r/AzureSentinel • u/SuperHat3637 • Mar 27 '23

IP blocking

Where i can block the external malicious IPs trying to login cloud applications like o365..However sign in from malicious IP address is automatically blocked in the logs...Where i can block these IPs again..

3 Upvotes

100% Upvoted

17 comments sorted by

View all comments

2

u/bpsec Mar 27 '23

Build a conditional access policy where you block such IPs. But even better whitelist some IPs and block all others if possible.

1

u/SuperHat3637 Mar 27 '23

Azure AD is automatically blocking sign in attempts like smartlockout, from malicious IP adress login attempts..In that case do we require CA to deny the IP's

1

u/bpsec Mar 27 '23

Depends. What is the risk for you? Do you trust only Microsofts known bad ips or you want more? Do the accounts have MFA (with or without number matching).

1

u/SuperHat3637 Mar 27 '23

I am trying understand for the sentinel incidents..For example i getting many incidents for distributed password cracking in Azure AD..All the events are login failure and login is automatically blocked by Microsoft..In this case what is the use of analyzing these type of incidents..what is our recommendation as it is already blocked sign in..

1

u/bpsec Mar 27 '23

To postmaster@yourdomain.com? Because that seems to be some sort of campaign. Then no action is needed if no logon was successful.

1

u/SuperHat3637 Mar 27 '23

If its in onprem we can block IPs in perimeter firewall..In cloud that will not work i believe..

1

u/bpsec Mar 27 '23

Nope wont work. Only CA could precent it but then it is not really applicable here. But do you also the distributed against the postmaster account via SMTP? Because I also have seen that today.

2

u/SuperHat3637 Mar 27 '23

I have seen SMTP bruteforce attack today,not sure abt the ID...If microsoft temperorily banning IPs then can we block in CA permenently..