Multiple Impossible Travel Activity Alerts

Query

// https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
let query_frequency = 5m;
let query_period = 2d;
AADUserRiskEvents
| where TimeGenerated > ago(query_period)
| where Source == "MicrosoftCloudAppSecurity" and RiskEventType == "mcasImpossibleTravel"
| summarize FirstTimeGenerated = min(TimeGenerated), arg_max(TimeGenerated, *) by Id
| where FirstTimeGenerated > ago(query_frequency)
| mv-apply Auxiliar = AdditionalInfo on (
    summarize AdditionalInfoBag = make_bag(bag_pack(tostring(Auxiliar["Key"]), Auxiliar["Value"]))
    )
| extend VendorOriginalId = tostring(split(tostring(AdditionalInfoBag["alertUrl"]), "/")[-1])
| project
    //TimeGenerated,
    ActivityDateTime,
    DetectedDateTime,
    Source,
    Activity,
    DetectionTimingType,
    UserDisplayName,
    UserPrincipalName,
    UserId,
    IpAddress,
    RequestId,
    CorrelationId,
    TokenIssuerType,
    RiskEventType,
    RiskDetail,
    RiskLevel,
    RiskState,
    AdditionalInfo,
    Id,
    VendorOriginalId
| extend AltAlertLink = strcat("https://entra.microsoft.com/#blade/Microsoft_AAD_IAM/RiskDetectionsBlade/riskState~/[]/userId/", UserId, "/riskLevel/[]/daysBack/90")// Someone wrote "90s" incorrectly in Defender XDR portal
| join kind=leftouter (
    SecurityAlert
    | where ProviderName == "MCAS" and ProductName == "Microsoft Cloud App Security" and AlertType == "MCAS_ALERT_ANUBIS_DETECTION_VELOCITY"
    | summarize arg_max(TimeGenerated, *) by VendorOriginalId
    | project
        AlertName,
        AlertSeverity,
        Description,
        AlertStatus = Status,
        Entities,
        ExtendedProperties,
        VendorName,
        ProviderName,
        ProductName,
        ProductComponentName,
        RemediationSteps,
        Tactics,
        Techniques,
        SubTechniques,
        VendorOriginalId,
        SystemAlertId,
        CompromisedEntity,
        AlertLink
    ) on VendorOriginalId
| extend
    AlertLink = coalesce(AlertLink, AltAlertLink),
    ExtendedPropertiesDynamic = todynamic(ExtendedProperties)
| extend
    CloudApplications = split(ExtendedPropertiesDynamic["Cloud Applications"], ", "),
    IPAddresses = split(ExtendedPropertiesDynamic["IP Addresses"], ", "),
    Countries = split(ExtendedPropertiesDynamic["Countries"], ", ")
| as _Events
| lookup kind=leftouter (
    union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(query_period)
    //| where RiskEventTypes_V2 has "mcasImpossibleTravel"
    | where OriginalRequestId in (toscalar(_Events | summarize make_list(RequestId)))
    | extend TimeReceived = _TimeReceived
    | summarize arg_max(TimeReceived, *) by OriginalRequestId
    | invoke UnifySignInLogs()
    | project
        TimeGenerated,
        CreatedDateTime,
        Type,
        //UserDisplayName,
        //UserPrincipalName,
        //UserId,
        AlternateSignInName,
        SignInIdentifier,
        UserType,
        IPAddress,
        AutonomousSystemNumber,
        Location,
        NetworkLocationDetails,
        ResultType,
        ResultSignature,
        ResultDescription,
        ClientAppUsed,
        AppDisplayName,
        ResourceDisplayName,
        DeviceDetail,
        UserAgent,
        Status,
        MfaDetail,
        AuthenticationContextClassReferences,
        AuthenticationDetails,
        AuthenticationProcessingDetails,
        AuthenticationProtocol,
        AuthenticationRequirement,
        AuthenticationRequirementPolicies,
        SessionLifetimePolicies,
        //TokenIssuerType,
        IncomingTokenType,
        TokenProtectionStatusDetails,
        ConditionalAccessStatus,
        ConditionalAccessPolicies,
        SignInLogs_RiskDetail = RiskDetail,
        RiskEventTypes,
        RiskEventTypes_V2,
        RiskLevelAggregated,
        RiskLevelDuringSignIn,
        SignInLogs_RiskState = RiskState,
        HomeTenantId,
        ResourceTenantId,
        CrossTenantAccessType,
        AppId,
        ResourceIdentity,
        UniqueTokenIdentifier,
        SessionId,
        OriginalRequestId//,
        //CorrelationId
    ) on $left.RequestId == $right.OriginalRequestId
| where case(
    // AlertStatus == "Resolved" and tostring(todynamic(ExtendedProperties)["State"]) == "Closed", false,
    SignInLogs_RiskState == "dismissed" and SignInLogs_RiskDetail == "aiConfirmedSigninSafe", false,
    SignInLogs_RiskState == "remediated" and SignInLogs_RiskDetail == "userPassedMFADrivenByRiskBasedPolicy", false,
    true
    )
| project
    //TimeGenerated,
    ActivityDateTime,
    DetectedDateTime,
    Source,
    Activity,
    DetectionTimingType,
    UserDisplayName,
    UserPrincipalName,
    UserId,
    IpAddress,
    RequestId,
    CorrelationId,
    TokenIssuerType,
    RiskEventType,
    RiskDetail,
    RiskLevel,
    RiskState,
    AdditionalInfo,
    Id,
    AlertName,
    AlertSeverity,
    Description,
    AlertStatus,
    Entities,
    ExtendedProperties,
    VendorName,
    ProviderName,
    ProductName,
    ProductComponentName,
    RemediationSteps,
    Tactics,
    Techniques,
    SubTechniques,
    VendorOriginalId,
    SystemAlertId,
    CompromisedEntity,
    AlertLink,
    TimeGenerated,
    CreatedDateTime,
    Type,
    //UserDisplayName,
    //UserPrincipalName,
    //UserId,
    AlternateSignInName,
    SignInIdentifier,
    UserType,
    IPAddress,
    AutonomousSystemNumber,
    Location,
    NetworkLocationDetails,
    CloudApplications,
    IPAddresses,
    Countries,
    ResultType,
    ResultSignature,
    ResultDescription,
    ClientAppUsed,
    AppDisplayName,
    ResourceDisplayName,
    DeviceDetail,
    UserAgent,
    Status,
    MfaDetail,
    AuthenticationContextClassReferences,
    AuthenticationDetails,
    AuthenticationProcessingDetails,
    AuthenticationProtocol,
    AuthenticationRequirement,
    AuthenticationRequirementPolicies,
    SessionLifetimePolicies,
    //TokenIssuerType,
    IncomingTokenType,
    TokenProtectionStatusDetails,
    ConditionalAccessStatus,
    ConditionalAccessPolicies,
    SignInLogs_RiskDetail,
    RiskEventTypes,
    RiskEventTypes_V2,
    RiskLevelAggregated,
    RiskLevelDuringSignIn,
    SignInLogs_RiskState,
    HomeTenantId,
    ResourceTenantId,
    CrossTenantAccessType,
    AppId,
    ResourceIdentity,
    UniqueTokenIdentifier,
    SessionId//,
    //OriginalRequestId,
    //CorrelationId

