AzureRiskyUsers

Azure Risky Users provides access to all at-risk users and risk detections in the Azure AD environment.

Vulnerability Management · Azure Risky Users

Details

IDAzureRiskyUsers
ProviderMicrosoft
CategoryVulnerability Management
From Version6.0.0
Docker Imagedemisto/crypto:1.0.0.10120494
Supported ModulesAgentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Azure Risky Users provides access to all at-risk users and risk detections in Azure AD environment.
This integration was integrated and tested with version 1.0 of Microsoft Graph Azure Risky Users.

Self-Deployed Application

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal.

The application must have the following permissions:

  • IdentityRiskEvent.Read.All
  • IdentityRiskEvent.ReadWrite.All
  • IdentityRiskyUser.Read.All
  • IdentityRiskyUser.ReadWrite.All
  • User.Read.All

In case you want to use Device code flow, you must allow public client flows (can be found under the Authentication section of the app).

Authentication Using the Client Credentials Flow (recommended)

Follow these steps for a self-deployed configuration:

  1. To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the following Microsoft article steps 1-8.
  2. Select the client-credentials Authentication Type.
  3. Enter your Client/Application ID in the Application ID parameter.
  4. Enter your Client Secret in the Client Secret parameter.
  5. Enter your Tenant ID in the Tenant ID parameter.
  6. Save the instance.
  7. Run the !azure-risky-users-auth-test command - a ‘Success’ message should be printed to the War Room.

Authentication Using the Device Code Flow

Follow these steps for a self-deployed configuration:

  1. Fill in the required parameters.
  2. Run the !azure-risky-users-auth-start command.
  3. Follow the instructions that appear.
  4. Run the !azure-risky-users-auth-complete command.

At end of the process you’ll see a message that you’ve logged in successfully.

Cortex XSOAR Application

In order to use the Cortex XSOAR Azure application,
use the Client ID - (application_id) (ec854987-95fa-4c8f-8056-768dd0f409ac).

Authentication Using the Device Code Flow -

In order to connect to the Azure Risky Users using the Cortex XSOAR Azure App with Device Code flow authentication. See device authorization grant flow.

  1. Fill in the required parameters - use the above mentioned Client ID - (application_id).
  2. Run the !azure-risky-users-auth-start command.
  3. Follow the instructions that appear.
  4. Run the !azure-risky-users-auth-complete command.

At end of the process you’ll see a message that you’ve logged in successfully.

Configure AzureRiskyUsers on Cortex

  1. Navigate to one of the following:
    • Cortex XSOAR 8: Settings & Info > Settings > Integrations > Instances
    • Cortex XSOAR 6: Settings > Integrations
    • Cortex XSIAM: Settings > Configurations > Automation & Feed Integrations
  2. Search for AzureRiskyUsers.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Required
    Client ID True
    Authentication Type True
    Tenant ID (for Client Credentials mode) False
    Client Secret (for Client Credentials mode) False
    Azure Managed Identities Client ID False
    Use system proxy False
    Trust any certificate False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-risky-users-auth-test

Tests the connectivity to Azure.

Base Command

azure-risky-users-auth-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

> Success!

### azure-risky-users-auth-start

***
Run this command to start the authorization process and follow the instructions in the command results.

#### Base Command

`azure-risky-users-auth-start`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!azure-risky-users-auth-start```

#### Human Readable Output

>### Authorization instructions
>
>1. To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXX to authenticate.
>2. Run the ***!azure-risky-users-auth-complete*** command in the War Room.

### azure-risky-users-auth-complete

***
Run this command to complete the authorization process. Should be used after running the azure-risky-users-auth-start command.

#### Base Command

`azure-risky-users-auth-complete`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!azure-risky-users-auth-complete```

#### Human Readable Output

> Authorization completed successfully.

### azure-risky-users-auth-reset

***
Run this command if for some reason you need to rerun the authentication process.

#### Base Command

`azure-risky-users-auth-reset`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!azure-risky-users-auth-reset```

#### Human Readable Output

>Authorization was reset successfully. Run **!azure-risky-users-auth-start** to start the authentication process.

