Skip to content

Commit 47bf705

Browse files
parth-sumoamee-sumojpipkin1
authored
CONN-5323: Added Microsoft Entra ID Protection doc (#5927)
* CONN-5323: Added Microsoft Entra ID Protection doc * Update 2025-10-17-apps.md * Update sidebars.ts * Update azure-security-microsoft-entra-id-protection.md * Fix to release note --------- Co-authored-by: Amee Lepcha <[email protected]> Co-authored-by: John Pipkin <[email protected]>
1 parent 1413327 commit 47bf705

File tree

8 files changed

+220
-54
lines changed

8 files changed

+220
-54
lines changed

‎blog-service/2025-10-17-apps.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Azure Security - Microsoft Entra ID Protection (Apps)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- apps
6+
- azure
7+
- microsoft
8+
- azure-security-microsoft-entra-id-protection
9+
hide_table_of_contents: true
10+
---
11+
12+
import useBaseUrl from '@docusaurus/useBaseUrl';
13+
14+
We're excited to introduce the new Sumo Logic app for Azure Security - Microsoft Entra ID Protection. This app enhances identity security across Azure environments by proactively detecting, investigating, and mitigating identity-related risks. This integration helps you safeguard user accounts and credentials, ensuring secure access to critical cloud resources. [Learn more](/docs/integrations/microsoft-azure/azure-security-microsoft-entra-id-protection/).

‎cid-redirects.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2950,6 +2950,8 @@
29502950
"/cid/1111": "/docs/integrations/microsoft-azure/azure-open-ai",
29512951
"/cid/1115": "/docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-cloud-apps",
29522952
"/docs/integrations/microsoft-azure/microsoft-defender-for-cloud-apps/": "/docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-cloud-apps",
2953+
"/cid/1116": "/docs/integrations/microsoft-azure/azure-security-microsoft-entra-id-protection",
2954+
"/docs/integrations/microsoft-azure/microsoft-entra-id-protection/": "/docs/integrations/microsoft-azure/azure-security-microsoft-entra-id-protection",
29532955
"/cid/1113": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/databricks-audit-source/",
29542956
"/Cloud_SIEM_Enterprise": "/docs/cse",
29552957
"/Cloud_SIEM_Enterprise/Administration": "/docs/cse/administration",

