Elastic high stable eql

Entra ID Protection Alerts for User Detected

Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account.

View Source

Detection Logic

sequence by azure.identityprotection.properties.user_principal_name with maxspan=10m
[any where event.module == "azure" and data_stream.dataset == "azure.identity_protection"] with runs=2

Field Validations

Loading…

Comments (0)

Loading comments...