rezamt

let data = SigninLogs
    | where AppDisplayName in ('*') or '*' in ('*')
    | where UserDisplayName in ('*') or '*' in ('*')
    | extend errorCode = Status.errorCode
    | extend SigninStatus = case(errorCode == 0, "Success", errorCode == 50058, "Pending action (Interrupts)", errorCode == 50140, "Pending action (Interrupts)", errorCode == 51006, "Pending action (Interrupts)", errorCode == 50059, "Pending action (Interrupts)", errorCode == 65001, "Pending action (Interrupts)", errorCode == 52004, "Pending action (Interrupts)", errorCode == 50055, "Pending action (Interrupts)", errorCode == 50144, "Pending action (Interrupts)", errorCode == 50072, "Pending action (Interrupts)", errorCode == 50074, "Pending action (Interrupts)", errorCode == 16000, "Pending action (Interrupts)", errorCode == 16001, "Pending action (Interrupts)", errorCode == 16003, "Pending action (Interrupts)", errorCode == 50127, "Pending action (Interrupts)", errorCode == 50125, "Pending action (Interrupts)", errorCode == 50129, "Pending a

rezamt

| spath path=properties.status.errorCode output=errorCode 
| spath path=properties.status.failureReason output=failureReason 
| spath path=properties.userPrincipalName output=userPrincipalName 
| eval errorCode=tonumber(errorCode) 
| stats latest(properties.createdDateTime) as properties.createdDateTime, 
        latest(time) as time, 
        latest(errorCode) as last_errorCode, 
 values(failureReason) as all_failureReasons, 

rezamt

AADSTS Error Codes Categorized

User Account & Identity Issues

• AADSTS16000: User account doesn't exist in tenant and can't access the application. [cite: 1]
• AADSTS16003: User hasn't been explicitly added to the tenant. [cite: 9]
• AADSTS50014: User account doesn’t exist in the directory (Guest user in pending state). [cite: 59]
• AADSTS50015: User requires legal age group consent. [cite: 62]
• AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application. [cite: 66]
• AADSTS50034: User account not found; account must be added to the directory. [cite: 79]
• AADSTS50053: Account is locked (too many incorrect sign-in attempts) or sign-in blocked from malicious IP. [cite: 86, 87]

rezamt

DeepSearch Critical Error Codes to Monitor:

AADSTS50000 - TokenIssuanceError (Sign-in service issue)

AADSTS50001 - InvalidResource (Resource disabled or doesn't exist)

AADSTS50053 - IdsLocked (Account locked due to suspicious activity)

AADSTS50055 - InvalidPasswordExpiredPassword (Password expired)

rezamt

index=your_index_name sourcetype="your_sourcetype" IsInteractive=true
| eval week=strftime(_time, "%U"), day=strftime(_time, "%Y-%m-%d")
| eval Result=if(ResultType="0", "Success", "Failure")
| eval weekLabel=case(relative_time(now(), "@w0") <= _time, "This Week", relative_time(now(), "-1w@w0") <= _time AND _time < relative_time(now(), "@w0"), "Last Week", "Other")
| search weekLabel="This Week" OR weekLabel="Last Week"
| stats count by day, weekLabel, Result
| eval Label=case(Result="Success" AND weekLabel="This Week", "Current Success",
                  Result="Failure" AND weekLabel="This Week", "Current Failure",
                  Result="Success" AND weekLabel="Last Week", "Success Trend (Last Week)",
                  Result="Failure" AND weekLabel="Last Week", "Failure Trend (Last Week)")

rezamt

$gpoList = Get-CsvData -FilePath "gpo-data.csv"

$gpoList| foreach {

    $gpo = Get-GPO -Guid $_.ID
    
    # Write-Output "$($gpo.Id),$($gpo.DisplayName),$($gpo.Owner)"
    $gpo

}

rezamt

Lookup invalid Authenication Method

| makeresults count=6
| streamstats count as _n
| eval method=case(
    _n=1,"Windows Hello for Business",
    _n=2,"Microsoft Authenticator push",
    _n=3,"Pincode",
 _n=4,"Microsoft Authenticator push",

rezamt

https://nicolasuter.medium.com/why-you-should-use-entra-workload-identity-federation-dfe8b6b626a1

When can I use Workload Identity Federation?

Which scenarios support “Workload identity Federation”?

• Workloads running on any Kubernetes cluster (Azure Kubernetes Service (AKS), Amazon Web Services EKS, Google Kubernetes Engine (GKE), or on-premises)
• GitHub Actions (CI / CD Pipelines) [2]
• GitLab (CI / CD Pipelines) [3]
• Workloads / VMs Google Cloud
• Workloads / VMs running in Amazon Web Services (AWS)

rezamt

# Framework

# Reference Architecture 
https://www.youtube.com/watch?v=1fjXNfIysbg&t=2612s

rezamt

Enforcing signed SAML authentication requests offers several key benefits:

Enhanced Security:

By requiring signed requests, you ensure that the authentication requests are coming from a trused source. This helps prevent unauthorized access and reduces the risk of man-in-the-middle attacks1.

Data Integrity:

Signed requests guarantee that the data within the authentication request has not been tampered with during transmission. This ensures the integrity of the authentication process1.

Compliance:

Many regulatory frameworks and security standards require the use of signed authentication requests to ensure secure data exchange. Enforcing signed requests helps organizations meet these compliance requirements1.