KQL Search

This query is part of a scheduled task designed to monitor Azure Active Directory provisioning jobs. Here's a simple breakdown of what it does:

1. Purpose: The query checks for provisioning jobs that were previously active (producing at least 100 events per hour over the past 7 days) but have suddenly stopped producing any events in the last 2 hours. This sudden silence could indicate potential issues such as credential theft, sabotage, or a broken connector.

2. Data Source: It uses data from Azure Active Directory provisioning logs.

3. Process:

   • Baseline Calculation: It calculates the average number of events per hour for each job over the past 7 days.
   • Recent Activity Check: It checks for any events in the last 2 hours.
   • Comparison: It identifies jobs that had a high baseline activity but have zero events in the recent 2-hour window.

4. Alert Generation: If a job meets the criteria (high baseline but no recent events), it generates an alert. The alert includes details like the job ID, service principal name, baseline activity rate, and a reason for the alert.

5. Severity and Tactics: The alert is marked with a medium severity and is associated with tactics like Defense Evasion and Impact, referencing specific MITRE ATT&CK techniques.

6. Incident Management: The query is configured to create incidents for these alerts, with options for grouping related alerts into a single incident.

In summary, this query helps detect potential issues in Azure AD provisioning jobs by identifying when a job that was previously busy suddenly stops, which could indicate a problem that needs attention.