IBM QRadar cannot receiving RiskLevel and RiskState information from Microsoft Graph API

Davin Ardian 1

Hello everyone,

Hope you are all is going well.

we already collected logs/events from Microsoft Graph API but we are not receiving RiskState and RiskLevel information

The QRadar by default gathers the logs from URL : https://graph.microsoft.com/v1.0/security/alerts on the QRadar event paylod we are receiving RiskScore but the value is sometimes none.

Does anyone experience the same issue?

James Hamil 22,086 Reputation points Microsoft Employee

2022-09-27T17:16:27.45+00:00

Hi @Davin Ardian , thanks for the question. I'm unfamiliar with QRadar so I might need some help understanding your question. You can call the Graph API through QRadar? What does your query look like? Please post a screenshot or text if you can.

Is "RiskScore" a QRadar attribute? You have listed riskLevel and riskState, but those are Graph properties. Does "RiskScore" utilize these?

Please let me know and I can help you further!

Thank you,
James
Davin Ardian 1 Reputation point

2022-09-28T00:58:01.037+00:00

Hi James,

Thank you for your response. this reference https://www.ibm.com/docs/en/dsm?topic=options-microsoft-graph-security-api-protocol-configuration that we follow to integrate QRadar with the Graph API.

The query look like :

The query to be executed:
https://graph.microsoft.com/v1.0/security/alerts?$filter=severity+eq+%27high%27+and+lastModifiedDateTime+gt

The RiskLevel and RiskState are Microsoft Graph API attributes, you can check on this https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0 on properties tables

The event from Graph API on QRadar is not contain either RiskLevel and RiskState