### azure-risky-users-list

***
Returns a list of all risky users and their properties.

#### Base Command

`azure-risky-users-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| risk_state | Sets the Risk State to retrieve. Possible values are: atRisk, confirmedCompromised, remediated, dismissed. | Optional |
| limit | Limit of results to retrieve. Default is 50. | Optional |
| page | Page number. | Optional |
| page_size | Amount of results per request. Value can be between 1 and 500. When only page_size is given, the first page results will be fetched. | Optional |
| next_token | The URL for the next set of items to return during pagination. (This URL can be retrieved from a previous call). | Optional |
| risk_level | Sets the Risk Level to retrieve. Possible values are: low, medium, high. | Optional |
| order_by | The method used to order the retrieved results. Possible values are: riskLastUpdatedDateTime desc, riskLastUpdatedDateTime asc. Default is riskLastUpdatedDateTime desc. | Optional |
| updated_before | Displays all RiskyUsers before a specific datetime. For Example "2024-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours". | Optional |
| updated_after | Displays all RiskyUsers after a specific datetime. For Example "2024-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours". | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureRiskyUsers.RiskyUser.id | String | Unique ID of the user at risk. |
| AzureRiskyUsers.RiskyUser.userDisplayName | String | Risky user display name. |
| AzureRiskyUsers.RiskyUser.userPrincipalName | String | Risky user principal name. |
| AzureRiskyUsers.RiskyUser.riskLevel | String | Level of the detected risky user. Possible values are: low, medium, high, hidden, none, unknownFutureValue. |
| AzureRiskyUsers.RiskyUser.riskState | String | State of the user's risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised. |
| AzureRiskyUsers.RiskyUser.riskLastUpdatedDateTime | Date | The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: 2014-01-01T00:00:00Z. |
| AzureRiskyUsers.RiskyUser.isDeleted | Boolean | Indicates whether the user is deleted. |
| AzureRiskyUsers.RiskyUser.isProcessing | Boolean | Indicates whether a user's risky state is being processed by the backend. |
| AzureRiskyUsers.RiskyUser.riskDetail | String | Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue. |
| AzureRiskyUsers.RiskyUserListNextToken | String | A property in the response that contains a URL to the next page of results. |

#### Command example

```!azure-risky-users-list page_size=2```

#### Context Example

```json
{
    "AzureRiskyUsers": {
        "RiskyUser": [
            {
                "id": "ID_1",
                "isDeleted": false,
                "isProcessing": false,
                "riskDetail": "none",
                "riskLastUpdatedDateTime": "2023-06-04T10:12:39.3625926Z",
                "riskLevel": "medium",
                "riskState": "atRisk",
                "userDisplayName": "user Display Name",
                "userPrincipalName": "User Principal Name"
            },
            {
                "id": "ID_2",
                "isDeleted": false,
                "isProcessing": false,
                "riskDetail": "none",
                "riskLastUpdatedDateTime": "2022-02-23T17:50:40.3408199Z",
                "riskLevel": "high",
                "riskState": "atRisk",
                "userDisplayName": "user Display Name",
                "userPrincipalName": "User Principal Name"
            },
        ],
        "RiskyUserListNextToken": "token",
    }
}

Human Readable Output

Risky Users List

Id User Display Name User Principal Name Risk Level Risk State Risk Detail Risk Last Updated Date Time
ID_1 user Display Name User Principal Name medium atRisk none 2023-06-04T10:12:39.3625926Z
ID_2 user Display Name User Principal Name high atRisk none 2022-02-23T17:50:40.3408199Z

Risky Users List Token

next_token
token

azure-risky-user-get

Retrieve properties and relationships of a Risky User.

Base Command

azure-risky-user-get

Input

Argument Name Description Required
id Risky user ID to retrieve. Required

Context Output

Path Type Description
AzureRiskyUsers.RiskyUser.id String Unique ID of the user at risk.
AzureRiskyUsers.RiskyUser.userDisplayName String Risky user display name.
AzureRiskyUsers.RiskyUser.userPrincipalName String Risky user principal name.
AzureRiskyUsers.RiskyUser.riskLevel String Level of the detected risky user. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
AzureRiskyUsers.RiskyUser.riskState String State of the user’s risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised.
AzureRiskyUsers.RiskyUser.riskLastUpdatedDateTime Date The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: 2014-01-01T00:00:00Z
AzureRiskyUsers.RiskyUser.isDeleted Boolean Indicates whether the user is deleted.
AzureRiskyUsers.RiskyUser.isProcessing Boolean Indicates whether a user’s risky state is being processed by the backend.
AzureRiskyUsers.RiskyUser.riskDetail String Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.

