Elastic medium stable kql

Entra ID High Risk User Sign-in Heuristic

Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics.

View Source

Detection Logic

data_stream.dataset:azure.signinlogs and
  azure.signinlogs.properties.risk_state:("confirmedCompromised" or "atRisk") and event.outcome:(success or Success)

Field Validations

Loading…

Comments (0)

Loading comments...