KQL Search

Query Details

MDA Threat detection policy with Enriched Information

MDA Threat Detection Policy With Enriched Information Workload Identity Info

Query

SecurityAlert
| where ProductName == "Microsoft Cloud App Security" or ProductComponentName == "Anubis"
| mv-expand parse_json(Entities) | where Entities.Type == "oauth-application"
| extend AppId = tostring(Entities.OAuthAppId)
| extend IpAddress = parse_json(ExtendedProperties).["IP Addresses"]
| extend RedirectUris = parse_json(tostring(Entities.RedirectURLs))
| extend AlertDisplayName = tostring(DisplayName)
| extend CommunityUse = tostring(Entities.CommunityUse)
| extend Publisher = tostring(Entities.PublisherName)
| join kind=inner (
    PrivilegedWorkloadIdentityInfo
    | project
        WorkloadIdentityName,
        WorkloadIdentityType,
        IsFirstPartyApp,
        AppId = tostring(ApplicationId),
        tostring(ServicePrincipalObjectId),
        EnterpriseAccessModelTiering,
        EntraIdRoles,
        AppRolePermissions
    )
    on AppId
| join kind=inner (
    SecurityIncident
    | mv-expand AlertIds
    | extend SystemAlertId = tostring(AlertIds)
    | summarize arg_max(TimeGenerated, *) by SystemAlertId
    | project
        SystemAlertId,
        IncidentUrl = AdditionalData.providerIncidentUrl,
        IncidentStatus = Status,
        IncidentName = IncidentNumber
    )
    on SystemAlertId

Explanation

This query is used to create an incident from a threat detection policy. It looks for events related to Microsoft Cloud App Security or Anubis and filters them based on certain conditions. It then joins the filtered events with other data sources to gather additional information. The query also includes incident configuration settings and mappings for different entities. The incident is created with a medium severity level and the query is scheduled to run every hour.