‎docs/integrations/microsoft-azure/azure-security-microsoft-entra-id-protection.md‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
---
2+
id: azure-security-microsoft-entra-id-protection
3+
title: Azure Security - Microsoft Entra ID Protection
4+
sidebar_label: Azure Security - Microsoft Entra ID Protection
5+
description: Learn how to collect alerts from the Azure Security - Microsoft Entra ID Protection platform and send them to Sumo Logic for analysis.
6+
---
7+
8+
import useBaseUrl from '@docusaurus/useBaseUrl';
9+
10+
<img src={useBaseUrl('img/integrations/microsoft-azure/azure-security-microsoft-entra-id-protection.png')} alt="Thumbnail icon" width="50"/>
11+
12+
The Azure Security – Microsoft Entra ID Protection application strengthens identity security within Azure environments by proactively detecting, investigating, and mitigating identity-related risks. It helps organizations safeguard user accounts and credentials against potential compromise, ensuring secure access to critical cloud resources
13+
14+
The Sumo Logic app for Azure Security - Microsoft Entra ID Protection provides interactive dashboards and visual tools. The app supports incident identification, user activity tracking, and access monitoring for sensitive data. These features enable faster response times and more agile decision-making, ultimately helping organizations enhance their overall security posture. By delivering a comprehensive view of cloud app security, the app empowers you to manage threats efficiently and ensures robust protection of critical Azure-based assets.
15+
16+
## Log Types
17+
18+
The Azure Security – Microsoft Entra ID Protection uses Sumo Logic’s Microsoft Graph Security source to collect [alerts](https://learn.microsoft.com/en-us/graph/api/security-list-alerts_v2?view=graph-rest-1.0&tabs=http) from the Microsoft Graph Security source.
19+
20+
### Sample log messages
21+
22+
<details>
23+
<summary>Alert Log</summary>
24+
25+
```json
26+
{
27+
"id": "ad702c56f4e096bad6317188657c055326e564fc89de72328c",
28+
"providerAlertId": "efa85202d5d391b6d368c8c985d95a221df17581886575fd8d11666a1d12",
29+
"incidentId": "14",
30+
"status": "new",
31+
"severity": "high",
32+
"classification": "truePositive",
33+
"determination": "malware",
34+
"serviceSource": "azureAdIdentityProtection",
35+
"detectionSource": "automatedInvestigation",
36+
"detectorId": "AnomalousToken",
37+
"tenantId": "3adb963c-8e61-48-a06d-6dbb0dacea39",
38+
"title": "Anomalous Token",
39+
"description": "Anomalous token indicates that there are abnormal characteristics in the token such as token duration and authentication from unfamiliar IP address",
40+
"recommendedActions": "",
41+
"category": "Random",
42+
"assignedTo": null,
43+
"alertWebUrl": "https://566bdd7bcaa08702d6bebe31e2901.serveo.net/alerts/ad702c56f4e096bad66c055326e564fc89de72328c?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
44+
"incidentWebUrl": "https://566ba0ac28702d6bebe31e2901.serveo.net/incidents/14?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
45+
"actorDisplayName": null,
46+
"threatDisplayName": null,
47+
"threatFamilyName": null,
48+
"mitreTechniques": [],
49+
"createdDateTime": "2025-09-18T15:14:17+0530577Z",
50+
"lastUpdateDateTime": "2025-09-18T15:14:17+0530667Z",
51+
"resolvedDateTime": null,
52+
"firstActivityDateTime": "2025-09-18T15:14:17+0530872Z",
53+
"lastActivityDateTime": "2025-09-18T15:14:17+0530872Z",
54+
"comments": [
55+
{
56+
"@odata.type": "#microsoft.graph.security.alertComment",
57+
"comment": "Not valid",
58+
"createdByDisplayName": "Sam",
59+
"createdDateTime": "2025-09-18T15:14:17+053088Z"
60+
}
61+
],
62+
"evidence": [
63+
{
64+
"@odata.type": "#microsoft.graph.security.userEvidence",
65+
"createdDateTime": "2025-09-18T15:14:17+0530333Z",
66+
"verdict": "unknown",
67+
"remediationStatus": "none",
68+
"remediationStatusDetails": null,
69+
"roles": ["compromised"],
70+
"detailedRoles": [],
71+
"tags": [],
72+
"userAccount": {
73+
"accountName": "tseapps",
74+
"domainName": null,
75+
"userSid": "S-1-12-1-175818657-1758188657-589068932-1758188657",
76+
"azureAdUserId": "f5e829f5-4f-4fcf-847a-1c234c1b3b84",
77+
"userPrincipalName": "[email protected]",
78+
"displayName": null
79+
}
80+
},
81+
{
82+
"@odata.type": "#microsoft.graph.security.ipEvidence",
83+
"createdDateTime": "2025-09-18T15:14:17+0530333Z",
84+
"verdict": "compromised",
85+
"remediationStatus": "none",
86+
"remediationStatusDetails": null,
87+
"roles": [],
88+
"detailedRoles": [],
89+
"tags": [],
90+
"ipAddress": "168.119.168.251",
91+
"countryLetterCode": "IN"
92+
}
93+
]
94+
}
95+
```
96+
</details>
97+
98+
### Sample queries
99+
100+
```sql title="Total Alerts"
101+
_sourceCategory=Labs/MicrosoftGraphSecurity
102+
|json"id","status","severity","category","title","description","classification","determination","serviceSource","detectionSource","alertWebUrl" ,"comments[*]","evidence[*]"as alert_id,status,severity,category,title,description,classification,determination,service_source,detection_source,alert_url,comments,evidence_info nodrop
103+
104+
| where toLowerCase(service_source) = "azureadidentityprotection"
105+
106+
// global filters
107+
| where if ("*" = "*", true, severity matches "*")
108+
| where if ("*" = "*", true, status matches "*")
109+
| where if ("*" = "*", true, classification matches "*")
110+
111+
// panel specific
112+
| count by alert_id
113+
| count
114+
```
115+
116+
```sql title="High Severity Alerts"
117+
_sourceCategory=Labs/MicrosoftGraphSecurity
118+
