User Accounts - Sign in Failure due to CA Spikes

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


Identifies spike in failed sign-ins from user accounts due to conditional access policied. Spike is determined based on Time series anomaly which will look at historical baseline values. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.

Attribute Value
Type Analytic Rule
Solution Microsoft Entra ID
ID 3a9d5ede-2b9d-43a2-acc4-d272321ff77c
Severity Medium
Status Available
Kind Scheduled
Tactics InitialAccess
Techniques T1078.004
Required Connectors AzureActiveDirectory, AzureActiveDirectory, BehaviorAnalytics, BehaviorAnalytics
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
Anomalies ?
BehaviorAnalytics ?
IdentityInfo ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Microsoft Entra ID