Azure - User Investigation

This playbook performs an investigation on a specific user in Azure environments, using queries and logs from Azure Log Analytics to locate the following activities performed by the user: - Script-based user agent usage - Administrative user activities - Security rules and policies changes - Failed login attempt - MFA failed login attempt - Login attempt from an uncommon country - Anomalies activities - Risky users - Uncommon high volume of actions - Action uncommonly performed by the user

Azure Enrichment and Remediation · 36 tasks · 4 inputs · 19 outputs

Details

ID	`Azure - User Investigation`
From Version	6.9.0
Tasks	36

README

This playbook performs an investigation on a specific user in Azure environments, using queries and logs from Azure Log Analytics to locate the following activities performed by the user:

Script-based user agent usage
Administrative user activities
Security rules and policies changes
Failed login attempt
MFA failed login attempt
Login attempt from an uncommon country
Anomalies activities
Risky users
Uncommon high volume of actions
Action uncommonly performed by the user

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Azure Log Analytics

Scripts

SetAndHandleEmpty
SetMultipleValues

Commands

azure-log-analytics-execute-query

Playbook Inputs

Name	Description	Default Value	Required
Username	The username to investigate.		Optional
AzureSearchTime	The Search Time for the Azure Log Analytics search query. Default value: ago(1d)	ago(7d)	Optional
failedLogonThreshold	The threshold number of failed logons by the user. Required to determine how many failed logon events count as suspicious events.	20	Optional
MfaAttemptThreshold	The threshold number of MFA failed logons by the user. Required to determine how many MFA failed logon events count as suspicious events.	10	Optional

Playbook Outputs

Path	Description	Type
AzureScriptBasedUserAgentEvents	Script-based user agent events used by the user in the Azure environment.	string
CountAzureEvents.AzureScriptBasedUserAgentCount	The number of script-based user agent usages by the user in the Azure environment.	number
AzureAdminActivitiesEvents	Administrative activities performed by the user in the Azure environment.	string
CountAzureEvents.AzureAdminActivitiesCount	The number of administrative activities performed by the user in the Azure environment.	number
AzureSecurityRulesChangeEvents	Security rules that were changed by the user in the Azure environment.	string
CountAzureEvents.AzureSecurityRulesChangeCount	The number of security rules that were changed by the user in the Azure environment.	number
AzureUnsuccessSecurityRulesChangeEvents	Unsuccessful attempts to change security rules by the user in the Azure environment.	string
CountAzureEvents.AzureUnsuccessSecurityRulesChangeCount	The number of unsuccessful attempts to change security rules by the user in the Azure environment.	number
AzureFailLoginCount	The number of failed logins by the user in the Azure environment.	number
AzureFailLoginMFACount	The number of failed logins by the user using MFA in the Azure environment.	number
AzureAnomaliesEvents	Anomaly events on the user in the Azure environment.	string
CountAzureEvents.AzureAnomaliesCount	The number of anomaly events on the user in the Azure environment.	number
AzureRiskyUserCount	The number of events where the user was defined as a risky user in the Azure environment.	number
AzureUncommonCountryLogonEvents	Uncommon country logon events by the user in the Azure environment.	string
CountAzureEvents.AzureUncommonCountryLogonCount	The number of uncommon country logon events by the user in the Azure environment.	number
AzureUncommonVolumeEvents	Uncommon volume events by the user in the Azure environment.	string
CountAzureEvents.AzureUncommonVolumeCount	The number of uncommon volume events by the user in the Azure environment.	number
AzureUncommonActivitiesEvents	Uncommon activity events by the user in the Azure environment.	string
CountAzureEvents.AzureUncommonActivitiesCount	The number of uncommon activity events by the user in the Azure environment.	number

Playbook Image

Azure - User Investigation

Inputs

Username — The username to investigate.
AzureSearchTime — The Search Time for the Azure Log Analytics search query. Default value: ago(1d)
failedLogonThreshold — The threshold number of failed logons by the user. Required to determine how many failed logon events count as suspicious events.
MfaAttemptThreshold — The threshold number of MFA failed logons by the user. Required to determine how many MFA failed logon events count as suspicious events.

