--- title: Effective Identity Threat Response with Teleport | daily.dev description: A practical guide to responding to identity compromise using Teleport's built-in features. Covers locking compromised users, roles, devices, MFA devices,... canonical: https://daily.dev/posts/effective-identity-threat-response-with-teleport-sbd0w8yzm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Effective Identity Threat Response with Teleport | daily.dev og:description: A practical guide to responding to identity compromise using Teleport's built-in features. Covers locking compromised users, roles, devices, MFA devices,... og:url: https://daily.dev/posts/effective-identity-threat-response-with-teleport-sbd0w8yzm og:image: https://api.daily.dev/og/posts/sbD0W8YZM.png og:image:alt: Effective Identity Threat Response with Teleport og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Effective Identity Threat Response with Teleport **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary A practical guide to responding to identity compromise using Teleport's built-in features. Covers locking compromised users, roles, devices, MFA devices, servers, and Windows desktops via tctl commands, plus Access Monitoring SQL-style queries to trace lateral movement, abused access requests, rogue join tokens, unauthorized user or access list changes, and attacker-executed commands. Emphasizes knowing your cluster configuration to craft effective detection queries and recommends reviewing Access Monitoring and audit event export documentation for deeper investigation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I lock a compromised user account in Teleport using tctl? Use the tctl lock command with the --user flag, specifying the account and a time-to-live for the lock. For example, tctl lock --user=rogue@victim.com --message="Rogue activity." --ttl=10h creates a lock that rejects new API requests and terminates active SSH, database, desktop, and Kubernetes sessions for that identity. _Teams building identity incident response playbooks can find practical Teleport workflows like this via daily.dev._ ### How can I detect if an attacker created a join token to escalate privileges in Teleport? Query the join_token_create table filtering by the compromised user to see which roles were requested for the token. Once identified, revoke the token immediately with tctl tokens rm , since a rogue join token could let an attacker obtain a built-in agent role within the cluster. _daily.dev helps security engineers track detection techniques like Teleport join-token abuse._ ### How do I track lateral movement by a compromised identity in Teleport? Run Access Monitoring SQL queries against Teleport's event tables using the compromised identity as a filter, checking access_request_create/review for abused approvals, user_create for new accounts, cert_create for identity file generation, and session_start/exec for accessed resources and executed commands. _Incident responders mapping attacker movement across systems can surface techniques like this on daily.dev._ ## Similar posts on daily.dev - [Teleport Launches Agentic Identity Framework to Secure AI Agents Across Enterprise Infrastructure](https://daily.dev/posts/teleport-launches-agentic-identity-framework-to-secure-ai-agents-across-enterprise-infrastructure-vosijavmu) · InfoQ · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/effective-identity-threat-response-with-teleport-sbd0w8yzm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Effective Identity Threat Response with Teleport","url":"https://daily.dev/posts/effective-identity-threat-response-with-teleport-sbd0w8yzm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/effective-identity-threat-response-with-teleport-sbd0w8yzm"},"datePublished":"2026-08-23T12:22:57.043Z","dateModified":"2026-08-23T12:53:32.776Z","description":"A practical guide to responding to identity compromise using Teleport's built-in features. Covers locking compromised users, roles, devices, MFA devices,...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/effective-identity-threat-response-with-teleport-sbd0w8yzm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Effective Identity Threat Response with Teleport"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/effective-identity-threat-response-with-teleport-sbd0w8yzm#faq","mainEntity":[{"@type":"Question","name":"How do I lock a compromised user account in Teleport using tctl?","acceptedAnswer":{"@type":"Answer","text":"Use the tctl lock command with the --user flag, specifying the account and a time-to-live for the lock. For example, tctl lock --user=rogue@victim.com --message=\"Rogue activity.\" --ttl=10h creates a lock that rejects new API requests and terminates active SSH, database, desktop, and Kubernetes sessions for that identity. Teams building identity incident response playbooks can find practical Teleport workflows like this via daily.dev."}},{"@type":"Question","name":"How can I detect if an attacker created a join token to escalate privileges in Teleport?","acceptedAnswer":{"@type":"Answer","text":"Query the join_token_create table filtering by the compromised user to see which roles were requested for the token. Once identified, revoke the token immediately with tctl tokens rm , since a rogue join token could let an attacker obtain a built-in agent role within the cluster. daily.dev helps security engineers track detection techniques like Teleport join-token abuse."}},{"@type":"Question","name":"How do I track lateral movement by a compromised identity in Teleport?","acceptedAnswer":{"@type":"Answer","text":"Run Access Monitoring SQL queries against Teleport's event tables using the compromised identity as a filter, checking access_request_create/review for abused approvals, user_create for new accounts, cert_create for identity file generation, and session_start/exec for accessed resources and executed commands. Incident responders mapping attacker movement across systems can surface techniques like this on daily.dev."}}]} ```