Skip to main content

Microsoft Graph Identity Protection

dropbox-icon.png

The Microsoft Graph Identity Protection App for Sumo Logic provides organizations with advanced security monitoring and analytics capabilities for their Microsoft Graph Identity Protection data. The app leverages Sumo Logic's cloud-to-cloud source to collect and analyze data from the Microsoft Graph Identity Protection Source, allowing organizations to proactively identify potential security risks and take action to mitigate them.

With the Microsoft Graph Identity Protection App, organizations can easily monitor and analyze events related to risky sign-ins, unusual user behavior, and security alerts generated by the Identity Protection API. The app provides a comprehensive view of these events, allowing security teams to quickly identify potential security incidents and take action to protect their organization.

Key features of the Microsoft Graph Identity Protection App include:

  • Real-time monitoring. The app provides real-time monitoring of events related to the Microsoft Graph Identity Protection Source, allowing you to quickly detect potential security incidents.
  • Advanced analytics. The app includes a wide range of pre-built dashboards, and visualizations, that enable organizations to analyze their Microsoft Graph Identity Protection data in real-time, and gain insights into user behavior, sign-in patterns, and .risky detections. The App displays the distribution of risks by level, state, processing status, type, activity, etc which allows you to categorize risks by various criteria and helps to identify critical and frequently occurring risks.
  • Investigation capabilities. The app provides advanced search and analytics capabilities that allow security teams to investigate security incidents, identify the root cause of security events, and take steps to improve their organization's overall security posture.

Log types​

The App uses Microsoft Graph Identity Protection Source to collect Risky Users and Risk Detections data from Microsoft Graph Identity Protection API.

To learn about the Microsoft Graph Identity Protection API fields, see the Risky Users and Risk Detections documentation.

Sample log messages​

This section contains log messages for both Risky Users and Risk detections sources.

Risky Users Log
{
"id": "a531defa-b587-4015-8837-748db116239a",
"isDeleted": false,
"isProcessing": false,
"riskLevel": "high",
"riskState": "atRisk",
"riskDetail": "none",
"riskLastUpdatedDateTime": "2022-07-08T20:07:11.9432076Z",
"userDisplayName": "hitarth",
"userPrincipalName": "hitarth@sumo.onmicrosoft.com"
}
Risk detections Log
{
"id": "127c7061f52a6f0302f08b166e5cb2281ca160cf58d4738569407b1231978490",
"requestId": "4495be88-4c61-4a8d-adc0-084db564e401",
"correlationId": "9671a08c-4ed4-4dd7-aef5-e106833ee501",
"riskEventType": "anonymizedIPAddress",
"riskState": "atRisk",
"riskLevel": "high",
"riskDetail": "none",
"source": "IdentityProtection",
"detectionTimingType": "realtime",
"activity": "signin",
"tokenIssuerType": "AzureAD",
"ipAddress": "167.86.94.107",
"activityDateTime": "2022-07-07T11:43:34.0566973Z",
"detectedDateTime": "2022-07-07T11:43:34.0566973Z",
"lastUpdatedDateTime": "2022-07-07T11:44:50.286276Z",
"userId": "a531defa-b587-40d5-8837-748db116339a",
"userDisplayName": "hitarth",
"userPrincipalName": "hitarth@sumo.onmicrosoft.com",
"additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (Android 9; Mobile; rv:78.0) Gecko/78.0 Firefox/78.0\"}]",
"location": {
"city": "Vadodara",
"state": "Gujarat",
"countryOrRegion": "IN",
"geoCoordinates": {
"latitude": 48.1089,
"longitude": 11.6074
}
}
}

Sample queries​

This section contains the sample queries of both the Risky Users and Risk detections.

Risky Users by Status
_sourceCategory=msgip-app-src !riskEventType
| json "id", "userPrincipalName", "isDeleted", "isProcessing", "riskLevel", "riskState", "riskDetail", "riskLastUpdatedDateTime" as user_id, user, is_deleted, is_processing, risk_level, risk_state, risk_action, risk_last_updated_date_time nodrop
| topk(1, risk_last_updated_date_time) by user_id