Outputs

AzureScriptBasedUserAgentEvents — Script-based user agent events used by the user in the Azure environment.
CountAzureEvents.AzureScriptBasedUserAgentCount — The number of script-based user agent usages by the user in the Azure environment.
AzureAdminActivitiesEvents — Administrative activities performed by the user in the Azure environment.
CountAzureEvents.AzureAdminActivitiesCount — The number of administrative activities performed by the user in the Azure environment.
AzureSecurityRulesChangeEvents — Security rules that were changed by the user in the Azure environment.
CountAzureEvents.AzureSecurityRulesChangeCount — The number of security rules that were changed by the user in the Azure environment.
AzureUnsuccessSecurityRulesChangeEvents — Unsuccessful attempts to change security rules by the user in the Azure environment.
CountAzureEvents.AzureUnsuccessSecurityRulesChangeCount — The number of unsuccessful attempts to change security rules by the user in the Azure environment.
AzureFailLoginCount — The number of failed logins by the user in the Azure environment.
AzureFailLoginMFACount — The number of failed logins by the user using MFA in the Azure environment.
AzureAnomaliesEvents — Anomaly events on the user in the Azure environment.
CountAzureEvents.AzureAnomaliesCount — The number of anomaly events on the user in the Azure environment.
AzureRiskyUserCount — The number of events where the user was defined as a risky user in the Azure environment.
AzureUncommonCountryLogonEvents — Uncommon country logon events by the user in the Azure environment.
CountAzureEvents.AzureUncommonCountryLogonCount — The number of uncommon country logon events by the user in the Azure environment.
AzureUncommonVolumeEvents — Uncommon volume events by the user in the Azure environment.
CountAzureEvents.AzureUncommonVolumeCount — The number of uncommon volume events by the user in the Azure environment.
AzureUncommonActivitiesEvents — Uncommon activity events by the user in the Azure environment.
CountAzureEvents.AzureUncommonActivitiesCount — The number of uncommon activity events by the user in the Azure environment.