Command Example

!azure-risky-user-get id=333

Context Example

{
    "AzureRiskyUsers": {
        "RiskyUser": {
            "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#identityProtection/riskyUsers/$entity",
            "id": "333",
            "isDeleted": false,
            "isProcessing": false,
            "riskDetail": "userPerformedSecuredPasswordReset",
            "riskLastUpdatedDateTime": "2020-10-05T12:12:17.2115592Z",
            "riskLevel": "none",
            "riskState": "remediated",
            "userDisplayName": "Yossi Israeli",
            "userPrincipalName": "yossi@test.com"
        }
    }
}

Human Readable Output

Found Risky User With ID: 333

Id User Display Name User Principal Name Risk Level Risk State Risk Detail Risk Last Updated Date Time
333 Yossi Israeli yossi@test.com none remediated userPerformedSecuredPasswordReset 2020-10-05T12:12:17.2115592Z

azure-risky-users-risk-detections-list

Get a list of the riskDetection objects and their properties.

Base Command

azure-risky-users-risk-detections-list

Input

Argument Name Description Required
limit Limit of results to retrieve. Default is 50. Optional
page Page number. Default is 1. Optional
risk_state Risk State to retrieve. If not specified, all states will be retrieved. Possible values are: atRisk, confirmedCompromised, remediated, dismissed, confirmedSafe. Optional
risk_level Specify to get only results with the same Risk Level. Possible values are: low, medium, high. Optional
detected_date_time_before Filter events that created before specific time range starting, e.g. 2022-06-09T23:00:44.7420905Z. Optional
detected_date_time_after Filter events that created after specific time range starting, e.g. 2022-06-09T23:00:44.7420905Z. Optional
order_by The method used to order the retrieved results. Optional

Context Output

Path Type Description
AzureRiskyUsers.RiskDetection.id String Unique ID of the risk detection. Inherited from entity.
AzureRiskyUsers.RiskDetection.userId String Unique ID of the user.
AzureRiskyUsers.RiskDetection.userDisplayName String The user display name of the user.
AzureRiskyUsers.RiskDetection.userPrincipalName String The user principal name (UPN) of the user.
AzureRiskyUsers.RiskDetection.riskDetail String Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.
AzureRiskyUsers.RiskDetection.riskEventType String The type of risk event detected. The possible values are unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue. If the risk detection is a premium detection, will show generic
AzureRiskyUsers.RiskDetection.riskLevel String Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
AzureRiskyUsers.RiskDetection.riskState String The state of a detected risky user or sign-in. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
AzureRiskyUsers.RiskDetection.ipAddress String Provides the IP address of the client from where the risk occurred.
AzureRiskyUsers.RiskDetection.source String Source of the risk detection. For example, activeDirectory.
AzureRiskyUsers.RiskDetection.detectionTimingType String Timing of the detected risk (real-time/offline). Possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.
AzureRiskyUsers.RiskDetection.lastUpdatedDateTime Date Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
AzureRiskyUsers.RiskDetection.location String Location of the sign-in.
AzureRiskyUsers.RiskDetection.activity String Indicates the activity type the detected risk is linked to. . Possible values are: signin, user, unknownFutureValue.
AzureRiskyUsers.RiskDetection.activityDateTime Date Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
AzureRiskyUsers.RiskDetection.additionalInfo String Additional information associated with the risk detection in JSON format.
AzureRiskyUsers.RiskDetection.correlationId String Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
AzureRiskyUsers.RiskDetection.detectedDateTime Date Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
AzureRiskyUsers.RiskDetection.requestId String Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
AzureRiskyUsers.RiskDetection.tokenIssuerType String Indicates the type of token issuer for the detected sign-in risk. Possible values are: AzureAD, ADFederationServices, UnknownFutureValue.

