security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Tuning Azure Service Principal Credentials Added (#4570)

Browse Source 
* tuning 'Azure Service Principal Credentials Added'

* updated patch version

* added investigation guide

* updating patch version

* updating patch version
This commit is contained in:
Terrance DeJesus
2025-04-16 13:58:17 -04:00
committed by GitHub
parent 1a6669e5a6
commit ba16e27edb
8 changed files with 235 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_rules/etc/non-ecs-schema.json
+1
View File
@@ -173,6 +173,7 @@
"logs-azure.signinlogs-*": {
"azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword",
"azure.signinlogs.properties.original_transfer_method": "keyword",
"azure.auditlogs.properties.target_resources.0.display_name": "keyword",
"azure.signinlogs.properties.authentication_details.authentication_method": "keyword"
},
"logs-azure.activitylogs-*": {