Commands used

azure-log-analytics-execute-query

Flowchart

Source

playbook-Azure_-_User_Investigation.yml

Download History Raw

id: Azure - User Investigation
version: -1
name: Azure - User Investigation
description: |-
  This playbook performs an investigation on a specific user in Azure environments, using queries and logs from Azure Log Analytics to locate the following activities performed by the user:
  - Script-based user agent usage
  - Administrative user activities
  - Security rules and policies changes
  - Failed login attempt
  - MFA failed login attempt
  - Login attempt from an uncommon country
  - Anomalies activities
  - Risky users
  - Uncommon high volume of actions
  - Action uncommonly performed by the user
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5aee39e8-c3e3-4825-8b99-253c7d8ddabc
    type: start
    task:
      id: 5aee39e8-c3e3-4825-8b99-253c7d8ddabc
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 240,
          "y": -80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 4286364d-bd10-43b7-8838-3d2f13d1eb87
    type: condition
    task:
      id: 4286364d-bd10-43b7-8838-3d2f13d1eb87
      version: -1
      name: Is Azure Log Analytics enabled and the user name is defined?
      description: Checks if the Azure Log Analytics integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "9"
      - "8"
      - "7"
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Azure Log Analytics
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 240,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: c793822a-6a73-4cef-87b4-cf6363c0b4ac
    type: regular
    task:
      id: c793822a-6a73-4cef-87b4-cf6363c0b4ac
      version: -1
      name: 'Logon attempt from uncommon country'
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      extend-context:
        simple: AzureUncommonCountryLogon=
      query:
        simple: "BehaviorAnalytics\n| where ActivityInsights.FirstTimeUserConnectedFromCountry == \"True\"\n| where UserPrincipalName == @\"${inputs.Username}\" \n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize Count = count(), Events = make_list(ActionType)"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: e3afb9b9-75b2-40da-8154-347de63aaedb
    type: title
    task:
      id: e3afb9b9-75b2-40da-8154-347de63aaedb
      version: -1
      name: BehaviorAnalytics (Sentinel)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 251ebe3b-f61c-4a7f-8173-6b3207bb53b5
    type: title
    task:
      id: 251ebe3b-f61c-4a7f-8173-6b3207bb53b5
      version: -1
      name: IdentityInfo (Sentinel)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 5a31e359-3437-4f0c-8580-2940c2532994
    type: title
    task:
      id: 5a31e359-3437-4f0c-8580-2940c2532994
      version: -1
      name: Anomalies (Sentinel)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 4b3731b9-77c7-4702-8cad-a6e33593e1ed
    type: title
    task:
      id: 4b3731b9-77c7-4702-8cad-a6e33593e1ed
      version: -1
      name: SigninLogs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: b1c902eb-61da-4b74-8ac4-e37f117a93d2
    type: title
    task:
      id: b1c902eb-61da-4b74-8ac4-e37f117a93d2
      version: -1
      name: AzureActivity
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 72248260-9922-4787-8a99-52eab98184e5
    type: title
    task:
      id: 72248260-9922-4787-8a99-52eab98184e5
      version: -1
      name: AuditLogs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a1fb3fb9-345e-4457-86bc-68967d850bf8
    type: regular
    task:
      id: a1fb3fb9-345e-4457-86bc-68967d850bf8
      version: -1
      name: Uncommon high volume of actions
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      extend-context:
        simple: AzureUncommonVolume=
      query:
        simple: "BehaviorAnalytics\n| where ActivityInsights.UncommonHighVolumeOfActions == \"True\"\n| where UserPrincipalName == @\"${inputs.Username}\" \n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize Count = count(), Events = make_list(ActionType)"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 003261b4-1cbb-4e46-86db-7ddc89bd98ef
    type: regular
    task:
      id: 003261b4-1cbb-4e46-86db-7ddc89bd98ef
      version: -1
      name: Action uncommonly performed by user
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      extend-context:
        simple: AzureUncommonActivities=
      query:
        simple: |-
          BehaviorAnalytics
          | where ActivityInsights.ActionUncommonlyPerformedByUser == "True"
          | where UserPrincipalName == @"${inputs.Username}"
          | where TimeGenerated > ${inputs.AzureSearchTime}
          | summarize Count = count(), Events = make_list(ActionType)
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: fdbda8a8-0c68-41ff-8383-b234f5796ebe
    type: regular
    task:
      id: fdbda8a8-0c68-41ff-8383-b234f5796ebe
      version: -1
      name: Check if the user is defined as a risky user
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      extend-context:
        simple: AzureRiskyUser=
      query:
        simple: |-
          IdentityInfo
          | where RiskState contains "Risk"
          | where RiskLevel == "High"
          | where AccountUPN == @"${inputs.Username}"
          | where TimeGenerated >  ${inputs.AzureSearchTime}
          | summarize Count = count()
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 5f98b4bb-04f8-4322-8552-6811832e17a4
    type: regular
    task:
      id: 5f98b4bb-04f8-4322-8552-6811832e17a4
      version: -1
      name: Anomalies for the user
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      extend-context:
        simple: AzureAnomalies=
      query:
