Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
1
1
MITRE Techniques
1
1
1
Detects PIM role activations and eligible or active role assignments that involve Entra agent users. Agents are identified by agentType, blueprintId or a maintained UPN list.
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