Explanation

This query is designed to detect and analyze "impossible travel" risk events in Microsoft Cloud App Security (MCAS) and correlate them with sign-in logs. Here's a simplified breakdown of what the query does:

Define Time Periods: It sets a query frequency of 5 minutes and a query period of 2 days.
Filter Risk Events: It looks for "impossible travel" risk events in the AADUserRiskEvents table that were generated within the last 2 days and are sourced from Microsoft Cloud App Security.
Summarize Events: It summarizes these events to find the first occurrence and the most recent details for each unique event ID.
Extract Additional Info: It processes additional information from these events to extract a unique identifier (VendorOriginalId) from the alert URL.
Project Relevant Fields: It selects specific fields to keep for further analysis, including user and risk details.
Generate Alternative Alert Link: It creates an alternative alert link for each event.
Join with Security Alerts: It joins the summarized risk events with related security alerts from the SecurityAlert table, matching them by the VendorOriginalId.
Extend Alert Details: It extends the data with additional alert details, such as alert name, severity, and description.
Parse Extended Properties: It parses extended properties to extract lists of cloud applications, IP addresses, and countries involved in the alerts.
Join with Sign-In Logs: It joins the events with sign-in logs (SigninLogs and AADNonInteractiveUserSignInLogs) to correlate risk events with sign-in activity.
Filter Out Resolved or Safe Events: It filters out events that have been resolved or deemed safe based on specific risk states and details.
Final Projection: It projects a comprehensive list of fields for the final output, including user details, risk information, alert details, and sign-in information.

In summary, this query identifies and analyzes "impossible travel" risk events, correlates them with security alerts and sign-in logs, and filters out resolved or safe events to provide a detailed view of potential security incidents.

Details

Jose Sebastián Canós

Released: September 26, 2025

Tables

AADUserRiskEventsSecurityAlertSigninLogsAADNonInteractiveUserSignInLogs

Keywords

AADUserRiskEventsMicrosoftCloudAppSecuritySecurityAlertSigninLogsAADNonInteractiveUserSignInLogsUserRiskEventAlertIPAddressDeviceApplicationNetworkLocationAuthenticationTokenAccessTenantSession

Operators

letago|where==summarizeminarg_maxbymv-applymake_bagbag_packextendtostringsplitprojectstrcatjoinkind=leftoutercoalescetodynamicaslookupunionintoscalarinvokecasetruefalse

Actions

GitHub

KQL Search