Analytic rule not working properly

[UNOBeheer]

The rule "Detections/SigninLogs/AuthenticationAttemptfromNewCountry.yaml" detects sign-ins from microsoft ip addresses and creates a incident. But the correct ip subnet with prefix is mention in the included JSON file. Sentinel wil create a incident with the microsoft ip addresses.

create a sign-in from a microsoft ip and run the rule.

[v-rusraut]

Hi @UNOBeheer, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-rusraut]

Hi @UNOBeheer, please provide more details about the issue. You mentioned that it created an incident with the Microsoft IP address; please provide more information about this as well.

[v-rusraut]

Hi @UNOBeheer,
We are waiting for response.

[v-rusraut]

Hi @UNOBeheer , Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond to it in the next 2 days. If we don't receive a response by 05-10-2024 date, we will be closing this issue.
Thanks!

[UNOBeheer]

Hello @v-rusraut,

The rule detects 95% off the time sign-ins within the non-interactive sign-in logs from Microsoft IP's. Within the screenshot that I previously submitted you see the events off 1 incident and it shows the Microsoft ip addresses.
When I investigate the incident I see Hybrid joined laptops within the sign-in event and when i search the ip on virustotal the Autonomous System Label is Microsoft. An example: https://www.virustotal.com/gui/ip-address/20.91.233.82/details
If I search in the json file thats included in the rule I see the subnet "20.91.128.0/17". The detected IP address falls within this /17 subnet and should therefore not appear in the incident.

We running de following analytic rule template version: 1.1.2

Do you need more information or is this enough for you?

Yours sincerely,
Boris

[v-rusraut]

Hi @UNOBeheer,
As we verify, the IP address from incident 20.91.233.82 is different from the addressPrefixes mentioned in the JSON file 20.91.128.0. The third digit (host) is different, which is why the incident was created.

[UNOBeheer]

Hello @v-rusraut
Sorry but a /17 network includes 32768 ip addresses, this ip is within the range. Please fix it.

[v-rusraut]

Hi @UNOBeheer,
We are working with respective team, we will update you.

[v-rusraut]

Hi @praveenthepro , please help on this issue .

[praveenthepro]

@v-rusraut , Started working on it, will keep you updated

[praveenthepro]

The service tags json file used for exceptions in this alert was outed which is the root cause of this false positives, Raised the PR for updating the json, microsoft/mstic#33, Which will fix the issue.

[v-rusraut]

Hi @UNOBeheer , The PR raised by Praveen has been merged. Please check if your issue is resolved so we can close it.