Secret Exposure with Anomalous SPN Sign-In

Original query, unchanged.

let lookback = 1d;
let SecretFindings = StratoSecure_Findings_CL
    | where TimeGenerated >= ago(lookback)
    | where FixStatus =~ "open"
    | where CweId in ("CWE-798", "CWE-259", "CWE-321", "CWE-522")
    | where Severity in ("Critical", "High")
    | summarize FindingCount = count(), RuleIds = make_set(RuleId), Repos = make_set(Repository)
        by ApplicationId, StraTenantId;
let AnomalousSignins = AADServicePrincipalSignInLogs
    | where TimeGenerated >= ago(lookback)
    | where ResultType != "0" or ConditionalAccessStatus =~ "failure"
    | summarize FailedAttempts = count(), DistinctIPs = dcount(IPAddress),
        FirstAttempt = min(TimeGenerated), LastAttempt = max(TimeGenerated)
        by ServicePrincipalId, ServicePrincipalName
    | where FailedAttempts > 5 or DistinctIPs > 3;
SecretFindings
    | join kind=inner AnomalousSignins on $left.ApplicationId == $right.ServicePrincipalId
    | project TimeGenerated = LastAttempt, ApplicationId, ServicePrincipalName, StraTenantId,
        FindingCount, RuleIds, Repos, FailedAttempts, DistinctIPs