Command Example

!azure-risky-users-risk-detections-list limit=2

Context Example

{
    "AzureRiskyUsers": {
        "RiskDetection": [
            {
                "activity": "signin",
                "activityDateTime": "2021-06-20T03:51:32.9572792Z",
                "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Dalvik/2.1.0 (Linux; U; Android 9; VKY-L29 Build/HUAWEIVKY-L29) ;VKY-L29\"}]",
                "correlationId": "aaaa1111",
                "detectedDateTime": "2021-06-20T03:51:32.9572792Z",
                "detectionTimingType": "realtime",
                "id": "555",
                "ipAddress": "1.1.1.1",
                "lastUpdatedDateTime": "2021-06-20T03:53:58.853418Z",
                "location": {
                    "city": "Pisgat Ze'ev",
                    "countryOrRegion": "IL",
                    "geoCoordinates": {
                        "latitude": 31,
                        "longitude": 35
                    },
                    "state": "Yerushalayim"
                },
                "requestId": "bbbb1111",
                "riskDetail": "userPassedMFADrivenByRiskBasedPolicy",
                "riskEventType": "unfamiliarFeatures",
                "riskLevel": "low",
                "riskState": "remediated",
                "source": "IdentityProtection",
                "tokenIssuerType": "AzureAD",
                "userDisplayName": "Shalev Israeli",
                "userId": "777",
                "userPrincipalName": "ShalevI@test.com"
            },
            {
                "activity": "signin",
                "activityDateTime": "2021-06-27T19:16:19.9976898Z",
                "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Dalvik/2.1.0 (Linux; U; Android 9; SM-G950F Build/PPR1.180610.011) ;SM-G950F\"}]",
                "correlationId": "aaaa2222",
                "detectedDateTime": "2021-06-27T19:16:19.9976898Z",
                "detectionTimingType": "realtime",
                "id": "888",
                "ipAddress": "1.1.1.1",
                "lastUpdatedDateTime": "2021-06-27T19:19:44.4975416Z",
                "location": {
                    "city": "Dniprodzerzhyns'k",
                    "countryOrRegion": "UA",
                    "geoCoordinates": {
                        "latitude": 48,
                        "longitude": 34
                    },
                    "state": "Dnipropetrovs'ka Oblast'"
                },
                "requestId": "bbbb2222",
                "riskDetail": "userPassedMFADrivenByRiskBasedPolicy",
                "riskEventType": "unfamiliarFeatures",
                "riskLevel": "low",
                "riskState": "remediated",
                "source": "IdentityProtection",
                "tokenIssuerType": "AzureAD",
                "userDisplayName": "Svetlana Israeli",
                "userId": "999",
                "userPrincipalName": "SvetlanaI@test.com"
            }
        ]
    }
}

Human Readable Output

Risk Detections List

Current page size: 2
Showing page 1 out others that may exist

Id User Id User Display Name User Principal Name Risk Detail Risk Event Type Risk Level Risk State Risk Detail Last Updated Date Time Ip Address
555 777 Shalev Israeli ShalevI@test.com userPassedMFADrivenByRiskBasedPolicy unfamiliarFeatures low remediated userPassedMFADrivenByRiskBasedPolicy 2021-06-20T03:53:58.853418Z 1.1.1.1
888 999 Svetlana Israeli SvetlanaI@test.com userPassedMFADrivenByRiskBasedPolicy unfamiliarFeatures low remediated userPassedMFADrivenByRiskBasedPolicy 2021-06-27T19:19:44.4975416Z 1.1.1.1

azure-risky-users-risk-detection-get

Read the properties and relationships of a riskDetection object.

Base Command

azure-risky-users-risk-detection-get

Input

Argument Name Description Required
id ID of risk detection to retrieve. Required

Context Output

Path Type Description
AzureRiskyUsers.RiskDetection.id String Unique ID of the risk detection. Inherited from entity.
AzureRiskyUsers.RiskDetection.userId String Unique ID of the user.
AzureRiskyUsers.RiskDetection.userDisplayName String The user display name of the user.
AzureRiskyUsers.RiskDetection.userPrincipalName String The user principal name (UPN) of the user.
AzureRiskyUsers.RiskDetection.riskDetail String Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.
AzureRiskyUsers.RiskDetection.riskEventType String The type of risk event detected. The possible values are unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue. If the risk detection is a premium detection, will show generic
AzureRiskyUsers.RiskDetection.riskLevel String Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
AzureRiskyUsers.RiskDetection.riskState String The state of a detected risky user or sign-in. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
AzureRiskyUsers.RiskDetection.ipAddress String Provides the IP address of the client from where the risk occurred.
AzureRiskyUsers.RiskDetection.source String Source of the risk detection. For example, activeDirectory.
AzureRiskyUsers.RiskDetection.detectionTimingType String Timing of the detected risk (real-time/offline). Possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.
AzureRiskyUsers.RiskDetection.lastUpdatedDateTime Date Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
AzureRiskyUsers.RiskDetection.location String Location of the sign-in.
AzureRiskyUsers.RiskDetection.activity String Indicates the activity type the detected risk is linked to. . Possible values are: signin, user, unknownFutureValue.
AzureRiskyUsers.RiskDetection.activityDateTime Date Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
AzureRiskyUsers.RiskDetection.additionalInfo String Additional information associated with the risk detection in JSON format.
AzureRiskyUsers.RiskDetection.correlationId String Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
AzureRiskyUsers.RiskDetection.detectedDateTime Date Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
AzureRiskyUsers.RiskDetection.requestId String Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
AzureRiskyUsers.RiskDetection.tokenIssuerType String Indicates the type of token issuer for the detected sign-in risk. Possible values are: AzureAD, ADFederationServices, UnknownFutureValue.

