Add Azure AD Entra ID identity attack detections (3 analytics) - #4091

Open

descambiado wants to merge 12 commits into

splunk:developfrom

descambiado:add-entra-id-identity-attack-detections

Commits on May 20, 2026

Add detection: Azure AD Temporary Access Pass created
descambiado
committed
1723873
Add detection: Azure AD guest user type changed to member
descambiado
committed
510413f
Add detection: Azure AD federated identity credential added to SP
descambiado
committed
edeb988

Commits on May 22, 2026

fix: resolve appinspect failures in Entra ID detections
descambiado
committed
1ca3d62

Commits on Jun 4, 2026

Merge branch 'develop' into add-entra-id-identity-attack-detections
ljstella
authored
d0bdc1e

Commits on Jun 13, 2026

Commits on Jun 17, 2026

Commits on Jun 19, 2026

fix: use targetSpName as intermediate entity to avoid double-scoring actor (v6.0 EventBasedDetection)
descambiado
committed
6c8e904