Microsoft Graph
Package Details
Microsoft Graph API consists of the following components:
- Universal REST API Fetcher
- MicrosoftGraphFetcher
- Compiled Normalizer
- MicrosoftGraphCompiledNormalizer
- Search Templates
- Entra ID Identity Protection
- Defender XDR Security
- Dashboards
- LP_DEFENDER XDR ALERTS
- LP_DEFENDER XDR INCIDENTS
- LP_ENTRA ID IDENTITY PROTECTION
- Alerts
- LP_Microsoft Defender XDR - High Severity Alert
- LP_Microsoft Defender XDR - Host Generating Multiple Alerts
- LP_Microsoft Defender XDR - Multiple Alerts Involving Same User
- LP_Microsoft EntraID - User at Risk
- LP_Potentially Unwanted Software Detected
- Report Template
- Entra ID Audit Activity Monitoring
Enhancements
Enhanced normalization for Microsoft Graph directory audit logs by extracting key fields from targetResources and additionalDetails at ingestion time for Role Management and Application Management events:
user_agent,source_addressresource_id,resource_display_name,resource_upn,resource_type,resource_group_typeModified property values:
application_address,display_name,publisher_domain,service_principal_name,is_account_enabled
This removes the need for runtime JSON parsing, improving alert and dashboard performance, and requires no configuration changes after upgrade.
Bug Fixes
log_ts field in Microsoft Graph normalized logs was mapped to lastUpdatedDateTime rather than the actual event occurrence time, causing alerts and incidents to appear in incorrect time buckets.
Pagination Key for alerts_v2 and had an incorrect date format for riskDetections, causing log ingestion issues.
log_ts field in Microsoft Graph normalized logs was mapped to the log collection time rather than the createdDateTime value from the source log, resulting in inaccurate event timestamps.
Past Releases
Microsoft Graph v5.3.1 ▾
Bug Fix
Microsoft Graph v5.3.0 ▾
Enhancement
MicrosoftGraphCompiledNormalizer is updated to map the following Microsoft Graph fields to the Logpoint fields.
-
accountNametoaccount -
domainNametodomain -
userSidtouser_sid -
fileNametofile -
filePathtofile_path -
ipAddresstosource_address
Microsoft Graph v5.2.0 ▾
Enhancements
Microsoft Graph now includes two new endpoints:
- auditLogs/directoryaudits
- auditLogs/signIns
for collecting logs from Microsoft Entra ID, previously Azure Active Directory.
To learn more, go to Microsoft Graph.
Microsoft Graph now includes Dashboards, Search Templates, Alerts, and a Report Template, providing deeper insights into Microsoft Graph activities and security events.
To learn more, go to Microsoft Graph Analytics.
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.