{"product_id":"entra-id-high-risk-alerts-graph-thehive-slack-n8n","title":"Entra ID High-Risk Alerts: Graph + TheHive + Slack n8n","description":"\u003ch3\u003eCatch Microsoft Entra ID Protection high-risk events fast—enriched with Graph context, tracked in TheHive, and broadcast to Slack\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow monitors Microsoft Entra ID Protection for \u003cstrong\u003ehigh-risk\u003c\/strong\u003e detections, enriches them using \u003cstrong\u003eMicrosoft Graph\u003c\/strong\u003e (risky user record + recent sign-ins), then creates or updates corresponding \u003cstrong\u003eTheHive\u003c\/strong\u003e alerts and posts a clean summary to a selected \u003cstrong\u003eSlack\u003c\/strong\u003e security channel.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns every 30 minutes\u003c\/strong\u003e on a schedule to stay ahead of identity threats.\u003c\/li\u003e\n  \u003cli\u003eQueries Microsoft Graph Identity Protection for \u003cstrong\u003ehigh\u003c\/strong\u003e risk detections from the \u003cstrong\u003elast 20 minutes\u003c\/strong\u003e, following \u003ccode\u003e@odata.nextLink\u003c\/code\u003e pagination.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eGroups detections by user\u003c\/strong\u003e and aggregates key context (detection types, risk states, IPs, locations, and first\/last detection timestamps).\u003c\/li\u003e\n  \u003cli\u003eFetches additional enrichment from Microsoft Graph by retrieving:\n    \u003cul\u003e\n      \u003cli\u003ethe \u003cstrong\u003erisky user record\u003c\/strong\u003e\n\u003c\/li\u003e\n      \u003cli\u003ethe user’s \u003cstrong\u003efive most recent sign-in events\u003c\/strong\u003e\n\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n  \u003cli\u003eCorrelates deterministic signals (e.g., privileged roles, multiple countries, confirmed compromise state, or non-compliant devices) to classify severity and generate a detailed incident narrative.\u003c\/li\u003e\n  \u003cli\u003eChecks \u003cstrong\u003eTheHive 5\u003c\/strong\u003e for existing open alerts of type \u003cstrong\u003eentra-id-risk\u003c\/strong\u003e and then:\n    \u003cul\u003e\n      \u003cli\u003e\n\u003cstrong\u003eupdates\u003c\/strong\u003e the matching alert (by \u003cem\u003esourceRef\u003c\/em\u003e), or\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003ecreates\u003c\/strong\u003e a new alert with observables.\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003ePosts a formatted alert summary\u003c\/strong\u003e with the \u003cstrong\u003eTheHive reference\u003c\/strong\u003e to a chosen \u003cstrong\u003eSlack\u003c\/strong\u003e channel.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eSecurity teams needing near-real-time visibility into \u003cstrong\u003eEntra ID Protection high-risk\u003c\/strong\u003e detections.\u003c\/li\u003e\n  \u003cli\u003eSaaS operators centralizing identity incident intake into \u003cstrong\u003eTheHive\u003c\/strong\u003e while notifying analysts via \u003cstrong\u003eSlack\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003eAutomation engineers building an identity-focused SOC triage pipeline with \u003cstrong\u003en8n\u003c\/strong\u003e, Graph enrichment, and case management.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eIntegrations:\u003c\/strong\u003e Microsoft Graph (IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, AuditLog.Read.All), \u003cstrong\u003eTheHive 5\u003c\/strong\u003e, \u003cstrong\u003eSlack\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eNode\/tooling:\u003c\/strong\u003e if, code, merge, Slack, HTTP Request, sticky note.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":46114725265587,"sku":"N8N-19996","price":45.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/1pLpPpZ_BPhGYDrC9-j2g_MTz6BF0T.png?v=1790587136","url":"https:\/\/buyflowscripts.com\/products\/entra-id-high-risk-alerts-graph-thehive-slack-n8n","provider":"N8N Commerce","version":"1.0","type":"link"}