Closed
Description
"Azure Active Directory High Risk Sign-in"
We noticed it's important to also alert on failed outcomes. Customers who don't want failed outcomes can exclude with an exception.
Link to rule
https://www.elastic.co/guide/en/security/current/azure-active-directory-high-risk-sign-in.html
Description
Current query:
event.dataset:azure.signinlogs and
(azure.signinlogs.properties.risk_level_during_signin:high or azure.signinlogs.properties.risk_level_aggregated:high) and
event.outcome:(success or Success)
Change to:
event.dataset:azure.signinlogs and
(azure.signinlogs.properties.risk_level_during_signin:high or azure.signinlogs.properties.risk_level_aggregated:high)