Example: Use Twosense Security Events to Trigger Real-Time Adaptive Authentication

Automatically step authentication up or down as risk changes, keeping protection aligned with real-time risks.

Overview

Goal: Use Twosense as a Shared Signals Framework (SSF) transmitter so ITDR can receive risk-level security events, update the High Risk Users list, and trigger real-time adaptive authentication in Advanced Passwordless Authentication (APA).

In this example, Twosense detects that the person using an account may no longer be the expected user.

  1. Twosense sends a Security Event Token (SET) to ITDR to indicate that the user’s risk level changed to high.
  2. ITDR uses a monitor to add the user to the High Risk Users list.
  3. The APA Default rule set uses the High Risk Users list to step up authentication on the user’s next authentication event.
  4. If the user successfully completes step-up authentication, the user can continue but remains on the High Risk Users list.
  5. When Twosense later detects that the user’s behavior returned to normal, Twosense sends a low-risk SET to ITDR.
  6. ITDR uses a second monitor to remove the user from the High Risk Users list and return the user to the standard authentication flow on future authentication events.

This example assumes that Twosense is configured as an SSF transmitter and ITDR is configured to receive Security Event Tokens.

Before You Begin

Before you begin, verify that you have:

  • An APA license, which includes an ITDR tenant.
  • A Twosense license that can send SETs.
  • Permission to configure SSF transmitters.
  • Permission to create lists, monitors, and rule set changes in ITDR.
  • An APA Default rule set. Three versions, Strict, Moderate, and Permissive, are created automatically when an ITDR tenant is provisioned for APA.

Step 1: Configure Twosense as an SSF Transmitter

Configure Twosense to send security events to ITDR.

Twosense acts as the transmitter. ITDR acts as the receiver. After you configure the transmitter, Twosense can send supported CAEP events, such as Risk Level Change events, to ITDR.

To configure the transmitter:

  1. Log in to itdr.imprivata.com.
  2. Click the Account icon in the upper-right corner.
  3. Select Settings.
  4. Scroll down to the Shared Signals Framework section.
  5. On the SSF Transmitter card, click Add.
  6. Enter the required configuration details:
    • Source Name: Enter Twosense.
    • Issuer URL: Enter https://ssf-beta.twosense.ai/.well-known/ssf-configuration.
    • Bearer Token: Copy the bearer token from your Twosense instance.
  7. Click Test Configuration.
  8. If the test is successful, click Save.

After the transmitter is saved, ITDR displays the transmitter in the Shared Signals Framework section with a stream status.

The stream status indicates whether the transmitter is connected and available. For example:

  • Active: The stream is connected and available.

  • Error: The stream could not be created or verified. Hover over the Error status to view the tooltip, review the error message, confirm the issuer URL and bearer token, and try again.

You can also click Verify Stream to re-check the connection. ITDR displays the last verified timestamp so you can see when the stream was most recently validated.

After the transmitter is configured, Twosense can send SETs to ITDR when supported security events occur.

Result: When Twosense sends a low-risk SET, ITDR automatically removes the user’s Account ID from the High Risk Users list. On the next authentication event, the user is no longer evaluated as high risk and returns to the standard authentication method associated with the lower-risk outcome.

Step 2: Create a High Risk Users List

Create an empty list that ITDR updates automatically with high-risk users.

The APA Default rule set references this list to determine when to step up authentication for a user. Your security team can also use the list to investigate suspicious activity.

To create the list in ITDR:

  1. Go to Lists.
  2. Click +.
  3. Name the list High Risk Users.
  4. Add a short description, such as Tracks users added automatically by ITDR when third-party risk signals indicate elevated risk.
  5. Click Save.

The list starts empty. Monitors update the list automatically in a later step.

Step 3: Step Up Authentication for High-Risk Users

Add a rule to your APA Default rule set that checks whether the user is on the High Risk Users list.

When a user is on the list, the APA Default rule set can apply a higher-risk outcome and require a stronger authentication method on the next authentication event.