Command Example

!azure-risky-users-risk-detection-get id=6565

Context Example

{
    "AzureRiskyUsers": {
        "RiskDetection": {
            "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#identityProtection/riskDetections/$entity",
            "activity": "signin",
            "activityDateTime": "2021-07-03T13:35:38.8773806Z",
            "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Dalvik/2.1.0 (Linux; U; Android 9; SM-G950F Build/PPR1.180610.011) ;SM-G950F\"}]",
            "correlationId": "aaaa3333",
            "detectedDateTime": "2021-07-03T13:35:38.8773806Z",
            "detectionTimingType": "realtime",
            "id": "6565",
            "ipAddress": "3.3.3.3",
            "lastUpdatedDateTime": "2021-07-03T13:38:04.6531838Z",
            "location": {
                "city": "Lviv",
                "countryOrRegion": "UA",
                "geoCoordinates": {
                    "latitude": 49,
                    "longitude": 24
                },
                "state": "L'vivs'ka Oblast'"
            },
            "requestId": "bbbb33333",
            "riskDetail": "userPassedMFADrivenByRiskBasedPolicy",
            "riskEventType": "unfamiliarFeatures",
            "riskLevel": "low",
            "riskState": "remediated",
            "source": "IdentityProtection",
            "tokenIssuerType": "AzureAD",
            "userDisplayName": "Svetlana Israeli",
            "userId": "999",
            "userPrincipalName": "SvetlanaI@test.com"
        }
    }
}

Human Readable Output

Found Risk Detection with ID: 6565

Id User Id User Display Name User Principal Name Risk Detail Risk Event Type Risk Level Risk State Ip Address Detection Timing Type Last Updated Date Time Location
6565 999 Svetlana Israeli SvetlanaI@test.com userPassedMFADrivenByRiskBasedPolicy unfamiliarFeatures low remediated 3.3.3.3 realtime 2021-07-03T13:38:04.6531838Z city: Lviv
state: L’vivs’ka Oblast’
countryOrRegion: UA
geoCoordinates: {“latitude”: 49, “longitude”: 24}

azure-risky-users-confirm-safe

Confirms user(s) as safe (post-investigation).

Base Command

azure-risky-users-confirm-safe

Input

Argument Name Description Required
user A comma-separated list of User IDs or UPNs of the user(s) to confirm as safe. Results may not be immediately visible due to processing delays in Azure. Required

Context Output

Path Type Description
AzureRiskyUsers.Remediation.UserID String The ID of the user.
AzureRiskyUsers.Remediation.UserPrincipalName String The UPN of the user. This key will be populated only if the user’s UPN is provided.
AzureRiskyUsers.Remediation.Success Boolean Whether the new state was applied successfully.
AzureRiskyUsers.Remediation.RiskState String The new risk state of the user.

Command Example

!azure-risky-users-confirm-safe user=user_id_1,name2@test.com,name3@test.com

Context Example

{
    "AzureRiskyUsers": {
        "Remediation": [
            {
                "UserID": "user_id_1",
                "UserPrincipalName": "",
                "Success": true,
                "RiskState": "confirmedSafe"
            },
            {
                "UserID": "user_id_2",
                "UserPrincipalName": "name2@test.com",
                "Success": true,
                "RiskState": "confirmedSafe"
            },
            {
                "UserID": "user_id_3",
                "UserPrincipalName": "name3@test.com",
                "Success": false,
                "RiskState": ""
            }
        ]
    }
}

Human Readable Output

Successfully confirmed users as safe

UserID UserPrincipalName Success RiskState
user_id_1   true confirmedSafe
user_id_2 name2@test.com true confirmedSafe

Unable to confirm users as safe

User Error
name3@test.com Error: confirmation failed.

azure-risky-users-confirm-compromise

Confirms user(s) as compromised.

