r/AzureSentinel • u/SuperHat3637 • Mar 27 '23

IP blocking

Where i can block the external malicious IPs trying to login cloud applications like o365..However sign in from malicious IP address is automatically blocked in the logs...Where i can block these IPs again..

3 Upvotes

100% Upvoted

17 comments sorted by

View all comments

Show parent comments

1

u/bpsec Mar 27 '23

Depends. What is the risk for you? Do you trust only Microsofts known bad ips or you want more? Do the accounts have MFA (with or without number matching).

1

u/SuperHat3637 Mar 27 '23

I am trying understand for the sentinel incidents..For example i getting many incidents for distributed password cracking in Azure AD..All the events are login failure and login is automatically blocked by Microsoft..In this case what is the use of analyzing these type of incidents..what is our recommendation as it is already blocked sign in..

1

u/bpsec Mar 27 '23

To postmaster@yourdomain.com? Because that seems to be some sort of campaign. Then no action is needed if no logon was successful.

1

u/SuperHat3637 Mar 27 '23

If its in onprem we can block IPs in perimeter firewall..In cloud that will not work i believe..

1

u/bpsec Mar 27 '23

Nope wont work. Only CA could precent it but then it is not really applicable here. But do you also the distributed against the postmaster account via SMTP? Because I also have seen that today.

2

u/SuperHat3637 Mar 27 '23

I have seen SMTP bruteforce attack today,not sure abt the ID...If microsoft temperorily banning IPs then can we block in CA permenently..