AzureAD Updated Detections

[mvelazc0]

Details

This PR updates 25 Azure AD detections to use the latest schema provided by the Splunk Add-on for Microsoft Cloud Services in its latest versions.

Updated Detections

• Azure AD Global Administrator Role Assigned
• Azure AD Multiple Users Failing To Authenticate From Ip
• Azure AD Service Principal Owner Added
• Azure AD Unusual Number of Failed Authentications From Ip
• Azure AD Service Principal Created
• Azure AD Privileged Role Assigned
• Azure AD Privileged Authentication Administrator Role Assigned
• Azure AD Application Administrator Role Assigned
• Azure AD Multi-Factor Authentication Disabled
• Azure AD External Guest User Invited
• Azure AD User Enabled And Password Reset
• Azure AD Service Principal New Client Credentials
• Azure AD New Federated Domain Added
• Azure AD New Custom Domain Added
• Azure AD Successful Single-Factor Authentication
• Azure AD Authentication Failed During MFA Challenge
• Azure AD Successful PowerShell Authentication
• Azure AD Multiple Failed MFA Requests For User
• Azure AD User ImmutableId Attribute Updated
• Azure Active Directory High Risk Sign-in

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.