category: Vulnerability Management provider: Microsoft commonfields: id: AzureRiskyUsers version: -1 sectionorder: - Connect configuration: - display: Client ID name: client_id type: 9 hiddenusername: true displaypassword: Client ID required: false section: Connect - additionalinfo: Type of authentication - could be Client Credentials Authorization Flow (recommended) or Device Code Flow. defaultvalue: Device Code display: Authentication Type name: authentication_type options: - Client Credentials - Device Code - Azure Managed Identities required: true type: 15 section: Connect - display: Tenant ID (for Client Credentials mode) name: tenant_id type: 0 required: false section: Connect - display: Client Secret (for Client Credentials mode) name: client_secret type: 9 hiddenusername: true displaypassword: Client Secret (for Client Credentials mode) required: false section: Connect - additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. displaypassword: Azure Managed Identities Client ID name: managed_identities_client_id hiddenusername: true type: 9 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect description: Azure Risky Users provides access to all at-risk users and risk detections in the Azure AD environment. display: Azure Risky Users name: AzureRiskyUsers script: commands: - description: Tests the connectivity to Azure. name: azure-risky-users-auth-test - description: Starts the authorization process. Follow the instructions in the command results. name: azure-risky-users-auth-start - description: Completes the authorization process. Run this command after executing the azure-risky-users-auth-start command. name: azure-risky-users-auth-complete - description: Run this command if for some reason you need to rerun the authentication process. name: azure-risky-users-auth-reset - arguments: - auto: PREDEFINED description: Sets the Risk State to retrieve. name: risk_state predefined: - atRisk - confirmedCompromised - remediated - dismissed - defaultValue: '50' description: Limit of results to retrieve. name: limit - description: Page number. name: page hidden: true - description: Amount of results per request. Value can be between 1 and 500. When only page_size is given, the first page results will be fetched. name: page_size - description: The URL for the next set of items to return during pagination. (This URL can be retrieved from a previous call). name: next_token - auto: PREDEFINED description: Sets the Risk Level to retrieve. name: risk_level predefined: - low - medium - high - description: The method used to order the retrieved results. name: order_by defaultValue: 'riskLastUpdatedDateTime desc' auto: PREDEFINED predefined: - 'riskLastUpdatedDateTime desc' - 'riskLastUpdatedDateTime asc' - description: Displays all RiskyUsers before a specific datetime. For Example "2024-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours". name: updated_before - description: Displays all RiskyUsers after a specific datetime. For Example "2024-02-27T04:49:26.257525Z", "10 days", "5 months", "2 hours". name: updated_after description: Returns a list of all risky users and their properties. name: azure-risky-users-list outputs: - contextPath: AzureRiskyUsers.RiskyUser.id description: Unique ID of the user at risk. type: String - contextPath: AzureRiskyUsers.RiskyUser.userDisplayName description: Risky user display name. type: String - contextPath: AzureRiskyUsers.RiskyUser.userPrincipalName description: Risky user principal name. type: String - contextPath: AzureRiskyUsers.RiskyUser.riskLevel description: 'Level of the detected risky user. Possible values are: low, medium, high, hidden, none, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskyUser.riskState description: 'State of the user''s risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised.' type: String - contextPath: AzureRiskyUsers.RiskyUser.riskLastUpdatedDateTime description: 'The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskyUser.isDeleted description: Indicates whether the user is deleted. type: Boolean - contextPath: AzureRiskyUsers.RiskyUser.isProcessing description: Indicates whether a user's risky state is being processed by the backend. type: Boolean - contextPath: AzureRiskyUsers.RiskyUser.riskDetail description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskyUserListNextToken description: A property in the response that contains a URL to the next page of results. type: String - arguments: - description: Risky user ID to retrieve. name: id required: true description: Retrieves properties and relationships of a Risky User. name: azure-risky-user-get outputs: - contextPath: AzureRiskyUsers.RiskyUser.id description: Unique ID of the user at risk. type: String - contextPath: