KQL Search

id: 1225bb11-96d0-40f0-9ad7-b460042e0a52
Function:
  Title: Parser for WorkloadIdentityInfo with enriched classification of EntraOps
  Version: '1.0.0'
  LastUpdated: '2023-11-11'
Category: Microsoft Sentinel Parser
FunctionName: PrivilegedWorkloadIdentityInfo
FunctionAlias: PrivilegedWorkloadIdentityInfo
FunctionQuery: |
        let SensitiveMsGraphPermissions = externaldata(EAMTierLevelName: string, Category: string, AppRoleDisplayName: string)["https://raw.githubusercontent.com/Cloud-Architekt/AzurePrivilegedIAM/main/Classification/Classification_AppRoles.json"] with(format='multijson');
        let SensitiveAadDirectoryRoles = externaldata(Classification: string, RolePermissions: string, Category: string, RoleId: string)["https://raw.githubusercontent.com/Cloud-Architekt/AzurePrivilegedIAM/main/Classification/Classification_EntraIdDirectoryRoles.json"] with(format='multijson') | mv-expand parse_json(RolePermissions)
        | summarize Category = make_list(RolePermissions.Category) by AadDirectoryRoleId = RoleId, AadDirectoryRoleTierLevel = tostring(parse_json(Classification).EAMTierLevelName);
        let SpWithAppRole = _GetWatchlist('WorkloadIdentityInfo')
        | mv-expand parse_json(AssignedAppRoles)
        | extend AppRoleDisplayName = tostring(AssignedAppRoles.AppRoleDisplayName)
        | extend ResourceDisplayName = tostring(AssignedAppRoles.ResourceDisplayName)
        | join kind=leftouter(
            SensitiveMsGraphPermissions | project AppRolePermissionTierLevel = EAMTierLevelName, Category, AppRoleDisplayName, ResourceDisplayName = "Microsoft Graph"
            ) on AppRoleDisplayName, ResourceDisplayName
        | where isnotempty(AppRoleDisplayName)    
        | summarize AppRolePermissions = make_set(AppRoleDisplayName), AppRolePermissionTierLevels = make_set(AppRolePermissionTierLevel) by ServicePrincipalObjectId;
        let SpWithDirectoryRole = _GetWatchlist('WorkloadIdentityInfo')
        | mv-expand parse_json(AssignedRoles)
        | extend AadDirectoryRoleId = tostring(AssignedRoles.RoleDefinitionId)
        | extend AadDirectoryRoleName = tostring(AssignedRoles.RoleDefinitionName)
        | join kind=leftouter(
            SensitiveAadDirectoryRoles
            ) on AadDirectoryRoleId
        | where isnotempty(AadDirectoryRoleName)    
        | summarize AadDirectoryRoles = make_set(AadDirectoryRoleName), AadDirectoryRoleTierLevels = make_set(AadDirectoryRoleTierLevel) by ServicePrincipalObjectId;
        _GetWatchlist('WorkloadIdentityInfo')
        | join kind=leftouter (
            union SpWithAppRole, SpWithDirectoryRole
            | summarize AppRolePermissions = make_set(AppRolePermissions), AppRolePermissionTierLevels = make_set(AppRolePermissionTierLevels), AadDirectoryRoles = make_set(AadDirectoryRoles), AadDirectoryRoleTierLevels = make_set(AadDirectoryRoleTierLevels) by ServicePrincipalObjectId
            ) on ServicePrincipalObjectId
        | extend Classification = iif((AppRolePermissionTierLevels contains "ControlPlane" or AadDirectoryRoleTierLevels contains "ControlPlane"), "ControlPlane", "Unclassified")
        | extend Classification = iif((Classification == "Unclassified" and (AppRolePermissionTierLevels contains "ManagementPlane" or AadDirectoryRoleTierLevels contains "ManagementPlane")), "ManagementPlane", Classification)
        | extend Classification = iif((Classification == "Unclassified" and (AppRolePermissionTierLevels contains "WorkloadPlane" or AadDirectoryRoleTierLevels contains "WorkloadPlane")), "WorkloadPlane", Classification)
        | extend Classification = iif((Classification == "Unclassified" and (AppRolePermissionTierLevels contains "UserAccess" or AadDirectoryRoleTierLevels contains "UserAccess")), "UserAccess", Classification)
        | project 
            WorkloadIdentityName = AppDisplayName,
            WorkloadIdentityType = ServicePrincipalType,
            IsFirstPartyApp,
            SignInAudience,
            UserAssignmentRequired,
            ServicePrincipalObjectId,
            ApplicationObjectId = tostring(AppObjectId),
            ApplicationId = AppId,
            EntraIdRoles = AadDirectoryRoles,
            AppRolePermissions,
            EnterpriseAccessModelTiering = Classification