        simple: "Anomalies \n| where UserPrincipalName ==  @\"${inputs.Username}\"\n| where TimeGenerated >  ${inputs.AzureSearchTime}\n| summarize Count = count(), Events = make_list(AnomalyDetails)"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: c9c89daa-d7bf-48cc-8efd-16ce1ac02113
    type: regular
    task:
      id: c9c89daa-d7bf-48cc-8efd-16ce1ac02113
      version: -1
      name: Failed login attempts by the user
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      extend-context:
        simple: AzureNumOfFailLogin=
      query:
        simple: "SigninLogs \n| where parse_json(Status) contains \"fail\"\n| where UserPrincipalName == @\"${inputs.Username}\"\n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize ActionCount = count() by UserPrincipalName\n| where ActionCount > ${inputs.failedLogonThreshold}\n| summarize Count = count()"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 3f60ee79-cdd8-4732-8bf0-1eb7494a072f
    type: regular
    task:
      id: 3f60ee79-cdd8-4732-8bf0-1eb7494a072f
      version: -1
      name: Check for script-based user agent
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      extend-context:
        simple: AzureScriptBasedUserAgent=
      ignore-outputs:
        simple: "false"
      query:
        simple: "AuditLogs \n| where parse_json(tostring(InitiatedBy.user)).userPrincipalName == @\"${inputs.Username}\" \n| where AdditionalDetails[0].value contains \"python\" or AdditionalDetails[0].value contains \"curl\" or AdditionalDetails[0].value contains \"axios\" or AdditionalDetails[0].value contains \"httpie\" or AdditionalDetails[0].value contains \"wget\"\n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize Count = count(), Events = make_list(AdditionalDetails)"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 231a71b4-5b1f-4b2b-8a38-864e0c704167
    type: regular
    task:
      id: 231a71b4-5b1f-4b2b-8a38-864e0c704167
      version: -1
      name: Security rules were changed successfully
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      extend-context:
        simple: AzureSuccessSecurityRulesChange=
      query:
        simple: "AzureActivity\n| where OperationName in (\"Delete Security Rule\",\"Create or Update Security Rule\",\"Update Alert Rules\",\"Delete Alert Rules\",\"Delete Watchlists\",\"Update Watchlists\",\"Microsoft.SecurityInsights/watchlists/watchlistItems/delete\",\"Create or Update Application Gateway WAF Policy\",\"Delete Application Gateway WAF Policy\",\"Update database threat detection policy\")\n| where ActivityStatus == \"Succeeded\"\n| where Caller ==  @\"${inputs.Username}\" \n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize Count = count(), Events = make_list(OperationName)"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 2c78c73a-079c-4c66-884d-c30be565c963
    type: regular
    task:
      id: 2c78c73a-079c-4c66-884d-c30be565c963
      version: -1
      name: An unsuccessful attempt to change security rules
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      extend-context:
        simple: AzureUnsuccessSecurityRulesChange=
      query:
        simple: "AzureActivity\n| where OperationName in (\"Delete Security Rule\",\"Create or Update Security Rule\",\"Update Alert Rules\",\"Delete Alert Rules\",\"Delete Watchlists\",\"Update Watchlists\",\"Microsoft.SecurityInsights/watchlists/watchlistItems/delete\",\"Create or Update Application Gateway WAF Policy\",\"Delete Application Gateway WAF Policy\",\"Update database threat detection policy\")\n| where ActivityStatus != \"Succeeded\"\n| where Caller ==  @\"${inputs.Username}\" \n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize Count = count(), Events = make_list(OperationName)"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: a4968328-3479-4eef-80f1-f42aab2c6fe4
    type: regular
    task:
      id: a4968328-3479-4eef-80f1-f42aab2c6fe4
      version: -1
      name: Search for administrative user activities
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      extend-context:
        simple: AzureAdminActivities=
      ignore-outputs:
        simple: "false"
      query:
        simple: "AuditLogs\n| where parse_json(tostring(InitiatedBy.user)).userPrincipalName ==  @\"${inputs.Username}\" \n| where Category in (\"ApplicationManagement\", \"UserManagement\", \"PolicyManagement\", \"GroupManagement\")| where Result == \"success\"\n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize Count = count(), Events = make_list(OperationName)"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 2a2bf514-43ab-4e9b-8e9f-c76ba315d16a
    type: regular
    task:
      id: 2a2bf514-43ab-4e9b-8e9f-c76ba315d16a
      version: -1
      name: Set events count
      description: Set multiple keys/values to the context.
      scriptName: SetMultipleValues
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      keys:
        simple: AzureScriptBasedUserAgentCount,AzureAdminActivitiesCount,AzureSecurityRulesChangeCount,AzureUnsuccessSecurityRulesChangeCount,AzureAnomaliesCount,AzureUncommonCountryLogonCount,AzureUncommonVolumeCount,AzureUncommonActivitiesCount
      parent:
        simple: CountAzureEvents
      values:
        simple: ${AzureScriptBasedUserAgent.tables.rows.[0].[0]},${AzureAdminActivities.tables.rows.[0].[0]},${AzureSuccessSecurityRulesChange.tables.rows.[0].[0]},${AzureUnsuccessSecurityRulesChange.tables.rows.[0].[0]},${AzureAnomalies.tables.rows.[0].[0]},${AzureUncommonCountryLogon.tables.rows.[0].[0]},${AzureUncommonVolume.tables.rows.[0].[0]},${AzureUncommonActivities.tables.rows.[0].[0]}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 240,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 87060e96-667d-49a4-8b5a-3072fd4553a1
    type: regular
    task:
      id: 87060e96-667d-49a4-8b5a-3072fd4553a1
      version: -1
      name: The user did not pass the MFA challenge
      description: Executes an Analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      extend-context:
