[Feature] Entra Risks Module Include most common login locations

[NobleWolf]

Is your feature request related to a problem? Please describe.
When investigating Impossible Travel type alerts the Entra ID Risks Module includes some useful information, but knowing where the account most commonly authenticates from would be most useful.
Currently that information is not there:

Describe the solution you'd like
The Defender portal entity page includes this information:

This information is supremely useful and always required by our Analysts for Impossible Travel (and similar) type alerts.

Describe alternatives you've considered
Accessing this information from Defender

Additional context
None

[piaudonn]

Perhaps it is time to work on #210
What other insights shall we surface?

[NobleWolf]

@piaudonn yes, that #210 sounds about right. Sorry for not searching the open issues 😨

As for other insights I'm not familiar with what's available in UEBA.

[piaudonn]

This is draft:

[piaudonn]

@NobleWolf what do you think? It is also gathering stats about the IP and host if available.
It also detects if users are related in case more than 1 user is impacted in the incident (using the /people endpoint).

See here: https://github.com/briandelmsft/STAT-Function/pull/207/files#diff-33acf9a5da90fac8a4e5b0a03c6090a2e8bbefbcb1de6ea70f5adf2d9f7c8c53

[NobleWolf]

@NobleWolf what do you think? It is also gathering stats about the IP and host if available. It also detects if users are related in case more than 1 user is impacted in the incident (using the /people endpoint).

I think it looks great!

Sorry for the delayed reply. At a new company and just got STAT installed here today!

Looking forward to the new version that includes this!!