How to filter specific events from use case?

[AidanMarkSmith]

Hi All,

We have turned on the Use Case - ESCU 0365 Authentication Failures Alert

We need this turned on in order to assess risky logins, however due to the nature of the company (being a University) we have alot of old unused Alumni accounts that we cannot get rid of.

The issue we are running into is that the risk scores of some of these accounts are consistently rising causing a consistent volume of Highs. 

We have found that the accounts are trying to login via the user agent BAV2ROPC which is the Azure User Agent for Legacy Authentication (IMAP, POP3 etc)

We have tried adding these users to a conditional access policy in Azure to prevent these Authentication attempts but that has not worked.

The question I am asking is, is there any possible way in the Use Case search to specifically filter our BAV2ROPC so we do not constantly get these alerts as they are causing alot of noise within our search and it is making it difficult to find actual attempts to access users accounts.

This is our Correlation Search for this use case

index=appext_o365 `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`

[richgalloway]

I should think it's a matter of testing the UserAgent value.

index=appext_o365 `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure UserAgent!="BAV2ROPC"
| stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
| where count > 10 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_excessive_authentication_failures_alert_filter`