Entra object created by unusual Initiator

Anomalous account creation can indicate a potential security issue, especially when accounts are created outside of expected processes. Alerts are triggered when account creation records are detected that were not made by a known initiator with more than two weeks of inactivity. Note that after two weeks of inactivity, any inactive known initiators are removed from the “known initiators” list.

NOTE: This threat rule includes a built-in lookback parameter set to 12 hours. Only events that occurred within this timeframe are processed by the rule.