[FR] New Analyzer - AzureAlerts

Feature description
Using the Microsoft Graph API, get details of various security alerts from the Microsoft Azure eco-system.

Describe the solution you'd like
The Cortex Analyzer would ingest one of the following observable type:

• URL
• Mail

When provided with an URL, the analyzer will run the getAlertDetails service, which checks if the URL belongs to one of the supported security alerts type from Microsoft Azure, and queries additional information about this alert via the Microsoft Graph API. Note: The Analyzer supports the used of Microsoft Safe Links as Observable URLs.

If provided a Mail, the analyzer will run the getRiskySignIn service, which checks for any Risky Sign-In alerts related to this Mail in the Microsoft Azure AD Identity Protection alerts.

Currently the following are tested and supported:

1. Office365 Alerts (protection.office.com)
   • Default Alerts
   • Custom Alerts
2. Microsoft 365 Compliance Center (compliance.microsoft.com)
3. Azure AD Alerts
   • Identity Protection Alerts

Additional context
In order to make this Cortex Analyzer work, you will need to register an "app" in your Microsoft Azure AD. This app, given proper credentials, will return a token used to authenticate with the Microsoft Graph API. Without it, you cannot use the Microsoft Graph API.

The README of the Analyzer contains detailed instructions on how to add such an app to your Azure AD.

There are currently some limitations on how much information the Microsoft Graph API can pull back. As the Microsoft Graph API project grows, and new features are added, this will enable the analyzer to perform more complex queries and correlations.

See below for some screenshots of the short/long report output for this analyzer:

Example of Short Reports for different type and status of alerts:

Example of a Long Report for a Compliance Alert:

Example of a Risky Sign-In check on a user account, with multiple alerts returned:

Start with the Analyzer README for the Azure AD app registration and Microsoft Graph authentication requirements. Review the getAlertDetails and getRiskySignIn services described in the issue, along with the supported URL and Mail observables. Done means the analyzer can query the listed Office365, Compliance Center, and Azure AD alert types and produce short and long reports.