than outcome, leaving the business audience to infer the value themselves.

Why D tempts people

Cherry-picking extreme events shows the tool can produce high scores but establishes no baseline, so the audience cannot tell whether high scores are meaningful or simply common.

Comparison matrix

From Sources: PingOne Protect and the dashboard: refill the Page (append to the base above) column from what you know. The rest of the table is as it appeared.

Draw it

One page, no notation unless you need it: draw how these connect — The Reframe · The Plumbing · Finding the Event · Using the Filters · Reading the Score · Predictors as Detectors. Put an arrow wherever one of them is what makes another possible, and label the arrow with why.