Base Command

azure-risky-users-confirm-compromise

Input

Argument Name Description Required
user A comma-separated list of User IDs or UPNs of the user(s) to confirm as compromised. Results may not be immediately visible due to processing delays in Azure. Required

Context Output

Path Type Description
AzureRiskyUsers.Remediation.UserID String The ID of the user.
AzureRiskyUsers.Remediation.UserPrincipalName String The UPN of the user. This key will be populated only if the user’s UPN is provided.
AzureRiskyUsers.Remediation.Success Boolean Whether the new state was applied successfully.
AzureRiskyUsers.Remediation.RiskState String The new risk state of the user.

Command Example

!azure-risky-users-confirm-compromise user=user_id_1,name2@test.com,name3@test.com

Context Example

{
    "AzureRiskyUsers": {
        "Remediation": [
            {
                "UserID": "user_id_1",
                "UserPrincipalName": "",
                "Success": true,
                "RiskState": "confirmedCompromised"
            },
            {
                "UserID": "user_id_2",
                "UserPrincipalName": "name2@test.com",
                "Success": true,
                "RiskState": "confirmedCompromised"
            },
            {
                "UserID": "user_id_3",
                "UserPrincipalName": "name3@test.com",
                "Success": false,
                "RiskState": ""
            }
        ]
    }
}

Human Readable Output

Successfully confirmed users as compromised

UserID UserPrincipalName Success RiskState
user_id_1   true confirmedCompromised
user_id_2 name2@test.com true confirmedCompromised

Unable to confirm users as compromised

User Error
name3@test.com Error: confirmation failed.

Configuration parameters

  • client_id — Client ID
  • authentication_type — Authentication Type (required)
  • tenant_id — Tenant ID (for Client Credentials mode)
  • client_secret — Client Secret (for Client Credentials mode)
  • managed_identities_client_id —
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (10)

  • azure-risky-user-get

    Retrieves properties and relationships of a Risky User.

  • azure-risky-users-auth-complete

    Completes the authorization process. Run this command after executing the azure-risky-users-auth-start command.

  • azure-risky-users-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • azure-risky-users-auth-start

    Starts the authorization process. Follow the instructions in the command results.

  • azure-risky-users-auth-test

    Tests the connectivity to Azure.

  • azure-risky-users-confirm-compromise

    Confirms user(s) as compromised.

  • azure-risky-users-confirm-safe

    Confirms user(s) as safe (post-investigation).

  • azure-risky-users-list

    Returns a list of all risky users and their properties.

  • azure-risky-users-risk-detection-get

    Reads the properties and relationships of a riskDetection object.

  • azure-risky-users-risk-detections-list

    Returns a comma-separated list of the Risk Detection objects and their properties.