        simple: AzureNumOfFailMFA=
      query:
        simple: "SigninLogs \n| where ResultType =~ \"50074\"\n| where UserPrincipalName == @\"${inputs.Username}\"\n| where TimeGenerated > ${inputs.AzureSearchTime}\n| summarize ActionCount = count() by UserPrincipalName\n| where ActionCount > ${inputs.MfaAttemptThreshold}"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: e54197e5-9cf6-4f4f-8875-7e43bdef9808
    type: regular
    task:
      id: e54197e5-9cf6-4f4f-8875-7e43bdef9808
      version: -1
      name: Set script-based user agent events
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      key:
        simple: AzureScriptBasedUserAgentEvents
      value:
        complex:
          root: AzureScriptBasedUserAgent.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 69fa497d-ca2e-4891-8b51-842262dc8cfe
    type: regular
    task:
      id: 69fa497d-ca2e-4891-8b51-842262dc8cfe
      version: -1
      name: Set administrative events
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key:
        simple: AzureAdminActivitiesEvents
      value:
        complex:
          root: AzureAdminActivities.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 632abf51-3069-4d39-8307-d88729788b94
    type: regular
    task:
      id: 632abf51-3069-4d39-8307-d88729788b94
      version: -1
      name: Set security rules changed events
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: AzureSecurityRulesChangeEvents
      value:
        complex:
          root: AzureSuccessSecurityRulesChange.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 47fae1fd-4922-4eab-8b29-8577018f047a
    type: regular
    task:
      id: 47fae1fd-4922-4eab-8b29-8577018f047a
      version: -1
      name: Set attempt to change security rules events
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key:
        simple: AzureUnsuccessSecurityRulesChangeEvents
      value:
        complex:
          root: AzureUnsuccessSecurityRulesChange.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 7f8e214d-c0df-4d8b-8867-3fd95e597d66
    type: regular
    task:
      id: 7f8e214d-c0df-4d8b-8867-3fd95e597d66
      version: -1
      name: Set anomalies events
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key:
        simple: AzureAnomaliesEvents
      value:
        complex:
          root: AzureAnomalies.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: ad023e29-8a0d-4c84-87cf-bec720378b87
    type: regular
    task:
      id: ad023e29-8a0d-4c84-87cf-bec720378b87
      version: -1
      name: Set event of logon attempt from uncommon country
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      key:
        simple: AzureUncommonCountryLogonEvents
      value:
        complex:
          root: AzureUncommonCountryLogon.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 532d2390-6293-4c2c-8873-cbe620c21414
    type: regular
    task:
      id: 532d2390-6293-4c2c-8873-cbe620c21414
      version: -1
      name: Set events of uncommon high volume of actions
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      key:
        simple: AzureUncommonVolumeEvents
      value:
        complex:
          root: AzureUncommonVolume.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 2add1b66-34d3-4c95-8697-2403d56660a7
    type: regular
    task:
      id: 2add1b66-34d3-4c95-8697-2403d56660a7
      version: -1
      name: Set events of action uncommonly performed by the user
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key:
        simple: AzureUncommonActivitiesEvents
      value:
        complex:
          root: AzureUncommonActivities.tables.rows.[0]
          accessor: '[1]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: b8af36fa-0211-4310-866b-cb9f58e16115
    type: title
    task:
      id: b8af36fa-0211-4310-866b-cb9f58e16115
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 240,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 982caec5-ce0d-46e0-81d4-54f83b6378d7
    type: regular
    task:
      id: 982caec5-ce0d-46e0-81d4-54f83b6378d7
      version: -1
      name: Set the number of failed login attempts by the user
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      key:
        simple: AzureFailLoginCount
      value:
        complex:
          root: AzureNumOfFailLogin.tables.rows.[0]
          accessor: '[0]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 881466ef-da2a-461a-8ee3-81c1d7504eb8
    type: regular
    task:
      id: 881466ef-da2a-461a-8ee3-81c1d7504eb8
      version: -1
      name: Set the number of failed login MFA by the user
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key:
        simple: AzureFailLoginMFACount
      value:
        complex:
          root: AzureNumOfFailMFA.tables.rows.[0]
          accessor: '[0]'
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "0"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 752b0d29-0d1f-4985-814f-72d96252984b
    type: regular
    task:
      id: 752b0d29-0d1f-4985-814f-72d96252984b
      version: -1
      name: Set the number that the user was defined as a risky user
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key:
        simple: AzureRiskyUserCount
      value:
        complex:
          root: AzureRiskyUser.tables.rows.[0]
          accessor: '[0]'
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "0"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 5b2b1c42-7a11-456d-82a6-421c46feee98
    type: regular
    task:
      id: 5b2b1c42-7a11-456d-82a6-421c46feee98
      version: -1
      name: Search for available tables
      description: Executes an analytics query for data.
      script: Azure Log Analytics|||azure-log-analytics-execute-query
      type: regular
      iscommand: true
      brand: Azure Log Analytics
    nexttasks:
      '#none#':
