Microsoft Graph Identity and Access Classifier

Details

ID	`Microsoft Graph Identity and Access Classifier`
Type	classification
Version	-1
From Version	6.2.0
Default Incident Type	Microsoft Graph Identity and Access
Feed	No

Key Type Map

Key	Incident Type
`adminConfirmedUserCompromised`	Microsoft Graph Identity and Access
`anomalousToken`	Microsoft Graph Identity and Access
`anomalousUserActivity`	Microsoft Graph Identity and Access
`anonymizedIPAddress`	Microsoft Graph Identity and Access
`attackerinTheMiddle`	Microsoft Graph Identity and Access
`attemptedPrtAccess`	Microsoft Graph Identity and Access
`generic`	Microsoft Graph Identity and Access
`impossibleTravel`	Microsoft Graph Identity and Access
`investigationsThreatIntelligence`	Microsoft Graph Identity and Access
`leakedCredentials`	Microsoft Graph Identity and Access
`maliciousIPAddress`	Microsoft Graph Identity and Access
`malwareInfectedIPAddress`	Microsoft Graph Identity and Access
`mcasImpossibleTravel`	Microsoft Graph Identity and Access
`mcasFinSuspiciousFileAccess`	Microsoft Graph Identity and Access
`mcasSuspiciousInboxManipulationRules`	Microsoft Graph Identity and Access
`nationStateIP`	Microsoft Graph Identity and Access
`newCountry`	Microsoft Graph Identity and Access
`passwordSpray`	Microsoft Graph Identity and Access
`riskyIPAddress`	Microsoft Graph Identity and Access
`suspiciousAPITraffic`	Microsoft Graph Identity and Access
`suspiciousBrowser`	Microsoft Graph Identity and Access
`suspiciousInboxForwarding`	Microsoft Graph Identity and Access
`suspiciousIPAddress`	Microsoft Graph Identity and Access
`suspiciousSendingPatterns`	Microsoft Graph Identity and Access
`tokenIssuerAnomaly`	Microsoft Graph Identity and Access
`unlikelyTravel`	Microsoft Graph Identity and Access
`unfamiliarFeatures`	Microsoft Graph Identity and Access
`userReportedSuspiciousActivity`	Microsoft Graph Identity and Access
`investigationsThreatIntelligenceSigninLinked`	Microsoft Graph Identity and Access
`maliciousIPAddressValidCredentialsBlockedIP`	Microsoft Graph Identity and Access
`unknownFutureValue`	Microsoft Graph Identity and Access

Source

classifier-Azure_Active_Directory_Identity_Protection_Classifier.json

Download History Raw

{
    "defaultIncidentType": "Microsoft Graph Identity and Access",
    "description": "Classifies Microsoft Graph Identity and Access's alerts",
    "feed": false,
    "id": "Microsoft Graph Identity and Access Classifier",
    "keyTypeMap": {
        "adminConfirmedUserCompromised": "Microsoft Graph Identity and Access",
        "anomalousToken": "Microsoft Graph Identity and Access",
        "anomalousUserActivity": "Microsoft Graph Identity and Access",
        "anonymizedIPAddress": "Microsoft Graph Identity and Access",
        "attackerinTheMiddle": "Microsoft Graph Identity and Access",
        "attemptedPrtAccess": "Microsoft Graph Identity and Access",
        "generic": "Microsoft Graph Identity and Access",
        "impossibleTravel": "Microsoft Graph Identity and Access",
        "investigationsThreatIntelligence": "Microsoft Graph Identity and Access",
        "leakedCredentials": "Microsoft Graph Identity and Access",
        "maliciousIPAddress": "Microsoft Graph Identity and Access",
        "malwareInfectedIPAddress": "Microsoft Graph Identity and Access",
        "mcasImpossibleTravel": "Microsoft Graph Identity and Access",
        "mcasFinSuspiciousFileAccess": "Microsoft Graph Identity and Access",
        "mcasSuspiciousInboxManipulationRules": "Microsoft Graph Identity and Access",
        "nationStateIP": "Microsoft Graph Identity and Access",
        "newCountry": "Microsoft Graph Identity and Access",
        "passwordSpray": "Microsoft Graph Identity and Access",
        "riskyIPAddress": "Microsoft Graph Identity and Access",
        "suspiciousAPITraffic": "Microsoft Graph Identity and Access",
        "suspiciousBrowser": "Microsoft Graph Identity and Access",
        "suspiciousInboxForwarding": "Microsoft Graph Identity and Access",
        "suspiciousIPAddress": "Microsoft Graph Identity and Access",
        "suspiciousSendingPatterns": "Microsoft Graph Identity and Access",
        "tokenIssuerAnomaly": "Microsoft Graph Identity and Access",
        "unlikelyTravel": "Microsoft Graph Identity and Access",
        "unfamiliarFeatures": "Microsoft Graph Identity and Access",
        "userReportedSuspiciousActivity": "Microsoft Graph Identity and Access",
        "investigationsThreatIntelligenceSigninLinked": "Microsoft Graph Identity and Access",
        "maliciousIPAddressValidCredentialsBlockedIP": "Microsoft Graph Identity and Access",
        "unknownFutureValue": "Microsoft Graph Identity and Access"
    },
    "name": "Microsoft Graph Identity and Access Classifier",
    "propagationLabels": [
        "all"
    ],
    "transformer": {
        "complex": null,
        "simple": "riskEventType"
    },
    "type": "classification",
    "version": -1,
    "fromVersion": "6.2.0",
    "supportedModules": [
        "agentix",
        "xsiam"
    ]
}