EQL querry (Missing IP Info)

[dhyey0112]

I’m building an Elastic detection rule to identify when a user logs in and subsequently modifies their MFA (StrongAuthenticationMethod). The goal is to detect suspicious activity patterns like: Account compromise followed by MFA change Bypassed MFA protections

A login event Followed by a change in MFA configuration for the same user

sequence by related.user [any where event.action == "UserLoggedIn"] [any where event.action == "modified-user-account" and o365.audit.ModifiedProperties.StrongAuthenticationMethod.NewValue != null]

What I’ve Tried: -Checked the raw document structure for event.action: "modified-user-account" -Queried all IP-related fields: source.ip, client.ip, o365.audit.ClientIP -Confirmed that UserLoggedIn events do contain the IP

Example Missing Field(s): -source.ip -client.ip -o365.audit.ClientIP

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[banderror]

@Mikaayenson I'm transferring this issue to https://github.com/elastic/detection-rules in case our team would be willing to help here and this could be considered a candidate for prebuilt rules.

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic[bot]]

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.