C
Chris Ba
We are trying to set up alerts to detect and alert us when a new app is added with admin permissions. Huntress ITDR alerted on a new eM Client addition but it got us thinking how we can alert us when other apps are added by Admins, just as an additional metric for our team.
Our Huntress SIEM ES|QL queries that use
DISSECT
fail with
"Failed to parse query: Pipeline splitting is not enabled"
, in both the SIEM portal and the
/v1/siem/query
API.
Please enable pipeline splitting (
DISSECT
) for ES|QL in the SIEM.
Use case: a scheduled ITDR query that extracts the Entra application name from itdr.Target.ID on consent and service-principal events. If DISSECT can't be enabled, can EVAL/RENAME be enabled instead? Both currently return server errors.
Current Query that work, but does not provide the App name as its own column. Though it is visible in the
itdr.Target.ID
field, it is surrounded by other not useful data.
FROM logs | WHERE event.provider == "ITDR" AND itdr.Operation IN ("Consent to application.","Add delegated permission grant.","Add app role assignment to service principal.","Add service principal credentials.") | KEEP @timestamp, itdr.Operation, itdr.UserId, itdr.Target.ID, itdr.ObjectId