Conditional Access policies logs from Azure

[ljohnson4 (ljohnson)]

I have an event hub streaming all sorts of data, and while I do see CA policy results, searching the logs and grouping is not possible because when I do a log search using SSO as the source, the CA policies are stored in an array, my policy changes from source_json.properties.appliedConditionalAccessPolicies.20.displayName to source_json.properties.appliedConditionalAccessPolicies.22.displayName etc - that number changes between log entries. Any sense of how I can use Insight IDR to track this? In chatting with AI, they suggest using Azure Log Analytics as it can unpack arrays. What do you all do?

[sam_ozinga]

Maybe using the HAS operator will work? Similar to how it is used in this blog post?

Building an Effective Exception Rule for Attacker Technique - Inbox Forwarding Rule Created

How to Build an Exception Rule for Inbox Forwarding Rule Created - Ignore Internal Domain An Alert based on users creating an Inbox Forwarding Rule is often times a benign false positive as it is an activity performed by some users on a semi-regular basis throughout their regular duties. [Screenshot 2024-08-01 at 1.06.18 PM] This detection identifies the creation of new inbox rules that will forward emails upon receipt to another email address. This technique is used by malicious actors to c…

[ljohnson4 (ljohnson)]

I haven’t done it yet, but I think this is exactly what I need - thank you! I will report back when I have this up and running. Thanks!