Azure AD Identity Protection Integration custom filter

kbratt — Fri, 13 May 2022 00:15:45 GMT

I have the AZ AD Identity Protection integration setup and working, but I am trying to get some custom filters to work without much luck. Does anyone have an example of what OData queries are relevant with this integration?

Would like to be able to filter_expression to something like risklevel=high but everything I try comes back with a "Invalid filter clause
"

I don't see any examples with filters in the documentation.

This is from the filter tips: A custom query in OData syntax. Using this overrides all arguments, except for next_link. For more information, see https://docs.microsoft.com/en-us/graph/query-parameters.

Re: Azure AD Identity Protection Integration custom filter

jfernandes1 — Fri, 13 May 2022 01:28:09 GMT

Hi @kbratt,

Could you try something like this

riskLevel eq 'medium' or riskLevel eq 'high'

Re: Azure AD Identity Protection Integration custom filter

kbratt — Fri, 13 May 2022 15:43:07 GMT

Looks so simple ! Thanks, that is working great

topic Re: Azure AD Identity Protection Integration custom filter in Cortex XSOAR Discussions

Azure AD Identity Protection Integration custom filter

Re: Azure AD Identity Protection Integration custom filter

Re: Azure AD Identity Protection Integration custom filter