Microsoft Entra ID (Azure AD)
Overview
- Vendor: Microsoft
- Supported environment: SaaS
- Detection based on: Telemetry
- Supported application or feature: Application logs, Authentication logs
Microsoft Entra ID (Azure AD) is a cloud-based Identity and Rights management service. The service is developed and managed by Microsoft Corp.
Configure
To forward Microsoft Entra ID (Azure AD) events from Azure to Sekoia.io you need to send your event to an Azure Event Hub where Sekoia.io will collect the events.
Prerequisite
You must have Contributor write on Azure to perform the following installation.
Azure Event Hubs is a cloud-based event streaming platform and event ingestion service provided by Microsoft Azure. It is designed to handle large amounts of event data generated by various applications, devices, and services in real-time. Event Hubs enables you to ingest, process, and store events, logs, telemetry data, and other streaming data for further analysis, monitoring, and processing. Two ways are suggested in order to set up everything you need to forward your events on Sekoia.io.
If you are not an expert and want an easy way to configure the ressources on Azure, we recommend to use to Automatic way as it is easier to set up.
These two ways will create an Azure Event Hub and a Storage Account.
Use the template to create the ressources
To get started, click on the button below and fill the form on Azure to set up the required environment for Sekoia
Some fields must be filled in.
Project details
- Subscription: select the Azure subscription you want to use
- Resource Group: select or create a new Resource Group. A Resource Group is a container that holds related resources
Instance details
- Region: select the appropriated region
- Project Name: give a name for this project. Here is how the names of the resources will be affected by this project name
| Ressource | Name |
|---|---|
| Event Hub Namespace | <project_name>ehns |
| Event Hub | <project_name>eh |
| Shared Access Policy | <project_name>ap |
| Consumer Group | <project_name>cp |
| Storage Account | <project_name>sa |
- Event Hub Sku: Select the messaging tier for Event Hub Namespace between
Basic,StandardorPremium. We do not recommendBasicmodel due to its limitation. Please follow this Microsoft web page to get more information avec the different messaging tier. - Troughput Unit: A unit gives you up to 1 MB/s or 1,000 events per second (whichever comes first) per Event Hub Namespace. Please adapt it to your need.
- Enable Auto Inflate: When checked, the Auto-inflate feature of Event Hubs automatically scales up by increasing the number of troughput units, to meet usage needs.
- Auto Inflate Maximum Throughput Unit: When Enable Auto Inflate is checked, you can specify the maximum throughput units you allow.
- Partition Count: The number of event hub partitions. Microsoft recommends a maximum throughput of 1 MB/s per partition. Unless you plan to add more Event hubs to the Event Hub Namespace, the Partition Count and Throughput Unit variables should have the same values.
- Retention Time: How long you will keep events in the Event hub in days.
Use the output variables to create a Sekoia playbook
When the message Your deployment is complete is displayed, click on Outputs.
Keep these 5 pieces of information displayed carefully, it will used to configure the Trigger Configuration of the Sekoia playbook.
Overview
This setup guide will show you how to create an Event Hub manually.
Theses changes have to be made from the Azure Web Portal.
Some resources created during this procedure are needed to connect Sekoia.io to the Event Hub, you can complete the following table to save all the useful informations for later use.
| Name | Value | Description | Example |
|---|---|---|---|
| hub_name | To be completed at step 3 | Name of the Event Hub | sekoia_event_hub |
| hub_connection_string | To be completed at step 5 | Connection string–primary key | Endpoint=sb://company-eventhub.servicebus.windows.net/;SharedAccessKeyName=sekoiaio;SharedAccessKey=XXXXXX;EntityPath=sekoia_event_hub |
| hub_consumer_group | To be completed at step 6 | Name of the comsumer group | consumergroup_sekoiaio |
| storage_container_name | To be completed at step 7 | Name of your container | sekoiaio |
| storage_connection_string | To be completed at step 8 | Storage connection string | DefaultEndpointsProtocol=https;AccountName=sekoiaiocheckpoint;AccountKey=XXXXX |
As a prerequisite, you need to choose an existing Resource group, or create a new one (e.g. company-resource-group).
Step 1: Find your Subscription ID
- Go to: Home > Cost Management + Billing > Subscriptions.
- From there, keep the relevant “Subscription ID” that will be used along the process.
Step 2: Create Event Hub Namespace
- Navigate to Home > Event Hubs.
- Create an Event Hub Namespace.
