MDA Threat detection policy with Enriched Information

MDA Threat Detection Policy With Enriched Information Workload Identity Info

Query

SecurityAlert
| where ProductName == "Microsoft Cloud App Security" or ProductComponentName == "Anubis"
| mv-expand parse_json(Entities) | where Entities.Type == "oauth-application"
| extend AppId = tostring(Entities.OAuthAppId)
| extend IpAddress = parse_json(ExtendedProperties).["IP Addresses"]
| extend RedirectUris = parse_json(tostring(Entities.RedirectURLs))
| extend AlertDisplayName = tostring(DisplayName)
| extend CommunityUse = tostring(Entities.CommunityUse)
| extend Publisher = tostring(Entities.PublisherName)
| join kind=inner (
    PrivilegedWorkloadIdentityInfo
    | project
        WorkloadIdentityName,
        WorkloadIdentityType,
        IsFirstPartyApp,
        AppId = tostring(ApplicationId),
        tostring(ServicePrincipalObjectId),
        EnterpriseAccessModelTiering,
        EntraIdRoles,
        AppRolePermissions
    )
    on AppId
| join kind=inner (
    SecurityIncident
    | mv-expand AlertIds
    | extend SystemAlertId = tostring(AlertIds)
    | summarize arg_max(TimeGenerated, *) by SystemAlertId
    | project
        SystemAlertId,
        IncidentUrl = AdditionalData.providerIncidentUrl,
        IncidentStatus = Status,
        IncidentName = IncidentNumber
    )
    on SystemAlertId

Explanation

This query is used to create an incident from a threat detection policy. It looks for events related to Microsoft Cloud App Security or Anubis and filters them based on certain conditions. It then joins the filtered events with other data sources to gather additional information. The query also includes incident configuration settings and mappings for different entities. The incident is created with a medium severity level and the query is scheduled to run every hour.

Details

Thomas Naunheim

Released: November 20, 2023

Tables

SecurityAlert PrivilegedWorkloadIdentityInfo SecurityIncident

Keywords

DevicesIntuneUserCloud ApplicationMDA Threat detection policyEnriched InformationSecurityAlertProductNameProductComponentNameEntitiesTypeoauth-applicationAppIdIpAddressExtendedPropertiesRedirectUrisDisplayNameCommunityUsePublisherPrivilegedWorkloadIdentityInfoWorkloadIdentityNameWorkloadIdentityTypeIsFirstPartyAppApplicationIdServicePrincipalObjectIdEnterpriseAccessModelTieringEntraIdRolesAppRolePermissionsSecurityIncidentAlertIdsSystemAlertIdTimeGeneratedAdditionalData.providerIncidentUrlStatusIncidentNumbersuppressionEnabledcreateIncidentgroupingConfigurationenabledreopenClosedIncidentlookbackDurationmatchingMethodAllEntitiesgroupByEntitiesgroupByAlertDetailsgroupByCustomDetailseventGroupingSettingsaggregationKindAlertPerResultalertDisplayNameFormatalertDescriptionFormatalertTacticsColumnNamealertSeverityColumnNamealertDynamicPropertiesAlertLinkTechniquesProviderNameRemediationStepsConfidenceLevelConfidenceScoreExtendedLinkscustomDetailsentityMappingsCloudApplicationIPURLAddresssuppressionDuration.

Operators

whereormv-expandparse_jsonextendtostringjoinkind=innerprojectsummarizearg_maxbyonsuppressionEnabledcreateIncidentenabledreopenClosedIncidentlookbackDurationmatchingMethodgroupByEntitiesgroupByAlertDetailsgroupByCustomDetailsaggregationKindalertDisplayNameFormatalertDescriptionFormatalertTacticsColumnNamealertSeverityColumnNamealertDynamicPropertiescustomDetailsentityMappings

Severity

Medium

Frequency: 1h

Period: 1h

Actions

GitHub

KQL Search