Microsoft Graph Identity Protection

The Microsoft Graph Identity Protection App for Sumo Logic provides organizations with advanced security monitoring and analytics capabilities for their Microsoft Graph Identity Protection data. The app leverages Sumo Logic's cloud-to-cloud source to collect and analyze data from the Microsoft Graph Identity Protection Source, allowing organizations to proactively identify potential security risks and take action to mitigate them.

With the Microsoft Graph Identity Protection App, organizations can easily monitor and analyze events related to risky sign-ins, unusual user behavior, and security alerts generated by the Identity Protection API. The app provides a comprehensive view of these events, allowing security teams to quickly identify potential security incidents and take action to protect their organization.

Key features of the Microsoft Graph Identity Protection App include:

• Real-time monitoring. The app provides real-time monitoring of events related to the Microsoft Graph Identity Protection Source, allowing you to quickly detect potential security incidents.
• Advanced analytics. The app includes a wide range of pre-built dashboards, and visualizations, that enable organizations to analyze their Microsoft Graph Identity Protection data in real-time, and gain insights into user behavior, sign-in patterns, and .risky detections. The App displays the distribution of risks by level, state, processing status, type, activity, etc which allows you to categorize risks by various criteria and helps to identify critical and frequently occurring risks.
• Investigation capabilities. The app provides advanced search and analytics capabilities that allow security teams to investigate security incidents, identify the root cause of security events, and take steps to improve their organization's overall security posture.

Log types

The App uses Microsoft Graph Identity Protection Source to collect Risky Users and Risk Detections data from Microsoft Graph Identity Protection API.

To learn about the Microsoft Graph Identity Protection API fields, see the Risky Users and Risk Detections documentation.

Sample Log Messages

This section contains log messages for both Risky Users and Risk detections sources.

Risky Users Log

{
   "id": "a531defa-b587-4015-8837-748db116239a",
   "isDeleted": false,
   "isProcessing": false,
   "riskLevel": "high",
   "riskState": "atRisk",
   "riskDetail": "none",
   "riskLastUpdatedDateTime": "2022-07-08T20:07:11.9432076Z",
   "userDisplayName": "hitarth",
   "userPrincipalName": "hitarth@sumo.onmicrosoft.com"
}

Risk detections Log

{
  "id": "127c7061f52a6f0302f08b166e5cb2281ca160cf58d4738569407b1231978490",
  "requestId": "4495be88-4c61-4a8d-adc0-084db564e401",
  "correlationId": "9671a08c-4ed4-4dd7-aef5-e106833ee501",
  "riskEventType": "anonymizedIPAddress",
  "riskState": "atRisk",
  "riskLevel": "high",
  "riskDetail": "none",
  "source": "IdentityProtection",
  "detectionTimingType": "realtime",
  "activity": "signin",
  "tokenIssuerType": "AzureAD",
  "ipAddress": "167.86.94.107",
  "activityDateTime": "2022-07-07T11:43:34.0566973Z",
  "detectedDateTime": "2022-07-07T11:43:34.0566973Z",
  "lastUpdatedDateTime": "2022-07-07T11:44:50.286276Z",
  "userId": "a531defa-b587-40d5-8837-748db116339a",
  "userDisplayName": "hitarth",
  "userPrincipalName": "hitarth@sumo.onmicrosoft.com",
  "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (Android 9; Mobile; rv:78.0) Gecko/78.0 Firefox/78.0\"}]",
  "location": {
    "city": "Vadodara",
    "state": "Gujarat",
    "countryOrRegion": "IN",
    "geoCoordinates": {
      "latitude": 48.1089,
      "longitude": 11.6074
    }
  }
}

Sample Queries

This section contains the sample queries of both the Risky Users and Risk detections.

