Map Microsoft Entra ID telemetry logs to detection patterns.
npx skills add https://github.com/OpenTideHQ/AgentTide --skill entra-id
Please help me install this Agent Skill. Skill: entra-id Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/entra-id Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill entra-id
Microsoft Entra ID knowledge for detection engineers to understand architecture, telemetry surfaces, risk signals, and attack patterns across SigninLogs, AuditLogs, and cross-tenant scenarios.
Analyze a risky sign-in by mapping SigninLogs, NonInteractiveUserSignInLogs, and AuditLogs to investigate.
High-intent search queries and answers about installing and using this skill.
Entra ID sign-in telemetry mapping structures SigninLogs, NonInteractiveUserSignInLogs, and AuditLogs to identify risk signals, policy evaluations, and attack patterns for detection engineering. It covers tenant architecture, workload identities, and MFA surfaces.
Identity risk analysis in Entra ID requires SigninLogs, NonInteractiveUserSignInLogs, AuditLogs, ManagedIdentitySignInLogs, and ServicePrincipalSignInLogs. These canonical log categories capture user, workload identity, and service principal activity along with associated risk signals.
Cross-tenant scenarios and Conditional Access evaluation are supported through architectural overviews and detection enrichment guidance tailored for multi-tenant deployments. It maps identity protection concepts and policy evaluations across tenant boundaries.
Investigating a risky sign-in involves mapping SigninLogs, NonInteractiveUserSignInLogs, and AuditLogs to correlate risk signals with Conditional Access policy evaluations. This approach identifies anomalous authentication patterns and workload identity abuses.
ManagedIdentitySignInLogs capture telemetry for workload identities using managed authentication, while ServicePrincipalSignInLogs record authentications for explicitly configured app identities. Both provide distinct risk signals and detection surfaces for non-human access.
Documenting Entra ID architecture and telemetry surfaces is fully supported, covering tenants, users, service principals, and MFA risk surfaces. It satisfies requirements for mapping log categories, risk usage, and cross-platform alignment guidance.
SCStelzDetect and quantify scope drift across Entra ID service principals and user accounts.
patrykkopycinskiAutomate Elastic alerting, ingest pipelines, security detection, and Agent Builder integrations.
SCStelzAutomate security investigations for Entra ID and Defender for Endpoint devices.
YukiIto1999Query Azure Monitor activity and sign-in logs to surface suspicious operations.
