Login & Account Watch: Spikes, Strangers & New Admins
You'll walk away with: A read-only watcher you built with Claude Code that, every 5–15 minutes, checks YOUR OWN systems and cloud tenant against YOUR definition of normal account-health — failed-login bursts, impossible sign-ins, a new admin appearing, MFA switched off — and stays silent on an ordinary day, with evidence attached when it isn't.
🔒 This walkthrough is part of the full training. Choose a plan to unlock it.