MDCA improvement - Githubissues

briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)

https://aka.ms/mstat

MIT License

8 stars 1 forks source link

MDCA improvement #45

Closed piaudonn closed 9 months ago

piaudonn commented 9 months ago

Added additional checks:

Check if the user's score is trending up (adding a function data.py to calculate the slope)
Check if the user is in the top 10 score on the tenant (or top X provided as TopUserThreshold input to the module)
Retrieve the user's last score ranking percentile

Those are done for each user and then summarized in the following global properties in the returned mdca_object:

HighestScorePercentile - the highest latest percentile
TopUserThresholdCount - return how many users in the incidents are in the top 10 (or top X)
AnyThreatScoreTrendingUp - return if any user's score is trending up

Fixes #44

piaudonn commented 9 months ago

@briandelmsft what do you think?