Start with a useful clue
A sign-in gives an investigation a starting point: an identity, a time, an application, and the context of access. It is one view of an event. The question that follows is what the identity did with that access.
Connect the next action
A mailbox change means more when it sits beside the session that preceded it. File access, a new app permission, or an authentication change can add another piece to the sequence. Reviewing those records together helps a team form a better question.
Keep the conclusion grounded
An unusual action is not automatically an attack. Compare the sequence with the available context and record what is known, what is inferred, and what still needs investigation. The aim is a supported explanation, not a verdict based on one field.
The Sentry perspective
Sentry brings identity and workload evidence into the same investigation. Location stays part of the picture; the actions that follow help explain it.