Detect Cloud Services in Sumo Logic CSE

(_sourceCategory=*Windows/Sysmon* OR _sourceCategory=*Windows/Security* OR _sourceCategory=*Azure/SignIn* OR _sourceCategory=*AWS/CloudTrail*)
| json auto maxdepth 5 nodrop
// Normalize command line field across log sources
| if (!isBlank(CommandLine), CommandLine,
    if (!isBlank(command_line), command_line,
      if (!isBlank(process.command_line), process.command_line, "")
    )
  ) as cmd_line
// Normalize actor field across log sources
| if (!isBlank(SubjectUserName), SubjectUserName,
    if (!isBlank(properties.userPrincipalName), properties.userPrincipalName,
      if (!isBlank(userIdentity.arn), userIdentity.arn, "-")
    )
  ) as actor
// Normalize source IP across log sources
| if (!isBlank(IpAddress), IpAddress,
    if (!isBlank(properties.ipAddress), properties.ipAddress,
      if (!isBlank(sourceIPAddress), sourceIPAddress, "-")
    )
  ) as src_ip
// Detection filter
| where
  // Pattern 1: Cloud CLI execution
  (
    cmd_line matches "*Connect-AzAccount*"
    OR cmd_line matches "*Connect-MgGraph*"
    OR cmd_line matches "*Connect-ExchangeOnline*"
    OR cmd_line matches "*az login*"
    OR cmd_line matches "*az account*"
    OR cmd_line matches "*aws configure*"
    OR cmd_line matches "*aws sts*"
    OR cmd_line matches "*gcloud auth*"
  )
  // Pattern 2: Risky Azure AD sign-in
  OR (
    !isBlank(properties.riskLevelDuringSignIn)
    AND (properties.riskLevelDuringSignIn = "medium" OR properties.riskLevelDuringSignIn = "high")
    AND properties.status.errorCode = 0
  )
  OR (
    !isBlank(properties.networkLocationDetails)
    AND properties.networkLocationDetails matches "*anonymizedIP*"
    AND properties.status.errorCode = 0
  )
  // Pattern 3: AWS Console login without MFA
  OR (
    eventName = "ConsoleLogin"
    AND responseElements.ConsoleLogin = "Success"
    AND additionalEventData.MFAUsed = "No"
  )
// Classify cloud platform
| if(
    cmd_line matches "*Connect-Az*" OR cmd_line matches "*az login*" OR cmd_line matches "*az account*" OR !isBlank(properties.riskLevelDuringSignIn),
    "Azure",
    if(cmd_line matches "*aws*" OR eventName = "ConsoleLogin", "AWS",
      if(cmd_line matches "*gcloud*", "GCP", "Unknown")
    )
  ) as CloudPlatform
// Classify detection type
| if(!isBlank(cmd_line) AND cmd_line != "", "CloudCLI_Execution",
    if(!isBlank(properties.riskLevelDuringSignIn) OR properties.networkLocationDetails matches "*anonymizedIP*",
      "RiskyAzureSignin", "AWSConsoleNoMFA")
  ) as DetectionType
| count by _sourceCategory, actor, src_ip, CloudPlatform, DetectionType, cmd_line
| sort by _count desc