Graph Tables

This query script is designed to analyze security-related data over two different time frames (7 days and 30 days) and create a graph-based representation of identity attacks and security incidents. Here's a simplified breakdown of what each part of the script does:

Identity Attack Graph (7 days)

1. ia_edge_signsinfrom: Collects sign-in data from two tables (SigninLogs and AADNonInteractiveUserSignInLogs) for the past 7 days. It summarizes the number of sign-ins, failures, and successes for each user and IP address, along with the first and last time they were seen and their location.

2. ia_edge_usesapp: Similar to the above, but focuses on the applications used during sign-ins. It summarizes sign-in attempts, failures, and the last time an app was used by each user.

3. ia_node_app: Extracts a distinct list of applications used in sign-ins.

4. ia_edge_attacked: Analyzes brute force attack data to identify users targeted in the past 7 days, summarizing attack patterns, severity, and whether the user was compromised.

5. ia_node_ipaddress: Combines data from sign-ins and attacks to create a list of IP addresses, summarizing user activity, attack attempts, and geographical information.

6. ia_node_country: Extracts a distinct list of countries from the IP address data.

7. ia_edge_locatedin: Maps IP addresses to their respective countries.

8. ia_node_user: Compiles user information from sign-in data, including the number of sign-ins, failures, distinct IPs used, and user identity details like display name and job title.

Incident Entity Graph (30 days)

1. ie_node_incident: Gathers security incident data from the past 30 days, summarizing details like incident number, title, severity, status, and associated risk scores.

2. ie_node_alert: Collects alert data from the past 30 days, summarizing alert details like name, severity, tactics, and product name.

3. ie_edge_hasalert: Links incidents to their associated alerts.

4. ie_stage_entities: Extracts and categorizes entities involved in alerts, such as users, hosts, and IP addresses.

5. ie_edge_involvesuser: Maps alerts to involved users.

6. ie_edge_involveshost: Maps alerts to involved hosts.

7. ie_edge_involvesip: Maps alerts to involved IP addresses.

8. ie_node_user: Summarizes the number of alerts associated with each user.

9. ie_node_host: Summarizes the number of alerts associated with each host.

10. ie_node_ipaddress: Summarizes the number of alerts associated with each IP address, combining it with identity attack data to determine if the IP is linked to an attacker.

Overall, this script is used to build a comprehensive view of identity attacks and security incidents, helping to identify patterns, compromised users, and potential threats based on sign-in and security alert data.