AzureRiskyUsers.RiskyUser.userDisplayName description: Risky user display name. type: String - contextPath: AzureRiskyUsers.RiskyUser.userPrincipalName description: Risky user principal name. type: String - contextPath: AzureRiskyUsers.RiskyUser.riskLevel description: 'Level of the detected risky user. Possible values are: low, medium, high, hidden, none, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskyUser.riskState description: 'State of the user''s risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised.' type: String - contextPath: AzureRiskyUsers.RiskyUser.riskLastUpdatedDateTime description: 'The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskyUser.isDeleted description: Indicates whether the user is deleted. type: Boolean - contextPath: AzureRiskyUsers.RiskyUser.isProcessing description: Indicates whether a user's risky state is being processed by the backend. type: Boolean - contextPath: AzureRiskyUsers.RiskyUser.riskDetail description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.' type: String - arguments: - defaultValue: '50' description: Limit of results to retrieve. name: limit predefined: - '' - defaultValue: '1' description: Page number. name: page - auto: PREDEFINED description: Sets the Risk State to retrieve. name: risk_state predefined: - atRisk - confirmedCompromised - remediated - dismissed - confirmedSafe - auto: PREDEFINED description: Sets the Risk Level to retrieve. name: risk_level predefined: - low - medium - high - description: Filter events that created before specific time range starting, e.g. 2022-06-09T23:00:44.7420905Z. name: detected_date_time_before - description: Filter events that created after specific time range starting, e.g. 2022-06-09T23:00:44.7420905Z. name: detected_date_time_after - description: The method used to order the retrieved results. name: order_by defaultValue: 'detectedDateTime desc' auto: PREDEFINED predefined: - 'detectedDateTime desc' - 'detectedDateTime asc' description: Returns a comma-separated list of the Risk Detection objects and their properties. name: azure-risky-users-risk-detections-list outputs: - contextPath: AzureRiskyUsers.RiskDetection.id description: Unique ID of the risk detection. Inherited from the entity. type: String - contextPath: AzureRiskyUsers.RiskDetection.userId description: The unique user ID. type: String - contextPath: AzureRiskyUsers.RiskDetection.userDisplayName description: The user display name. type: String - contextPath: AzureRiskyUsers.RiskDetection.userPrincipalName description: The user principal name (UPN). type: String - contextPath: AzureRiskyUsers.RiskDetection.riskDetail description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.riskEventType description: 'The type of risk event detected. Possible values are: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue. If the risk detection is a premium detection, will show generic.' type: String - contextPath: AzureRiskyUsers.RiskDetection.riskLevel description: 'Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.riskState description: 'The state of a detected risky user or sign-in. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.ipAddress description: The IP address of the client where the risk occurred. type: String - contextPath: AzureRiskyUsers.RiskDetection.source description: The source of the risk detection. For example, activeDirectory. type: String - contextPath: AzureRiskyUsers.RiskDetection.detectionTimingType description: 'Timing of the detected risk (real-time/offline). Possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.lastUpdatedDateTime description: 'Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskDetection.location description: Location of the sign-in. type: String - contextPath: AzureRiskyUsers.RiskDetection.activity description: 'Indicates the activity type the detected risk is linked to. . Possible values are: signin, user, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.activityDateTime description: 'Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskDetection.additionalInfo description: Additional information associated with the risk detection in JSON format. type: String - contextPath: AzureRiskyUsers.RiskDetection.correlationId description: Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in. type: String - contextPath: AzureRiskyUsers.RiskDetection.detectedDateTime description: 'Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskDetection.requestId description: Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in. type: String - contextPath: AzureRiskyUsers.RiskDetection.tokenIssuerType description: 'Indicates the type of token issuer for the detected sign-in risk. Possible values are: AzureAD, ADFederationServices, UnknownFutureValue.' type: