Elastic high stable kql

Entra ID High Risk Sign-in

Identifies high risk Microsoft Entra ID sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised.

View Source

Detection Logic

data_stream.dataset:azure.signinlogs and
  (
    azure.signinlogs.properties.risk_level_during_signin:high or
    azure.signinlogs.properties.risk_level_aggregated:high
  ) and
  not (event.outcome:failure and azure.signinlogs.properties.risk_level_aggregated:none and azure.signinlogs.properties.risk_state:none) and
  not azure.signinlogs.properties.risk_state:(remediated or dismissed or confirmedSafe)

Field Validations

Loading…

Comments (0)

Loading comments...