- Select your Subscription and your Resource group. Click on create new if you want your Event Hub Namespace in a new Resource group.
- Choose a namespace name.
- Select a location based on your events location.
- Select the pricing tier plan based on your utilisation: Standard or Premimum (We don't recommend to choose the Basic plan due to its limitations.)
- Select the throughput units number based on your events, or enable the auto inflate mode:
1 throughput unit can process up to 1 MB per second or 1000 events per second (whichever comes first).
Step 3: Create Event Hub Instance
When your Event Hub Namespace is created you can create an Event Hub inside:
- Navigate to Home > Event Hubs > company-eventhubnamespace.
- Create an Event Hub.
- Select 4 as default partition count
- Select
Deleteas cleanup policy - Type 168h (7 days) as retention time
- Click
Create
Info
Carefully store the Event Hub name that will be used for sekoia playbook configuration.
Step 4: Create “Shared Access Policies” for the Event Hub
- Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Shared access policies.
-
Create a policy (e.g.
sekoiaio) with the claimsListen.
-
Once created, click on the policy.
Info
Carefully store the connection string–primary key that will be used for sekoia playbook configuration.
Step 5: Create a Consumer group
- Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Consumer groups.
- Create a Consumer group (e.g.
consumergroup_sekoiaio).
Info
Carefully store the Consumer group name that will be used for sekoia playbook configuration.
Step 6: Create a Storage Account with a container
In order to allow Sekoia.io keep track of the consumed events, the next step consists in creating a dedicated Storage account.
- Navigate to Home > Storage accounts.
- Create a Storage account.
- Select your Subscription and your Resource group.
- Choose a Storage account name.
-
Select a Region.
Info
You must choose the Region used during the Event Hub Namespace creation.
-
Select your perfomance and redundancy parameters.
Info
We advise at least the following values: - performance: standard - redundancy: Geo-Redundancy storage (GRS)
When your storage account is created you can create an container inside. 1. Navigate to Home > Storage accounts > storageaccoutname | containers. 2. Create an container.
Keep the Public Acces Level to Private.
Info
The container name should be the same as the Event Hub name. Carefully store that container name that will be used for sekoia playbook configuration.
Step 7: Retrieve Connection String
You have to retrieve the connection string from Azure Web Portal.
- Go to Home > Storage accounts > storageaccoutname | Access Keys.
- Click on "Show Keys" on the first Connection String.
Info
Carefully store the Connection String that will be used for sekoia playbook configuration.
Further Readings
Send logs from Microsoft Entra ID (Azure AD) to Azure Event Hub
When you have an Event Hub follow this guide to send your Microsoft Entra ID (Azure AD) events from Azure to the Event Hub:
You need to activate and configure the Microsoft Entra ID (Azure AD) diagnostic settings (e.g. company-ad),
to receive logs from the Microsoft Entra ID (Azure AD) into your Event Hub.
Navigate to Home > Microsoft Entra ID (Azure AD) (e.g. company-ad) > Monitoring > Diagnostic settings:
- Add a new diagnostic setting, and select “Stream to an event hub” and click on configure.
- Select the previously created “Event hubs”, “Event Hub” and “SharedAccessKey” (see step 3 of the event hub guide).
- In the log section, select all log categories (as shown below).
- Choose a name for this configuration and click on “Save”.
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake Microsoft Entra ID / Azure AD. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x Microsoft Entra ID / Azure AD on ATT&CK Navigator
Authentication Impossible Travel
Detects impossible travel when performing authentication from a source IP address, grouped by username.
- Effort: advanced
Cryptomining
Detection of domain names potentially related to cryptomining activities.
- Effort: master
Dynamic DNS Contacted
Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.
- Effort: master
Entra ID Consent Attempt to Suspicious OAuth Application
Detects an attempt to authorize account access to an OAuth application commonly used in business email compromise (BEC) attacks. Investigate the source IP address: unusual countries, RDP hosts and VPN providers are likely indicators of malicious activity.
- Effort: elementary
Entra ID Password Compromised By Known Credential Testing Tool
Detects a sign-in that has a correlation ID known to be used by malicious credential testing scripts. Note that even if the sign-in was blocked by MFA (error 50074) or device authentication (error 50097), these verifications only occur after the correct password was submitted. The account's password must still be considered compromised, and be changed.
- Effort: elementary
Entra ID Sign-In Via Known AiTM Phishing Kit
Detects a sign-in attempt from an IP address belonging to a known adversary-in-the-middle phishing kit.