Source

AzureRiskyUsers.py AzureRiskyUsers_test.py AzureRiskyUsers.yml AzureRiskyUsers_description.md command_examples.txt
Download History Raw 
category: Vulnerability Management
provider: Microsoft
commonfields:
  id: AzureRiskyUsers
  version: -1
sectionorder:
- Connect
configuration:
- display: Client ID
  name: client_id
  type: 9
  hiddenusername: true
  displaypassword: Client ID
  required: false
  section: Connect
- additionalinfo: Type of authentication - could be Client Credentials Authorization Flow (recommended) or Device Code Flow.
  defaultvalue: Device Code
  display: Authentication Type
  name: authentication_type
  options:
  - Client Credentials
  - Device Code
  - Azure Managed Identities
  required: true
  type: 15
  section: Connect
- display: Tenant ID (for Client Credentials mode)
  name: tenant_id
  type: 0
  required: false
  section: Connect
- display: Client Secret (for Client Credentials mode)
  name: client_secret
  type: 9
  hiddenusername: true
  displaypassword: Client Secret (for Client Credentials mode)
  required: false
  section: Connect
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
description: Azure Risky Users provides access to all at-risk users and risk detections in the Azure AD environment.
display: Azure Risky Users
name: AzureRiskyUsers
script:
  commands:
  - description: Tests the connectivity to Azure.
    name: azure-risky-users-auth-test
  - description: Starts the authorization process. Follow the instructions in the command results.
    name: azure-risky-users-auth-start
  - description: Completes the authorization process. Run this command after executing the azure-risky-users-auth-start command.
    name: azure-risky-users-auth-complete
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: azure-risky-users-auth-reset
  - arguments:
    - auto: PREDEFINED
      description: Sets the Risk State to retrieve.
      name: risk_state
      predefined:
      - atRisk
      - confirmedCompromised
      - remediated
      - dismissed
    - defaultValue: '50'
      description: Limit of results to retrieve.
      name: limit
    - description: Page number.
      name: page
      hidden: true
    - description: Amount of results per request. Value can be between 1 and 500. When only page_size is given, the first page results will be fetched.
      name: page_size
    - description: The URL for the next set of items to return during pagination. (This URL can be retrieved from a previous call).
      name: next_token
    - auto: PREDEFINED
      description: Sets the Risk Level to retrieve.
      name: risk_level
      predefined:
      - low
      - medium
      - high
    - description: The method used to order the retrieved results.
      name: order_by
      defaultValue: 'riskLastUpdatedDateTime desc'
      auto: PREDEFINED
      predefined:
      - 'riskLastUpdatedDateTime desc'
      - 'riskLastUpdatedDateTime asc'
    - description: Displays all RiskyUsers before a specific datetime. For Example "2024-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".
      name: updated_before
    - description: Displays all RiskyUsers after a specific datetime. For Example "2024-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours".
      name: updated_after
    description: Returns a list of all risky users and their properties.
    name: azure-risky-users-list
    outputs:
    - contextPath: AzureRiskyUsers.RiskyUser.id
      description: Unique ID of the user at risk.
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.userDisplayName
      description: Risky user display name.
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.userPrincipalName
      description: Risky user principal name.
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.riskLevel
      description: 'Level of the detected risky user. Possible values are: low, medium, high, hidden, none, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.riskState
      description: 'State of the user''s risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised.'
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.riskLastUpdatedDateTime
      description: 'The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskyUser.isDeleted
      description: Indicates whether the user is deleted.
      type: Boolean
    - contextPath: AzureRiskyUsers.RiskyUser.isProcessing
      description: Indicates whether a user's risky state is being processed by the backend.
      type: Boolean
    - contextPath: AzureRiskyUsers.RiskyUser.riskDetail
      description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskyUserListNextToken
      description: A property in the response that contains a URL to the next page of results.
      type: String
  - arguments:
    - description: Risky user ID to retrieve.
      name: id
      required: true
    description: Retrieves properties and relationships of a Risky User.
    name: azure-risky-user-get
    outputs:
    - contextPath: AzureRiskyUsers.RiskyUser.id
      description: Unique ID of the user at risk.
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.userDisplayName
      description: Risky user display name.
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.userPrincipalName
      description: Risky user principal name.
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.riskLevel
      description: 'Level of the detected risky user. Possible values are: low, medium, high, hidden, none, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.riskState
      description: 'State of the user''s risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised.'
      type: String
    - contextPath: AzureRiskyUsers.RiskyUser.riskLastUpdatedDateTime
      description: 'The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskyUser.isDeleted
      description: Indicates whether the user is deleted.
      type: Boolean
    - contextPath: AzureRiskyUsers.RiskyUser.isProcessing
      description: Indicates whether a user's risky state is being processed by the backend.
      type: Boolean
    - contextPath: AzureRiskyUsers.RiskyUser.riskDetail
      description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.'
      type: String
  - arguments:
    - defaultValue: '50'
      description: Limit of results to retrieve.
      name: limit
      predefined:
      - ''
    - defaultValue: '1'
      description: Page number.
      name: page
    - auto: PREDEFINED
      description: Sets the Risk State to retrieve.
      name: risk_state
      predefined:
      - atRisk
      - confirmedCompromised
      - remediated
      - dismissed
      - confirmedSafe
    - auto: PREDEFINED
      description: Sets the Risk Level to retrieve.
      name: risk_level
      predefined:
      - low
      - medium
      - high
    - description: Filter events that created before specific time range starting, e.g. 2022-06-09T23:00:44.7420905Z.
      name: detected_date_time_before
    - description: Filter events that created after specific time range starting, e.g. 2022-06-09T23:00:44.7420905Z.
      name: detected_date_time_after
    - description: The method used to order the retrieved results.
      name: order_by
      defaultValue: 'detectedDateTime desc'
      auto: PREDEFINED
      predefined:
      - 'detectedDateTime desc'
      - 'detectedDateTime asc'
    description: Returns a comma-separated list of the Risk Detection objects and their properties.
    name: azure-risky-users-risk-detections-list
    outputs:
    - contextPath: AzureRiskyUsers.RiskDetection.id
