briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)
https://aka.ms/mstat
MIT License
9 stars 1 forks source link

Add AADRisks and MDCA #3

Closed piaudonn closed 1 year ago

piaudonn commented 1 year ago

Add support of the modules AADRisks and MDCA (MCAS).

Note the following change in the schema for the AADRisks. For input, we add the following property

SuspiciousActivityReportLookup > Boolean

For output, there are two changes. One in the rolled up object:

SuspiciousActivityReportTotalCount >Int (or null)

And one in the nested DetailedResults:

SuspiciousActivityReportCount > Int (or null)