- Effort: elementary
Entra ID Sign-In Via Known AiTM Phishing Kit (Mamba 2FA)
Detects a sign-in attempt with known characteristics of the adversary-in-the-middle phishing kit tracked by Sekoia.io as Mamba 2FA.
- Effort: elementary
Entra ID Sign-In Via Known AiTM Phishing Kit (Tycoon 2FA)
Detects a sign-in attempt with known characteristics of the adversary-in-the-middle phishing kit Tycoon 2FA.
- Effort: elementary
Exfiltration Domain
Detects traffic toward a domain flagged as a possible exfiltration vector.
- Effort: master
Login Brute-Force Successful On AzureAD From Single IP Address
A user has attempted to login several times (brute-force) on AzureAD and succeeded to login, all from the same source IP address and in a timerange of 5 minutes.
- Effort: advanced
Login Brute-Force Successful On SentinelOne EDR Management Console
A user has attempted to login several times (brute-force) on the SentinelOne EDR Management Console and succeeded to login.
- Effort: master
Microsoft Entra ID (Azure AD) Abnormal Token
Detects when Microsoft Entra ID (Azure AD) indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Anonymous IP
Detects when Microsoft Entra ID (Azure AD) identifies sign-ins from a risky IP address, for example, using an anonymous browser or VPN. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: advanced
Microsoft Entra ID (Azure AD) Device Code Authentication
Authentication via a device code is designed for use with input constrained devices. This method can however be abused, particularly in social engineering attacks. Whitelisting based on the organisation's practices is likely required to make this rule useful (e.g. excluding the public IP ranges of the organisation, excluding authentications attempt from managed devices, etc.)
- Effort: master
Microsoft Entra ID (Azure AD) Domain Trust Modification
Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Confirm the added or modified target domain/URL is legitimate administrator behavior.
- Effort: elementary
Microsoft Entra ID (Azure AD) Impossible Travel
Detects when Microsoft Entra ID (Azure AD) identifies two user activities (a single or multiple sessions) originating from geographically distant locations within a time period shorter than the time it would have taken the user to travel from the first location to the second. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Leaked Credentials
Detects when Microsoft Entra ID (Azure AD) identifies that the user's valid credentials have been leaked. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Login Failed Brute-Force From Single IP Address
A user has attempted to login several times (brute-force) on AzureAD and failed every time, all from the same source IP address and in a timerange of 5 minutes.
- Effort: advanced
Microsoft Entra ID (Azure AD) MFA Method Change
This rule detects when an user makes a change to the multifactor authentication methods for their account. In environments where this rule is too noisy, alert filters should be applied, e.g. to focus on privileged accounts, or unusual source network locations.
- Effort: master
Microsoft Entra ID (Azure AD) Malicious IP
Detects when Microsoft Entra ID (Azure AD) identifies a malicious IP address. An IP address is considered malicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Password Spray
Detects when Microsoft Entra ID (Azure AD) indicates that multiple usernames are attacked using common passwords in a unified brute force manner to gain unauthorized access. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Self Service Password Reset In Failure
Detects self-service password reset in failure for various reasons (except licence or policy ones)
- Effort: master
Microsoft Entra ID (Azure AD) Sign-in From Unlikely Country
Detects when Microsoft Entra ID (Azure AD) identifies sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Successful Password Spraying From Single IP Address
An IP address performed several failed logins on multiple users to then have a successful login on one of them. Note that even if the sign-in was blocked by MFA (error 50074/50076/50158) or conditional access (error 50097/53003), these verifications only occur after the correct password was submitted. The account's password must still be considered compromised, and be changed.
- Effort: advanced
Microsoft Entra ID (Azure AD) Suspicious Browser
Detects when Microsoft Entra ID (Azure AD) identifies suspicious sign-in activity across multiple tenants from different countries in the same browser. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Suspicious IP
Detects when Microsoft Entra ID (Azure AD) identifies a suspicious IP address. An IP address is considered suspicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Suspicious Inbox Forwarding
Detects when Microsoft Entra ID (Azure AD) identifies suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Threat Intelligence
Detects when Microsoft Entra ID (Azure AD) identifies a sign-in activity that is unusual for the given user or is consistent with known attack patterns based on Microsoft's internal and external threat intelligence sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Token Issuer Anomaly
Detects when Microsoft Entra ID (Azure AD) indicates that The SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: advanced
Microsoft Entra ID (Azure AD) Unfamiliar Features
Detects when Microsoft Entra ID (Azure AD) identifies sign-ins with characteristics that deviate from past sign-in properties. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Nimbo-C2 User Agent
Nimbo-C2 Uses an unusual User-Agent format in its implants.