Risky Users by Status

_sourceCategory=msgip-app-src !riskEventType
| json "id", "userPrincipalName", "isDeleted", "isProcessing", "riskLevel", "riskState", "riskDetail", "riskLastUpdatedDateTime" as user_id, user, is_deleted, is_processing, risk_level, risk_state, risk_action, risk_last_updated_date_time nodrop
| topk(1, risk_last_updated_date_time) by user_id

| "{{user_status}}" as user_status_filter
| if(user_status_filter matches "active", "false", user_status_filter) as user_status_filter
| if(user_status_filter matches "deleted", "true", user_status_filter) as user_status_filter
| where is_deleted matches user_status_filter
| "{{processing_state}}" as processing_state_filter
| if(processing_state_filter matches "processing", "true", processing_state_filter) as processing_state_filter
| if(processing_state_filter matches "not processing", "false", processing_state_filter) as processing_state_filter
| where is_processing matches processing_state_filter
| where risk_level matches "{{risk_level}}"
| where risk_state matches "{{risk_state}}"
| where risk_action matches "{{risk_action}}"

| if(is_deleted matches "true", "deleted", "active") as user_status
| count(user_id) by user_status
| sort by _count

Risk by Level

_sourceCategory=msgip-app-src riskEventType
| json "activity", "activityDateTime", "detectedDateTime", "detectionTimingType", "id", "ipAddress", "lastUpdatedDateTime", "location", "location.geoCoordinates.latitude", "location.geoCoordinates.longitude", "riskDetail", "riskEventType", "riskLevel", "riskState", "source", "tokenIssuerType", "userPrincipalName", "userId" as activity, activity_date_time, detected_date_time, detection_timing_type, risk_id, ip_address, last_updated_date_time, location, latitude, longitude, risk_action, risk_event_type, risk_level, risk_state, source, token_issuer_type, user, user_id nodrop
| concat(location.city, ", ", location.state, ", ", location.countryOrRegion) as location
| topk(1, last_updated_date_time) by risk_id

| where activity matches "{{activity}}"
| where risk_event_type matches "{{risk_event_type}}"
| where risk_level matches "{{risk_level}}"
| where risk_state matches "{{risk_state}}"
| where risk_action matches "{{risk_action}}"
| where location matches "{{location}}"

| count(risk_id) by risk_level
| sort by _count

Collecting Logs for Microsoft Graph Identity Protection API

This section explains how to collect logs from Microsoft Graph Identity Protection API and ingest them into Sumo Logic. For details, see Cloud-to-Cloud-Integration for Microsoft Graph Identity Protection Source to create the source and use the same source category while installing the app.

Installing the Microsoft Graph Identity Protection App

Locate and install the app from the App Catalog. If you want to see a preview of the dashboards included with the app before installing, click Preview Dashboards.

To install the app, follow the steps below:

1. From the App Catalog, search for the app and select it.
2. Select the version of the service you're using and click Add to Library. Version selection is available only for limited number of apps. For details, see the Install the Apps from the Library.
3. To install the app, enter the following fields.
   1. App Name. You can retain the existing name, or enter a name of your choice for the app.
   2. Data Source. Select either of these options for the data source:
      • Choose Source Category and then choose a source category from the list.
      • Select Enter a Custom Data Filter and type in a custom source category that starts with an underscore. For Example, _sourceCategory=MyCategory.
   3. Advanced. Select the Location in Library (the default is the Personal folder in the library), or click New Folder to add a new folder.
4. Click Add to Library.

Once an app is installed, it will appear in your Personal folder, or other folder that you specified. You can share it with your organization.

The panels will begin to fill automatically. It's worth noting that each panel gradually fills with data that matches the time range query and has been received since the panel was created. The results will not be available right away, but with some patience, you will be able to view full graphs and maps.

Viewing Microsoft Graph Identity Protection Dashboards

• All dashboards have a set of filters that you can apply to the entire dashboard, as shown in the following example. Click the funnel icon in the top dashboard menu bar to display a scrollable list of filters that are applied across the entire dashboard.
• You can use filters to drill down and examine the data on a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
• Each panel has a set of filters that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.

Risk Detections

Microsoft Graph Identity Protection - Risk Detections.

This dashboard provides insights into the risks detected in the organization. It displays the geo-location of risks, and the distribution of risks by state, type, level, activity, and token issuer type. It also shows the latency chart which helps to identify the delay between risk occurrence and detection time. It displays the table with information about the frequency of risks by type with a one-day comparison, a summary of all the risks, and a list of various actions performed to mitigate the risks with their frequency.

Risky Users

Microsoft Graph Identity Protection - Risky Users.

This dashboard helps to monitor and manage the risky users of your organization. It visualizes the distribution of risky users by status, level, state, and processing state. It also provides a list of various actions performed to mitigate the risks with their frequency. It displays the table of summary of all the risky users.