4.9 Building Sign-In Baselines

Building Sign-In Baselines

Reactive investigation starts when an alert fires. Proactive monitoring starts before the alert — by building baselines of normal behaviour and detecting deviations. The queries in this subsection establish what “normal” looks like for your environment, so you can spot “abnormal” faster.

User-level baseline: normal IPs and locations

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion)
| extend City = tostring(LocationDetails.city)
| summarize
    SignInCount = count(),
    LastSeen = max(TimeGenerated),
    Apps = make_set(AppDisplayName)
    by UserPrincipalName, IPAddress, Country, City
| sort by UserPrincipalName, SignInCount desc

This creates a profile for each user: which IPs they use, from which cities and countries, how often, when last seen, and which apps. Store this as a Sentinel watchlist for VIP users — it becomes the reference against which you compare suspicious sign-ins.

Environment-level baseline: sign-in volume by hour

1
2
3
4
5
6
7
8

SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| summarize HourlyCount = count() by bin(TimeGenerated, 1h)
| summarize
    AvgHourly = avg(HourlyCount),
    StdDev = stdev(HourlyCount),
    MaxHourly = max(HourlyCount)

This gives you the average hourly sign-in volume and standard deviation. A spike that exceeds AvgHourly + (3 * StdDev) is statistically anomalous and worth investigating.

Application baseline: unusual app access

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

let normalApps =
    SigninLogs
    | where TimeGenerated between (ago(30d) .. ago(1d))
    | where ResultType == 0
    | distinct UserPrincipalName, AppDisplayName;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| join kind=anti normalApps on UserPrincipalName, AppDisplayName
| summarize Count = count() by UserPrincipalName, AppDisplayName
| sort by Count desc

This finds users accessing applications they have never accessed before. A finance user suddenly accessing Azure Portal or a marketing user accessing Exchange Web Services for the first time could indicate compromise — the attacker is exploring what the stolen credentials can access.

Converting baselines to detections

Each baseline query can be promoted to a Sentinel analytics rule:

1. Run the baseline query to establish normal
2. Define the anomaly threshold (e.g. sign-ins from a new country, new IP, new application)
3. Save as a scheduled analytics rule with appropriate severity and entity mapping
4. Tune over time — adjust thresholds based on false positive rates