elastic / elastic/integrations

[Azure] Add support for ServicePrincipalRiskEvents and RiskyServicePrincipals on the AD Identity Protection Ingest Pipeline.

Open
#8,562 5 comments 1 reaction 0 assignees View on GitHub
enhancement Integration:azure Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

Hello,

The Azure Active Directory integration documentation [mentions](https://docs.elastic.co/integrations/azure/adlogs) that the following Log categories are supported:

|data stream|log category|
|-----|-----|
|Sign-in| SignInLogs |
|Sign-in| NonInteractiveUserSignInLogs |
|Sign-in| ServicePrincipalSignInLogs |
|Sign-in| ManagedIdentitySignInLogs |
|Audit| AuditLogs |
|Identity Protection| RiskyUsers |
|Identity Protection| UserRiskEvents |
|Provisioning| ProvisioningLogs |

For the Identity Protection data stream, it supports just the `RiskyUsers` and `UserRiskEvents` log category, but Azure AD also provides `RiskyServicePrincipals` and `ServicePrincipalRiskEvents`, which are similar, but for Service Principal accounts and those two tables are not mentioned in the documentation.

We have a requirement to collect the logs from those two tables, and currently they do not seem to be supported as they have extra/different fields.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.