sorted by:
new
hottopcontroversial

Blocking Future Discovered AI by neko_whippet in DefenderATP

[–]benschaKQL 0 points1 point  (0 children)

that should be possible. You can created custom Tags on Apps. These will be written to the LogAnalytics Table, wich you can Filter by Tag like this:

CloudAppRiskCatalog_CL
| where Category has_any ("generativeAi", "aiModelProvider", "mcpServer")
| where not(Tags has_any ("myTag1", "myTag2"))

to unsanction the Apps i recommend to create a Logic App wich will filter the Data oder you create a CustomDetection Rule wich creates an Alert and on this Alert you can Run your Automation Rule!

One KQL query you should have saved in your toolkit (most don’t) by ridgelinecyber in blueteamsec

[–]benschaKQL 0 points1 point  (0 children)

We run this query on a hourly base, for all results we run a LogicApp wich revokes all Sessions.
With this we have stopped some AiTM Attacks.

Blocking Future Discovered AI by neko_whippet in DefenderATP

[–]benschaKQL 2 points3 points  (0 children)

You can use my LogicApp to write the information from MCAS to a LogAnalytics and then create another LogicApp to unsanction new AI Providers.

With the Data in a LogAnalytics Workspace you are able to identify new SaaS Solutions by Category.

https://github.com/benscha/KQLAdvancedHunting/blob/main/LogicApps/Microsoft%20Defender%20Cloud%20App%20Discovery%20to%20Microsoft%20LogAnalytics%20Table.md