Microsoft Cloud App Security – Release 189, 190, and 191

Microsoft Cloud App Security – Release 189, 190, and 191

• New anomaly detection: Suspicious addition of credentials to an OAuth app
  Microsoft has extended their anomaly detections to include suspicious addition of privileged credentials to an OAuth app. The new detection is now available out-of-the-box and automatically enabled. The detection can indicate that an attacker has compromised the app and is using it for malicious activity. For more information, see Unusual addition of credentials to an OAuth app.

• Enhanced auditing for Shadow IT discovery activities
  Microsoft has updated the auditing for Shadow IT activities to include actions performed by administrators. The following new activities are now available in the activity log and can be used as part of your Cloud App Security investigation experience.
  • Tagging or untagging apps
  • Creating, updating, or deleting log collectors
  • Creating, updating, or deleting data sources

• New Data Enrichment REST API endpoints
  Microsoft has added the following Data Enrichment API endpoints enabling you to fully manage your IP address ranges using the API. Use their sample management script to help you get started. For more information about ranges, see Working with IP ranges and tags.
  • List IP address range
  • Update IP address range
  • Delete IP address range