      description: Unique ID of the risk detection. Inherited from the entity.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.userId
      description: The unique user ID.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.userDisplayName
      description: The user display name.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.userPrincipalName
      description: The user principal name (UPN).
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskDetail
      description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskEventType
      description: 'The type of risk event detected. Possible values are: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue. If the risk detection is a premium detection, will show generic.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskLevel
      description: 'Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskState
      description: 'The state of a detected risky user or sign-in. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.ipAddress
      description: The IP address of the client where the risk occurred.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.source
      description: The source of the risk detection. For example, activeDirectory.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.detectionTimingType
      description: 'Timing of the detected risk (real-time/offline). Possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.lastUpdatedDateTime
      description: 'Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskDetection.location
      description: Location of the sign-in.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.activity
      description: 'Indicates the activity type the detected risk is linked to. . Possible values are: signin, user, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.activityDateTime
      description: 'Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskDetection.additionalInfo
      description: Additional information associated with the risk detection in JSON format.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.correlationId
      description: Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.detectedDateTime
      description: 'Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskDetection.requestId
      description: Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.tokenIssuerType
      description: 'Indicates the type of token issuer for the detected sign-in risk. Possible values are: AzureAD, ADFederationServices, UnknownFutureValue.'
      type: String
  - arguments:
    - description: The risk detection ID to retrieve.
      name: id
      required: true
    description: Reads the properties and relationships of a riskDetection object.
    name: azure-risky-users-risk-detection-get
    outputs:
    - contextPath: AzureRiskyUsers.RiskDetection.id
      description: Unique ID of the risk detection. Inherited from the entity.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.userId
      description: The unique user ID.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.userDisplayName
      description: The user display name.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.userPrincipalName
      description: The user principal name (UPN).
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskDetail
      description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskEventType
      description: The type of risk event detected. The possible values are unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue. If the risk detection is a premium detection, will show generic.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskLevel
      description: 'Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.riskState
      description: 'The state of a detected risky user or sign-in. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.ipAddress
      description: The IP address of the client where the risk occurred.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.source
      description: The source of the risk detection. For example, activeDirectory.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.detectionTimingType
      description: 'Timing of the detected risk (real-time/offline). Possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.lastUpdatedDateTime
      description: 'Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskDetection.location
      description: Location of the sign-in.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.activity
      description: 'Indicates the activity type the detected risk is linked to. . Possible values are: signin, user, unknownFutureValue.'
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.activityDateTime
      description: 'Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskDetection.additionalInfo
      description: Additional information associated with the risk detection in JSON format.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.correlationId
      description: Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.detectedDateTime
      description: 'Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: AzureRiskyUsers.RiskDetection.requestId
      description: Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
      type: String
    - contextPath: AzureRiskyUsers.RiskDetection.tokenIssuerType
      description: 'Indicates the type of token issuer for the detected sign-in risk. Possible values are: AzureAD, ADFederationServices, UnknownFutureValue.'
      type: String
  - arguments:
    - description: A comma-separated list of User IDs or UPNs of the user(s) to confirm as compromised. Results may not be immediately visible due to processing delays in Azure.
      name: user
      required: true
      isArray: True
    description: Confirms user(s) as compromised.
    name: azure-risky-users-confirm-compromise
    outputs:
    - contextPath: AzureRiskyUsers.Remediation.UserID
      description: The ID of the user.
      type: String
    - contextPath: AzureRiskyUsers.Remediation.UserPrincipalName
      description: The UPN of the user. This key will be populated only if the user's UPN is provided.
      type: String
    - contextPath: AzureRiskyUsers.Remediation.Success
      description: Whether the new state was applied successfully.
      type: Boolean
    - contextPath: AzureRiskyUsers.Remediation.RiskState
      description: The new risk state of the user.
      type: String
  - arguments:
    - description: A comma-separated list of User IDs or UPNs of the user(s) to confirm as safe. Results may not be immediately visible due to processing delays in Azure.
      name: user
      required: true
      isArray: True
    description: Confirms user(s) as safe (post-investigation).
    name: azure-risky-users-confirm-safe
    outputs:
    - contextPath: AzureRiskyUsers.Remediation.UserID
      description: The ID of the user.
      type: String
    - contextPath: AzureRiskyUsers.Remediation.UserPrincipalName
      description: The UPN of the user. This key will be populated only if the user's UPN is provided.
      type: String
    - contextPath: AzureRiskyUsers.Remediation.Success
      description: Whether the new state was applied successfully.
      type: Boolean
    - contextPath: AzureRiskyUsers.Remediation.RiskState
      description: The new risk state of the user.
      type: String
  dockerimage: demisto/crypto:1.0.0.10120494
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- AzureRiskyUsers
fromversion: 6.0.0