String - arguments: - description: The risk detection ID to retrieve. name: id required: true description: Reads the properties and relationships of a riskDetection object. name: azure-risky-users-risk-detection-get outputs: - contextPath: AzureRiskyUsers.RiskDetection.id description: Unique ID of the risk detection. Inherited from the entity. type: String - contextPath: AzureRiskyUsers.RiskDetection.userId description: The unique user ID. type: String - contextPath: AzureRiskyUsers.RiskDetection.userDisplayName description: The user display name. type: String - contextPath: AzureRiskyUsers.RiskDetection.userPrincipalName description: The user principal name (UPN). type: String - contextPath: AzureRiskyUsers.RiskDetection.riskDetail description: 'Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.riskEventType description: The type of risk event detected. The possible values are unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue. If the risk detection is a premium detection, will show generic. type: String - contextPath: AzureRiskyUsers.RiskDetection.riskLevel description: 'Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.riskState description: 'The state of a detected risky user or sign-in. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.ipAddress description: The IP address of the client where the risk occurred. type: String - contextPath: AzureRiskyUsers.RiskDetection.source description: The source of the risk detection. For example, activeDirectory. type: String - contextPath: AzureRiskyUsers.RiskDetection.detectionTimingType description: 'Timing of the detected risk (real-time/offline). Possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.lastUpdatedDateTime description: 'Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskDetection.location description: Location of the sign-in. type: String - contextPath: AzureRiskyUsers.RiskDetection.activity description: 'Indicates the activity type the detected risk is linked to. . Possible values are: signin, user, unknownFutureValue.' type: String - contextPath: AzureRiskyUsers.RiskDetection.activityDateTime description: 'Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskDetection.additionalInfo description: Additional information associated with the risk detection in JSON format. type: String - contextPath: AzureRiskyUsers.RiskDetection.correlationId description: Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in. type: String - contextPath: AzureRiskyUsers.RiskDetection.detectedDateTime description: 'Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z.' type: Date - contextPath: AzureRiskyUsers.RiskDetection.requestId description: Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in. type: String - contextPath: AzureRiskyUsers.RiskDetection.tokenIssuerType description: 'Indicates the type of token issuer for the detected sign-in risk. Possible values are: AzureAD, ADFederationServices, UnknownFutureValue.' type: String - arguments: - description: A comma-separated list of User IDs or UPNs of the user(s) to confirm as compromised. Results may not be immediately visible due to processing delays in Azure. name: user required: true isArray: True description: Confirms user(s) as compromised. name: azure-risky-users-confirm-compromise outputs: - contextPath: AzureRiskyUsers.Remediation.UserID description: The ID of the user. type: String - contextPath: AzureRiskyUsers.Remediation.UserPrincipalName description: The UPN of the user. This key will be populated only if the user's UPN is provided. type: String - contextPath: AzureRiskyUsers.Remediation.Success description: Whether the new state was applied successfully. type: Boolean - contextPath: AzureRiskyUsers.Remediation.RiskState description: The new risk state of the user. type: String - arguments: - description: A comma-separated list of User IDs or UPNs of the user(s) to confirm as safe. Results may not be immediately visible due to processing delays in Azure. name: user required: true isArray: True description: Confirms user(s) as safe (post-investigation). name: azure-risky-users-confirm-safe outputs: - contextPath: AzureRiskyUsers.Remediation.UserID description: The ID of the user. type: String - contextPath: AzureRiskyUsers.Remediation.UserPrincipalName description: The UPN of the user. This key will be populated only if the user's UPN is provided. type: String - contextPath: AzureRiskyUsers.Remediation.Success description: Whether the new state was applied successfully. type: Boolean - contextPath: AzureRiskyUsers.Remediation.RiskState description: The new risk state of the user. type: String dockerimage: demisto/crypto:1.0.0.10120494 runonce: false script: '-' subtype: python3 type: python tests: - AzureRiskyUsers fromversion: 6.0.0