Reduce Noise from AAD Non Interactive SignIns

Introduction

As a part Azure Active Directory Data Connector in Sentinel, AADNonInterectiveSigniInLogs is one of the data sources.

As this table logs data where mostly no user intervention is needed so any error is also kept as a known secret. And in that process the

1. The volume of failed logs is increased
2. The error gets unnoticed and leads towards an unhealthy environment

Design

To avoid this, we can approach this problem in parallel 2 branches

1. Identify Top Application where Login failures are taking place.
2. Identify Top Users for whom failed logs are getting generated.

Each can be verified with a query / KQL Function

1. Top10NonInteractiveSigninFailedApps
2. Top10NonInteractiveSigninFailedUsers

Query/ KQL Function

Below has the queries which can be applied / used through this approach.

Top10NonInteractiveSigninFailedApps

AADNonInteractiveUserSignInLog
| extend ErrorCode = tostring(parse_json(Status).errorCode)
| summarize TotalLogins = count(),
SuccessfulLogins = countif(ErrorCode == 0),
FailedLogins = countif(ErrorCode != 0),
Users = make_set(UserPrincipalName)
by AppDisplayName, ClientAppUsed
| where FailedLogins > 0
| project UserCount = array_length(Users),AppDisplayName, ClientAppUsed
| take 10
| render columnchart        

Top10NonInteractiveSigninFailedUsers

AADNonInteractiveUserSignInLog
| extend ErrorCode = tostring(parse_json(Status).errorCode)
| summarize TotalLogins = count(),
SuccessfulLogins = countif(ErrorCode == 0),
FailedLogins = countif(ErrorCode != 0),
Apps = make_set(AppDisplayName),
ClientApps = make_set(ClientAppUsed)
by UserPrincipalName
| where FailedLogins > 0
| order by FailedLogins desc
| project-away TotalLogins
| take 10
| render columnchart        

Source Code

You can leverage the below source code to save this as a function in the workspace.

Please use the below button to deploy to your Sentinel Workspace and follow the deployment steps below

Deployment

Step 1: Fill the deployment form.

Step 2: Confirm the deployment in the workspace

Conclusion

Once the deployment is complete, the function can be referred in Hunting Queries, Analytic Rules, Workbooks for various use cases.

Now you will have access to top 10 Apps & Users with failed Signins a function call away in your workspace once you deploy the solution.

Feel free to extend with your thoughts !!!