| "{{user_status}}" as user_status_filter
| if(user_status_filter matches "active", "false", user_status_filter) as user_status_filter
| if(user_status_filter matches "deleted", "true", user_status_filter) as user_status_filter
| where is_deleted matches user_status_filter
| "{{processing_state}}" as processing_state_filter
| if(processing_state_filter matches "processing", "true", processing_state_filter) as processing_state_filter
| if(processing_state_filter matches "not processing", "false", processing_state_filter) as processing_state_filter
| where is_processing matches processing_state_filter
| where risk_level matches "{{risk_level}}"
| where risk_state matches "{{risk_state}}"
| where risk_action matches "{{risk_action}}"

| if(is_deleted matches "true", "deleted", "active") as user_status
| count(user_id) by user_status
| sort by _count
Risk by Level
_sourceCategory=msgip-app-src riskEventType
| json "activity", "activityDateTime", "detectedDateTime", "detectionTimingType", "id", "ipAddress", "lastUpdatedDateTime", "location", "location.geoCoordinates.latitude", "location.geoCoordinates.longitude", "riskDetail", "riskEventType", "riskLevel", "riskState", "source", "tokenIssuerType", "userPrincipalName", "userId" as activity, activity_date_time, detected_date_time, detection_timing_type, risk_id, ip_address, last_updated_date_time, location, latitude, longitude, risk_action, risk_event_type, risk_level, risk_state, source, token_issuer_type, user, user_id nodrop
| concat(location.city, ", ", location.state, ", ", location.countryOrRegion) as location
| topk(1, last_updated_date_time) by risk_id

| where activity matches "{{activity}}"
| where risk_event_type matches "{{risk_event_type}}"
| where risk_level matches "{{risk_level}}"
| where risk_state matches "{{risk_state}}"
| where risk_action matches "{{risk_action}}"
| where location matches "{{location}}"

| count(risk_id) by risk_level
| sort by _count

Collecting Logs for Microsoft Graph Identity Protection API​

This section explains how to collect logs from Microsoft Graph Identity Protection API and ingest them into Sumo Logic. For details, see Cloud-to-Cloud-Integration for Microsoft Graph Identity Protection Source to create the source and use the same source category while installing the app.

Installing the Microsoft Graph Identity Protection App​

To install the app:

  1. From the Sumo Logic navigation, select App Catalog.
  2. In the Search Apps field, search for and then select your app.
  3. Optionally, you can scroll down to preview the dashboards included with the app. Then, click Install App (sometimes this button says Add Integration).
    note

    If your app has multiple versions, you'll need to select the version of the service you're using before installation.

  4. On the next configuration page, under Select Data Source for your App, complete the following fields:
    • Data Source. Select one of the following options:
      • Choose Source Category and select a source category from the list; or
      • Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. For example, _sourceCategory=MyCategory.
    • Folder Name. You can retain the existing name or enter a custom name of your choice for the app.
    • All Folders (optional). Default location is the Personal folder in your Library. If desired, you can choose a different location and/or click New Folder to add it to a new folder.
  5. Click Next.
  6. Look for the dialog confirming that your app was installed successfully.
    app-success.png

Once an app is installed, it will appear in your Personal folder or the folder that you specified. From here, you can share it with other users in your organization. Dashboard panels will automatically start to fill with data matching the time range query received since you created the panel. Results won't be available immediately, but within about 20 minutes, you'll see completed graphs and maps.

Viewing Microsoft Graph Identity Protection Dashboards​

  • All dashboards have a set of filters that you can apply to the entire dashboard, as shown in the following example. Click the funnel icon in the top dashboard menu bar to display a scrollable list of filters that are applied across the entire dashboard.
  • You can use filters to drill down and examine the data on a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
  • Each panel has a set of filters that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.

Risk Detections​

Microsoft Graph Identity Protection - Risk Detections.

This dashboard provides insights into the risks detected in the organization. It displays the geo-location of risks, and the distribution of risks by state, type, level, activity, and token issuer type. It also shows the latency chart which helps to identify the delay between risk occurrence and detection time. It displays the table with information about the frequency of risks by type with a one-day comparison, a summary of all the risks, and a list of various actions performed to mitigate the risks with their frequency.

Microsoft Graph Identity Protection Risk Detections

Risky Users​

Microsoft Graph Identity Protection - Risky Users.

This dashboard helps to monitor and manage the risky users of your organization. It visualizes the distribution of risky users by status, level, state, and processing state. It also provides a list of various actions performed to mitigate the risks with their frequency. It displays the table of summary of all the risky users.

Microsoft Graph Identity Protection Risky Users
Status
Legal
Privacy Statement
Terms of Use

Copyright Β© 2024 by Sumo Logic, Inc.