[Rule Tuning] Azure Active Directory High Risk Sign-in => Also alert on failed

[willem-dhaese]

"Azure Active Directory High Risk Sign-in"

We noticed it's important to also alert on failed outcomes. Customers who don't want failed outcomes can exclude with an exception.

Link to rule

https://www.elastic.co/guide/en/security/current/azure-active-directory-high-risk-sign-in.html

Description

Current query:

event.dataset:azure.signinlogs and
  (azure.signinlogs.properties.risk_level_during_signin:high or azure.signinlogs.properties.risk_level_aggregated:high) and
  event.outcome:(success or Success)

Change to:

event.dataset:azure.signinlogs and
  (azure.signinlogs.properties.risk_level_during_signin:high or azure.signinlogs.properties.risk_level_aggregated:high)