Elastic Security Detection Rules

Entra ID Protection Alerts for User Detected

Last updated 22 days ago on 2025-12-10
Created 8 months ago on 2025-04-30

About

Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account.
Tags
Domain: CloudData Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Protection LogsUse Case: Identity and Access AuditTactic: Initial AccessLanguage: eql
Severity
high
Risk Score
73
MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-azure.identity_protection-*
Related Integrations

azure(external, opens in a new tab or window)

Query
text code block:
sequence by azure.identityprotection.properties.user_principal_name with maxspan=10m
[any where event.module == "azure" and event.dataset == "azure.identity_protection"] with runs=2

Install detection rules in Elastic Security

Detect Entra ID Protection Alerts for User Detected in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).