To configure the rule:

  1. Go to Rule Sets.
  2. Open the APA Default rule set you want to update, such as APA Default (Moderate).
  3. Edit the Active version.
  4. Add a new rule.
  5. Define the condition:
    • Filter: Select Lists.
    • Operator: Select Is.
    • Value: Select High Risk Users.
  6. Select the API response outcome:
    • Outcome: Select HIGH.
  7. Click Done.
  8. Move this rule above any existing rules with an API response outcome of MEDIUM or LOW.
  9. Click Save on the Active version of the rule set.
IMPORTANT:

Rules are evaluated in order. Place the High Risk Users rule above lower-risk rules so users on the list receive the HIGH outcome. Otherwise, a high-risk user might match a lower-risk rule first and receive a MEDIUM or LOW outcome instead.

Result: When a user is on the High Risk Users list, the next authentication event uses the HIGH outcome. The user is prompted to complete the step-up authentication method configured for that outcome in EAM.

Step 4: Create Monitors to Update the High Risk Users List

Create two monitors to keep the High Risk Users list aligned with Twosense risk changes.

  • The first monitor adds users to the list when Twosense sends a high-risk SET.
  • The second monitor removes users from the list when Twosense sends a SET indicating that the user’s risk level returned to low.

Create a monitor that detects when Twosense sends a high-risk SET.

In this example, Twosense detects that a user’s risk has changed to high and sends the following CAEP event to ITDR:

set.caep.risk-level-change.currentLevel = "high"

To configure the monitor:

  1. Go to Monitors.
  2. Click +.
  3. Name the monitor, such as Twosense: Add flagged users to High Risk Users list.
  4. Define the condition:
    • Filter: Select Event Type.
    • Operator: Select Is.
    • Event Type: Select SSF_SECURITY_EVENT.
    • Add an AND condition.
    • Filter: Select set.caep.risk-level-change.currentLevel.
    • Operator: Select Is.
    • Value: Select high.
  5. Add an action:
    • Action: Select Add to List.
    • List: Select High Risk Users.
    • List Items: Select Account ID or Email.
    • Expires: Select Never.
  6. Click Save.

Result: When Twosense sends a high-risk SET, ITDR automatically adds the user’s Account ID to the High Risk Users list. On the next authentication event, the APA rule set detects that the user is on the list and prompts the user to complete step-up authentication.

Create a second monitor that removes users from the High Risk Users list when Twosense sends a SET indicating that the user’s behavior has returned to normal and their risk level is low.

NOTE:

Successful step-up authentication does not trigger a low-risk SET from Twosense. Twosense sends a low-risk SET only when it determines that the user’s behavior has returned to normal.

In this example, ITDR receives the following low-risk CAEP event:

set.caep.risk-level-change.currentLevel = "low"

To configure the monitor:

  1. Go to Monitors.
  2. Click +.
  3. Name the monitor, such as Twosense: Remove low-risk users from High Risk Users list.
  4. Define the condition:
    • Filter: Select Event Type.
    • Operator: Select Is.
    • Event Type: Select SSF_SECURITY_EVENT.
    • AND
    • Filter: Select set.caep.risk-level-change.currentLevel.
    • Operator: Select Is.
    • Value: Select low.
  5. Add an action:
    • Action: Select Remove from List.
    • List: Select High Risk Users.
    • List Items: Select Account ID or Email.
  6. Click Save.

After the transmitter is configured, Twosense can send SETs to ITDR when supported security events occur.

Result: When Twosense sends a low-risk SET, ITDR automatically removes the user’s Account ID from the High Risk Users list. On the next authentication event, the user is no longer evaluated as high risk and returns to the standard authentication method associated with the lower-risk outcome.

Result: Adaptive Authentication Based on Twosense Security Event Tokens

With this configuration:

  • Twosense detects when a user’s risk changes.
  • Twosense sends the risk change to ITDR as a Security Event Token.
  • ITDR uses monitors to automatically add the user to, or remove the user from, the High Risk Users list based on Twosense risk-level changes.
  • The APA Default rule set checks whether the user is on the High Risk Users list.
  • When the user is on the list, the APA Default rule set applies the HIGH outcome and prompts the user for step-up authentication on the next authentication event.
  • If the user successfully completes step-up authentication, the user can continue but remains on the High Risk Users list until Twosense determines that the user’s behavior has returned to normal.
  • When Twosense sends a low-risk SET, ITDR removes the user from the High Risk Users list.
  • On future authentication events, the user returns to the standard authentication method associated with the lower-risk outcome.

Why This Matters

This configuration allows security teams to combine Twosense risk signals with ITDR detections in one centralized location. Teams can then use those signals to drive real-time adaptive authentication and automated response.