Microsoft Graph Security Alerts for Cross-Product Detection
This rule processes Microsoft Graph Security Alerts, aggregating evidence from various Microsoft Defender products (MDE, MDI, MDCA, MDO, Entra ID Protection). It extracts and normalizes detailed evidence related to devices, users, IP addresses, processes, files, URLs, emails, mailboxes, network connections, and Azure resources, providing a comprehensive view of security incidents across the Microsoft ecosystem.
Cortex XDR