      - "4"
      - "5"
      - "6"
    scriptarguments:
      extend-context:
        simple: AzureTables=
      query:
        simple: search "*" | summarize count() by $table | sort by count_ desc
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 6660c680-dbb2-4718-8eb2-3c52f0aa5452
    type: condition
    task:
      id: 6660c680-dbb2-4718-8eb2-3c52f0aa5452
      version: -1
      name: should perform queries on Azure Sentinel Anomalies tables?
      description: Checks if the Azure Sentinel Anomalies table is available for querying.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              simple: ${AzureTables.tables.rows.[].[0]}
            iscontext: true
          right:
            value:
              simple: Anomalies
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: edc86152-4e2a-405c-8822-bb3677942ab1
    type: condition
    task:
      id: edc86152-4e2a-405c-8822-bb3677942ab1
      version: -1
      name: should perform queries on Azure Sentinel BehaviorAnalytics tables?
      description: Checks if the Azure Sentinel BehaviorAnalytics table is available for querying.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              simple: ${AzureTables.tables.rows.[].[0]}
            iscontext: true
          right:
            value:
              simple: BehaviorAnalytics
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 4bfe49ef-8907-4748-8d5e-e9ab50d96c8e
    type: condition
    task:
      id: 4bfe49ef-8907-4748-8d5e-e9ab50d96c8e
      version: -1
      name: should perform queries on Azure Sentinel IdentityInfo tables?
      description: Checks if the Azure Sentinel IdentityInfo table is available for querying.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              simple: ${AzureTables.tables.rows.[].[0]}
            iscontext: true
          right:
            value:
              simple: IdentityInfo
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "1_22_#default#": 0.1,
      "38_22_#default#": 0.15,
      "39_22_#default#": 0.11,
      "40_22_#default#": 0.11
    },
    "paper": {
      "dimensions": {
        "height": 2125,
        "width": 2560,
        "x": -850,
        "y": -80
      }
    }
  }
inputs:
- key: Username
  value: {}
  required: false
  description: The username to investigate.
  playbookInputQuery:
- key: AzureSearchTime
  value:
    simple: ago(7d)
  required: false
  description: 'The Search Time for the Azure Log Analytics search query. Default value: ago(1d)'
  playbookInputQuery:
- key: failedLogonThreshold
  value:
    simple: "20"
  required: false
  description: The threshold number of failed logons by the user. Required to determine how many failed logon events count as suspicious events.
  playbookInputQuery:
- key: MfaAttemptThreshold
  value:
    simple: "10"
  required: false
  description: The threshold number of MFA failed logons by the user. Required to determine how many MFA failed logon events count as suspicious events.
  playbookInputQuery:
outputs:
- contextPath: AzureScriptBasedUserAgentEvents
  description: Script-based user agent events used by the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureScriptBasedUserAgentCount
  description: The number of script-based user agent usages by the user in the Azure environment.
  type: number
- contextPath: AzureAdminActivitiesEvents
  description: Administrative activities performed by the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureAdminActivitiesCount
  description: The number of administrative activities performed by the user in the Azure environment.
  type: number
- contextPath: AzureSecurityRulesChangeEvents
  description: Security rules that were changed by the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureSecurityRulesChangeCount
  description: The number of security rules that were changed by the user in the Azure environment.
  type: number
- contextPath: AzureUnsuccessSecurityRulesChangeEvents
  description: Unsuccessful attempts to change security rules by the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureUnsuccessSecurityRulesChangeCount
  description: The number of unsuccessful attempts to change security rules by the user in the Azure environment.
  type: number
- contextPath: AzureFailLoginCount
  description: The number of failed logins by the user in the Azure environment.
  type: number
- contextPath: AzureFailLoginMFACount
  description: The number of failed logins by the user using MFA in the Azure environment.
  type: number
- contextPath: AzureAnomaliesEvents
  description: Anomaly events on the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureAnomaliesCount
  description: The number of anomaly events on the user in the Azure environment.
  type: number
- contextPath: AzureRiskyUserCount
  description: The number of events where the user was defined as a risky user in the Azure environment.
  type: number
- contextPath: AzureUncommonCountryLogonEvents
  description: Uncommon country logon events by the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureUncommonCountryLogonCount
  description: The number of uncommon country logon events by the user in the Azure environment.
  type: number
- contextPath: AzureUncommonVolumeEvents
  description: Uncommon volume events by the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureUncommonVolumeCount
  description: The number of uncommon volume events by the user in the Azure environment.
  type: number
- contextPath: AzureUncommonActivitiesEvents
  description: Uncommon activity events by the user in the Azure environment.
  type: string
- contextPath: CountAzureEvents.AzureUncommonActivitiesCount
  description: The number of uncommon activity events by the user in the Azure environment.
  type: number
tests:
- No tests (auto formatted)
fromversion: 6.9.0