Post

🚀🔎 Track Sensitive Graph API Calls with my new #KQL Function for #MicrosoftDefenderXDR Microsoft has released the new advanced hunting table "GraphAPIAuditEvents" which offers great opportunities to investigate activities based on #MicrosoftGraph API calls.

I've created an experimental KQL function that enriches the data with details from #ExposureManagement and #EntraOps. This might help identify sensitive Graph Calls from the large volume of events in this table. 🔗 The query is available here: github.com/Cloud-Archit...

In the following example, several indicators are included that make this particular call interesting for further investigation: 1. IsSensitiveCaller 🗣️ A regular enterprise user (based on Exposure Management Critical Asset information) is calling Graph.

2. IsHighSensitiveScope 🔑 However, the scope includes Application.ReadWrite.All, which has been identified as "Control Plane" by using EntraOps classification model.

3. IsSensitiveAction ▶️ The Graph request includes a POST to the servicePrincipal endpoint, which is flagged as a sensitive modification. This logic is experimental and simplified, so it may result in inaccurate classification and should be used in combo with others indicators.