Update the Analytic rule.

Changes
- Added join kind
- Streamlined usage of parse_json

Solutions/Cloud Identity Threat Protection Essentials/Analytic Rules/MFADisable.yaml

@@ -24,17 +24,20 @@ query: |
  (union isfuzzy=true
  (AuditLogs
  | where OperationName =~ "Disable Strong Authentication"
- | extend IPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
- | extend InitiatedByUser = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)),
-  tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))
+ | extend _parsedIntiatedByUser = parse_json(tostring(InitiatedBy.user))
+ | extend _parsedIntiatedByApp = parse_json(tostring(InitiatedBy.app))
+ | extend IPAddress = tostring(_parsedIntiatedByUser.ipAddress)
+ | extend InitiatedByUser = iff(isnotempty(tostring(_parsedIntiatedByUser.userPrincipalName)),
+  tostring(_parsedIntiatedByUser.userPrincipalName), tostring(_parsedIntiatedByApp.displayName))
  | extend Targetprop = todynamic(TargetResources)
  | extend TargetUser = tostring(Targetprop[0].userPrincipalName)
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, InitiatedByUser , Operation = OperationName , CorrelationId, IPAddress, Category, Source = SourceSystem , AADTenantId, Type
  ),
  (AWSCloudTrail
  | where EventName in~ ("DeactivateMFADevice", "DeleteVirtualMFADevice")
- | extend InstanceProfileName = tostring(parse_json(RequestParameters).InstanceProfileName)
- | extend TargetUser = tostring(parse_json(RequestParameters).userName)
+ | extend _parsedRequestParameters = parse_json(RequestParameters)
+ | extend InstanceProfileName = tostring(_parsedRequestParameters.InstanceProfileName)
+ | extend TargetUser = tostring(_parsedRequestParameters.userName)
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, Source = EventSource , Operation = EventName , TenantorInstance_Detail = InstanceProfileName, IPAddress = SourceIpAddress
  )
  )

Solutions/Cloud Identity Threat Protection Essentials/Analytic Rules/NewExtUserGrantedAdmin.yaml

@@ -45,7 +45,7 @@ query: |
   | order by TimeGenerated
   | project TimeGenerated, Target, InviteInitiator, OperationName, TenantId
   | evaluate sequence_detect(TimeGenerated, maxTimeBetweenInviteAccept, maxTimeBetweenInviteAccept, invite=(OperationName has "Invite external user"), redeem=(OperationName has "Redeem external user invite"), Target)
-  | join (
+  | join kind=innerunique (
   AuditLogs
   | where Category =~ "RoleManagement"
   | where AADOperationType in~ ("Assign", "AssignEligibleRole")