How to create Playbook and automation rules for M365 Defender for Identity, Endpoint, Cloud Apps, an
How to create Playbook and automation rules for M365 Defender for Identity, Endpoint, Cloud Apps, and Data as we wanted to do some automation around it to let SOAR work on the alerts which are on "Low", "Medium" severity alerts? For example: if we have many alerts those should be verified by that respective automation rule and take the appropriate actions like close those alerts or mark as no action needed.
How to compare a array values in a column against another array from a watchlist in Kusto
I am getting results with a column named IPAddresses having values in array. I want to compare each value in this array to a list (another array from a watch list). I have been trying to make use of mv-apply but with no success, can any guide me in this. Here is my code snippet: let timeframe = ago(3h); let threshold = 2; let ZSwatchlist = (_GetWatchlist('zscaler') | project SearchKey); let zarray = (ZSwatchlist | summarize zlist = make_list(SearchKey)); let users = (imAuthentication | where TargetUserType != 'ServicePrincipal' | where TimeGenerated > timeframe | where EventType == 'Logon' and EventResult == 'Success' | where isnotempty(SrcGeoCountry) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Vendors=make_set(EventVendor), Products=make_set(EventProduct), Countries = make_set(SrcGeoCountry), IPAddresses = make_set(SrcDvcIpAddr) , NumOfCountries = dcount(SrcGeoCountry) by TargetUserId, TargetUsername, TargetUserType); users | mv-apply ipscaler=toscalar(IPAddresses) to typeof(string) on( where not(ipv4_is_in_range(IPAddresses,zarray)) )
