Can you explain how to set up user entity behavior analytics to catch privilege escalation attempts by disgruntled SaaS administrators who already have legitimate super-admin rights?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
Can you explain how to set up user entity behavior analytics to catch privilege escalation attempts by disgruntled SaaS administrators who already have legitimate super-admin rights?
3 real searches · 1 real-search pass
CISA insider threat logging monitoring privileged users audit logs guidance SaaS administrators UEBAGoogle ↗
OBSERVED
Microsoft Entra audit logs privileged role changes service principal credentials audit logging documentationGoogle ↗
OBSERVED
MITRE ATT&CK cloud account manipulation cloud service dashboard audit logs insider threatGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 3 queries…
Searches and sources
ChatGPT3 real searches · gpt-6
CISA insider threat logging monitoring privileged users audit logs guidance SaaS administrators UEBA Google ↗
Microsoft Entra audit logs privileged role changes service principal credentials audit logging documentation Google ↗
MITRE ATT&CK cloud account manipulation cloud service dashboard audit logs insider threat Google ↗
- Microsoft Entra security operations for applications - Microsoft Entra · learn.microsoft.com
- Microsoft Entra audit log activity reference - Microsoft Entra ID · learn.microsoft.com
- Visibility and Analytics Capabilities · nsa.gov
- User Capabilities · nsa.gov
- How to investigate why a service principal was created in your tenant - Microsoft Entra ID · learn.microsoft.com
- Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise · attack.mitre.org
- Cloud Service Dashboard, Technique T1538 - Enterprise · attack.mitre.org
- Cloud Security Playbook Volume 1 · dodcio.defense.gov
Queries
3 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
CISA insider threat logging monitoring privileged users audit logs guidance SaaS administrators UEBA OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Microsoft Entra audit logs privileged role changes service principal credentials audit logging documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
MITRE ATT&CK cloud account manipulation cloud service dashboard audit logs insider threat OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |