Microsoft Graph Identity Protection

The Microsoft Graph Identity Protection App for Sumo Logic provides organizations with advanced security monitoring and analytics capabilities for their Microsoft Graph Identity Protection data. The app leverages Sumo Logic's cloud-to-cloud source to collect and analyze data from the Microsoft Graph Identity Protection Source, allowing organizations to proactively identify potential security risks and take action to mitigate them.

With the Microsoft Graph Identity Protection App, organizations can easily monitor and analyze events related to risky sign-ins, unusual user behavior, and security alerts generated by the Identity Protection API. The app provides a comprehensive view of these events, allowing security teams to quickly identify potential security incidents and take action to protect their organization.

Key features of the Microsoft Graph Identity Protection App include:

• Real-time monitoring. The app provides real-time monitoring of events related to the Microsoft Graph Identity Protection Source, allowing you to quickly detect potential security incidents.
• Advanced analytics. The app includes a wide range of pre-built dashboards, and visualizations, that enable organizations to analyze their Microsoft Graph Identity Protection data in real-time, and gain insights into user behavior, sign-in patterns, and .risky detections. The App displays the distribution of risks by level, state, processing status, type, activity, etc which allows you to categorize risks by various criteria and helps to identify critical and frequently occurring risks.
• Investigation capabilities. The app provides advanced search and analytics capabilities that allow security teams to investigate security incidents, identify the root cause of security events, and take steps to improve their organization's overall security posture.

Log types

The App uses Microsoft Graph Identity Protection Source to collect Risky Users and Risk Detections data from Microsoft Graph Identity Protection API.

To learn about the Microsoft Graph Identity Protection API fields, see the Risky Users and Risk Detections documentation.

Sample log messages

This section contains log messages for both Risky Users and Risk detections sources.

Risky Users Log

{
   "id": "a531defa-b587-4015-8837-748db116239a",
   "isDeleted": false,
   "isProcessing": false,
   "riskLevel": "high",
   "riskState": "atRisk",
   "riskDetail": "none",
   "riskLastUpdatedDateTime": "2022-07-08T20:07:11.9432076Z",
   "userDisplayName": "hitarth",
   "userPrincipalName": "hitarth@sumo.onmicrosoft.com"
}

Risk detections Log

{
  "id": "127c7061f52a6f0302f08b166e5cb2281ca160cf58d4738569407b1231978490",
  "requestId": "4495be88-4c61-4a8d-adc0-084db564e401",
  "correlationId": "9671a08c-4ed4-4dd7-aef5-e106833ee501",
  "riskEventType": "anonymizedIPAddress",
  "riskState": "atRisk",
  "riskLevel": "high",
  "riskDetail": "none",
  "source": "IdentityProtection",
  "detectionTimingType": "realtime",
  "activity": "signin",
  "tokenIssuerType": "AzureAD",
  "ipAddress": "167.86.94.107",
  "activityDateTime": "2022-07-07T11:43:34.0566973Z",
  "detectedDateTime": "2022-07-07T11:43:34.0566973Z",
  "lastUpdatedDateTime": "2022-07-07T11:44:50.286276Z",
  "userId": "a531defa-b587-40d5-8837-748db116339a",
  "userDisplayName": "hitarth",
  "userPrincipalName": "hitarth@sumo.onmicrosoft.com",
  "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (Android 9; Mobile; rv:78.0) Gecko/78.0 Firefox/78.0\"}]",
  "location": {
    "city": "Vadodara",
    "state": "Gujarat",
    "countryOrRegion": "IN",
    "geoCoordinates": {
      "latitude": 48.1089,
      "longitude": 11.6074
    }
  }
}

Sample queries

This section contains the sample queries of both the Risky Users and Risk detections.

