Entra ID sign in/audit logs custom rules

[håkon haakensen]

Hi Team! 
I have made a custom ingestion pipeline to ingest entra ID sign in logs/audit logs to wazuh. before i make my own rules to trigger on these events i was wondering if someone already did it and might have postet the rules somewhere?

I have seatched around, but cant seem to find any rules related to entra ID sign in/audit.

[malena...@wazuh.com]

Hello Hakon!
Wazuh has no rules or decoders to generate events from EntraID logs. However, I have found this decoder and rules made by a user:
https://github.com/yunusmrcoban/wazuh-custom/blob/main/EntraID/EntraID_decoder.xml

It is important to clarify that this documentation is not official, we have not tested it, nor analyzed it. It is your responsibility to use them.

I hope you find them useful. Good luck!

[håkon haakensen]

Thank you! I will look into that.