- Effort: intermediate
Password Change Brute-Force On AzureAD
A change of password has failed on Azure Active Directory, 5 times for the same user
- Effort: intermediate
Potential Bazar Loader User-Agents
Detects potential Bazar loader communications through the user-agent
- Effort: elementary
Potential Lemon Duck User-Agent
Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".
- Effort: elementary
RSA SecurID Failed Authentification
Detects many failed attempts to authenticate followed by a successfull login for a super admin account.
- Effort: advanced
Remote Access Tool Domain
Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).
- Effort: master
Remote Monitoring and Management Software - AnyDesk
Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.
- Effort: master
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Sekoia.io EICAR Detection
Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.
- Effort: master
TOR Usage Generic Rule
Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.
- Effort: master
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Application logs |
information on AD activities are collected: domain/user/group creation, password change, token update |
Authentication logs |
Azure AD logs provide details on authentication: status, user, IP address |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | `` |
| Category | authentication |
| Type | connection, start |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "{\"time\": \"2019-06-24T09:21:27.3694184Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add unverified domain\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"2f006047-a6d9-4fca-847a-fffdb209fa4d\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_5P1YA_52883815\",\"category\": \"DirectoryManagement\",\"correlationId\": \"2f006047-a6d9-4fca-847a-fffdb209fa4d\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Add unverified domain\",\"activityDateTime\": \"2019-06-24T09:21:27.3694184+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": null,\"displayName\": \"examplecorp.onmicrosoft.com\",\"modifiedProperties\": [{\"displayName\": \"Name\",\"oldValue\": \"[\\\"\\\"]\",\"newValue\": \"[\\\"examplecorp.onmicrosoft.com\\\"]\"},{\"displayName\": \"LiveType\",\"oldValue\": \"[\\\"None\\\"]\",\"newValue\": \"[\\\"Managed\\\"]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"Name,LiveType\\\"\"}]}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:21:27.369418Z",
"action": {
"name": "Add unverified domain",
"outcome": "success",
"properties": [
{
"name": "Name",
"newValue": "[\"examplecorp.onmicrosoft.com\"]",
"oldValue": "[\"\"]"
},
{
"name": "LiveType",
"newValue": "[\"Managed\"]",
"oldValue": "[\"None\"]"
}
],
"target": "user",
"type": "add"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "2f006047-a6d9-4fca-847a-fffdb209fa4d",
"durationMs": 0,
"operationName": "Add unverified domain",
"operationVersion": "1.0",
"properties": {
"correlationId": "2f006047-a6d9-4fca-847a-fffdb209fa4d",
"id": "Directory_5P1YA_52883815"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
"name": "exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com"
}
}
{
"message": "{\"category\":\"AuditLogs\",\"correlationId\":\"93154481-5703-42a7-89a5-b7de6fbace8e\",\"durationMs\":0,\"identity\":\"Microsoft Teams Services\",\"level\":\"Informational\",\"operationName\":\"Add member to group\",\"operationVersion\":\"1.0\",\"properties\":{\"activityDateTime\":\"2020-01-02T13:36:37.9515687+00:00\",\"activityDisplayName\":\"Add member to group\",\"additionalDetails\":[{\"key\":\"User-Agent\",\"value\":\"SkypeSpaces/1.0a$*+\"}],\"category\":\"GroupManagement\",\"correlationId\":\"93154481-5703-42a7-89a5-b7de6fbace8e\",\"id\":\"Directory_FI4U8_64698073\",\"initiatedBy\":{\"app\":{\"appId\":null,\"displayName\":\"Microsoft Teams Services\",\"servicePrincipalId\":\"1de0a2d4-340e-4d98-b060-2dec8434481a\",\"servicePrincipalName\":null}},\"loggedByService\":\"Core