|json"id","status","severity","category","title","description","classification","determination","serviceSource","detectionSource" ,"comments[*]","evidence[*]"as alert_id,status,severity,category,title,description,classification,determination,service_source,detection_source,comments,evidence_info nodrop
119+
120+
| where toLowerCase(service_source) = "azureadidentityprotection"
121+
122+
// global filters
123+
| where if ("*" = "*", true, severity matches "*")
124+
| where if ("*" = "*", true, status matches "*")
125+
| where if ("*" = "*", true, classification matches "*")
126+
127+
// panel specific
128+
| where toLowerCase(severity) matches ("*high*")
129+
| count by alert_id
130+
| count
131+
```
132+
133+
## Collection configuration and app installation
134+
135+
:::note
136+
- Skip this step if you have already configured the [Microsoft Graph Security API Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/).
137+
- Select **Use the existing source and install the app** to install the app using the `sourceCategory` of the Microsoft Graph Security API Source configured above.
138+
:::
139+
140+
import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';
141+
142+
<CollectionConfiguration/>
143+
144+
:::important
145+
Use the [Cloud-to-Cloud Integration for Microsoft Graph Security API](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Azure Security - Microsoft Entra ID Protection is properly integrated and configured to collect and analyze your Azure Security - Microsoft Entra ID Protection data.
146+
:::
147+
148+
### Create a new collector and install the app
149+
150+
import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';
151+
152+
<AppCollectionOPtion1/>
153+
154+
### Use an existing collector and install the app
155+
156+
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';
157+
158+
<AppCollectionOPtion2/>
159+
160+
### Use an existing source and install the app
161+
162+
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';
163+
164+
<AppCollectionOPtion3/>
165+
166+
## Viewing the Azure Security - Microsoft Entra ID Protection dashboards
167+
168+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
169+
170+
<ViewDashboards/>
171+
172+
### Overview
173+
174+
The **Azure Security - Microsoft Entra ID Protection - Overview** dashboard provides a comprehensive view of identity-related security risks and anomalies detected across Azure environments. It enables analysts to monitor risky sign-ins, user risk levels, and identity protection trends, ensuring timely detection and mitigation of potential account compromises.
175+
176+
With features like geo-location mapping and top user alerts, the dashboard supports regional risk assessment and detection of insider threats. By combining real-time insights with historical trends, it enhances situational awareness and strengthens incident response strategies.
177+
<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Entra+-ID-Protection/Azure+Security+-+Microsoft+Entra+ID+Protection+-+Overview.png' alt="Azure Security - Microsoft Entra ID Protection - Overview" />
178+
179+
### Security
180+
181+
The **Azure Security - Microsoft Entra ID Protection - Security** dashboard provides a comprehensive overview of identity-related threats within the organization, enabling teams to pinpoint where identity risks are concentrated and how they evolve over time. Visual trend panels display fluctuations in user and sign-in risk levels, helping analysts assess whether identity-based attacks are increasing and prioritize mitigation accordingly.
182+
183+
Key insights include compromised user accounts, frequently attacked devices, and countries linked to malicious IPs, enabling targeted defense strategies. By combining trend analysis with threat origins and user risk data, the dashboard empowers proactive threat response and strengthens overall security posture.
184+
<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Entra+-ID-Protection/Azure+Security+-+Microsoft+Entra+ID+Protection+-+Security.png' alt="Azure Security - Microsoft Entra ID Protection - Security" />
185+
186+
## Upgrade/Downgrade the Azure Security - Microsoft Entra ID Protection app (Optional)
187+
188+
import AppUpdate from '../../reuse/apps/app-update.md';
189+
190+
<AppUpdate/>
191+
192+
## Uninstalling the Azure Security - Microsoft Entra ID Protection app (Optional)
193+
194+
import AppUninstall from '../../reuse/apps/app-uninstall.md';
195+
196+
<AppUninstall/>

‎docs/integrations/microsoft-azure/index.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,12 @@ This guide has documentation for all of the apps that Sumo Logic provides for Mi
307307
<p>Learn about the Sumo Logic collection process for the Azure Security - Microsoft Defender for Office 365</p>
308308
</div>
309309
</div>
310+
<div className="box smallbox card">
311+
<div className="container">
312+
<a href="/docs/integrations/microsoft-azure/azure-security-microsoft-entra-id-protection"><img src={useBaseUrl('img/integrations/microsoft-azure/azure-security-microsoft-entra-id-protection.png')} alt="thumbnail icon" width="55"/><h4>Azure Security - Microsoft Entra ID Protection</h4></a>
313+
<p>Learn about the Sumo Logic collection process for the Azure Security - Microsoft Entra ID Protection.</p>
314+
</div>
315+
</div>
310316
<div className="box smallbox card">
311317
<div className="container">
312318
<img src={useBaseUrl('img/integrations/microsoft-azure/azure-service-bus.png')} alt="Thumbnail icon" width="60"/>

‎docs/integrations/microsoft-azure/microsoft-entra-id-protection.md‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

0 commit comments

Comments
 (0)