Risky Users by Status

_sourceCategory=msgip-app-src !riskEventType
| json "id", "userPrincipalName", "isDeleted", "isProcessing", "riskLevel", "riskState", "riskDetail", "riskLastUpdatedDateTime" as user_id, user, is_deleted, is_processing, risk_level, risk_state, risk_action, risk_last_updated_date_time nodrop
| topk(1, risk_last_updated_date_time) by user_id

| "{{user_status}}" as user_status_filter
| if(user_status_filter matches "active", "false", user_status_filter) as user_status_filter
| if(user_status_filter matches "deleted", "true", user_status_filter) as user_status_filter
| where is_deleted matches user_status_filter
| "{{processing_state}}" as processing_state_filter
| if(processing_state_filter matches "processing", "true", processing_state_filter) as processing_state_filter
| if(processing_state_filter matches "not processing", "false", processing_state_filter) as processing_state_filter
| where is_processing matches processing_state_filter
| where risk_level matches "{{risk_level}}"
| where risk_state matches "{{risk_state}}"
| where risk_action matches "{{risk_action}}"

| if(is_deleted matches "true", "deleted", "active") as user_status
| count(user_id) by user_status
| sort by _count

Risk by Level

_sourceCategory=msgip-app-src riskEventType
| json "activity", "activityDateTime", "detectedDateTime", "detectionTimingType", "id", "ipAddress", "lastUpdatedDateTime", "location", "location.geoCoordinates.latitude", "location.geoCoordinates.longitude", "riskDetail", "riskEventType", "riskLevel", "riskState", "source", "tokenIssuerType", "userPrincipalName", "userId" as activity, activity_date_time, detected_date_time, detection_timing_type, risk_id, ip_address, last_updated_date_time, location, latitude, longitude, risk_action, risk_event_type, risk_level, risk_state, source, token_issuer_type, user, user_id nodrop
| concat(location.city, ", ", location.state, ", ", location.countryOrRegion) as location
| topk(1, last_updated_date_time) by risk_id

| where activity matches "{{activity}}"
| where risk_event_type matches "{{risk_event_type}}"
| where risk_level matches "{{risk_level}}"
| where risk_state matches "{{risk_state}}"
| where risk_action matches "{{risk_action}}"
| where location matches "{{location}}"

| count(risk_id) by risk_level
| sort by _count

Collecting Logs for Microsoft Graph Identity Protection API

This section explains how to collect logs from Microsoft Graph Identity Protection API and ingest them into Sumo Logic. For details, see Cloud-to-Cloud-Integration for Microsoft Graph Identity Protection Source to create the source and use the same source category while installing the app.

Installing the Microsoft Graph Identity Protection App

To install the app, do the following:

1. From the Sumo Logic navigation, select App Catalog.
2. In the Search Apps field, search for and then select your app.
   Optionally, you can scroll down to preview the dashboards included with the app.
3. To install the app, click Install App.
4. Click Next in the Setup Data section.
5. In the Configure section of the respective app, complete the following fields.
   1. Key. Select either of these options for the data source.
      • Choose Source Category, and select a source category from the list for Default Value.
      • Choose Custom, and enter a custom metadata field. Insert its value in Default Value.
6. Click Next. You will be redirected to the Preview & Done section.

Your app will be installed in the Installed Apps folder and dashboard panels will start to fill automatically.

Each panel slowly fills with data matching the time range query and received since the panel was created. Results will not immediately be available, updating with full graphs and charts over time.

Viewing Microsoft Graph Identity Protection dashboards

All dashboards have a set of filters that you can apply to the entire dashboard. Use these filters to drill down and examine the data to a granular level.

• You can change the time range for a dashboard or panel by selecting a predefined interval from a drop-down list, choosing a recently used time range, or specifying custom dates and times. Learn more.
• You can use template variables to drill down and examine the data on a granular level. For more information, see Filter with template variables.
• Most Next-Gen apps allow you to provide the scope at the installation time and are comprised of a key (_sourceCategory by default) and a default value for this key. Based on your input, the app dashboards will be parameterized with a dashboard variable, allowing you to change the dataset queried by all panels. This eliminates the need to create multiple copies of the same dashboard with different queries.

Risk Detections

Microsoft Graph Identity Protection - Risk Detections.

This dashboard provides insights into the risks detected in the organization. It displays the geo-location of risks, and the distribution of risks by state, type, level, activity, and token issuer type. It also shows the latency chart which helps to identify the delay between risk occurrence and detection time. It displays the table with information about the frequency of risks by type with a one-day comparison, a summary of all the risks, and a list of various actions performed to mitigate the risks with their frequency.

Risky Users

Microsoft Graph Identity Protection - Risky Users.

This dashboard helps to monitor and manage the risky users of your organization. It visualizes the distribution of risky users by status, level, state, and processing state. It also provides a list of various actions performed to mitigate the risks with their frequency. It displays the table of summary of all the risky users.