Directory\",\"operationType\":\"Assign\",\"result\":\"success\",\"resultReason\":\"\",\"targetResources\":[{\"displayName\":null,\"id\":\"e6285600-5ec8-4ea4-89fc-40db84049b26\",\"modifiedProperties\":[{\"displayName\":\"Group.ObjectID\",\"newValue\":\"\\\"f3bccb88-a12b-4bbd-a971-e6e616946872\\\"\",\"oldValue\":null},{\"displayName\":\"Group.DisplayName\",\"newValue\":\"\\\"NEWCORP\\\"\",\"oldValue\":null},{\"displayName\":\"Group.WellKnownObjectName\",\"newValue\":null,\"oldValue\":null}],\"type\":\"User\",\"userPrincipalName\":\"example.user@corp.net\"},{\"displayName\":null,\"groupType\":\"azureAD\",\"id\":\"f3bccb88-a12b-4bbd-a971-e6e616946872\",\"modifiedProperties\":[],\"type\":\"Group\"}]},\"resourceId\":\"/tenants/29218bde-dc31-4e0d-969b-bac924ce3216/providers/Microsoft.aadiam\",\"resultSignature\":\"None\",\"tenantId\":\"29218bde-dc31-4e0d-969b-bac924ce3216\",\"time\":\"2020-01-02T13:36:37.9515687Z\"}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2020-01-02T13:36:37.951568Z",
"action": {
"name": "Add member to group",
"outcome": "success",
"properties": [
{
"name": "Group.ObjectID",
"newValue": "\"f3bccb88-a12b-4bbd-a971-e6e616946872\"",
"oldValue": ""
},
{
"name": "Group.DisplayName",
"newValue": "\"NEWCORP\"",
"oldValue": ""
},
{
"name": "Group.WellKnownObjectName",
"newValue": "",
"oldValue": ""
},
{
"id": "e6285600-5ec8-4ea4-89fc-40db84049b26",
"name": "example.user@corp.net",
"type": "targetedUser"
}
],
"target": "user",
"type": "assign"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "93154481-5703-42a7-89a5-b7de6fbace8e",
"durationMs": 0,
"identity": "Microsoft Teams Services",
"operationName": "Add member to group",
"operationVersion": "1.0",
"properties": {
"correlationId": "93154481-5703-42a7-89a5-b7de6fbace8e",
"id": "Directory_FI4U8_64698073"
},
"resourceId": "/tenants/29218bde-dc31-4e0d-969b-bac924ce3216/providers/Microsoft.aadiam",
"tenantId": "29218bde-dc31-4e0d-969b-bac924ce3216"
},
"related": {
"user": [
"Microsoft Teams Services"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "1de0a2d4-340e-4d98-b060-2dec8434481a",
"name": "Microsoft Teams Services"
}
}
{
"message": "{\"time\": \"2019-06-24T09:18:23.5860200Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add service principal\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"resultDescription\": \"Microsoft.Online.Workflows.SpnValidationException\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"191e390a-0c29-41e1-874b-c57ca3599213\",\"identity\": \"Microsoft Azure AD Internal - Jit Provisioning\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_GMR7H_185505965\",\"category\": \"ApplicationManagement\",\"correlationId\": \"191e390a-0c29-41e1-874b-c57ca3599213\",\"result\": \"failure\",\"resultReason\": \"Microsoft.Online.Workflows.SpnValidationException\",\"activityDisplayName\": \"Add service principal\",\"activityDateTime\": \"2019-06-24T09:18:23.58602+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {},\"targetResources\": [{\"id\": \"224fe45d-b5c4-44e7-ace4-7bea31600122\",\"displayName\": \"Azure AD Identity Protection\",\"type\": \"ServicePrincipal\",\"modifiedProperties\": [{\"displayName\": \"AccountEnabled\",\"oldValue\": \"[]\",\"newValue\": \"[true]\"},{\"displayName\": \"AppAddress\",\"oldValue\": \"[]\",\"newValue\": \"[{\\\"AddressType\\\":0,\\\"Address\\\":\\\"https://main.protectioncenter.ext.azure.com\\\",\\\"ReplyAddressClientType\\\":0},{\\\"AddressType\\\":0,\\\"Address\\\":\\\"https://s2.cloudappdiscovery.ext.azure.com/\\\",\\\"ReplyAddressClientType\\\":0}]\"},{\"displayName\": \"AppPrincipalId\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"fc68d9e5-1f76-45ef-99aa-214805418498\\\"]\"},{\"displayName\": \"DisplayName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"Azure AD Identity Protection\\\"]\"},{\"displayName\": \"ServicePrincipalName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"https://s2.cloudappdiscovery.ext.azure.com/\\\",\\\"https://main.protectioncenter.ext.azure.com\\\",\\\"fc68d9e5-1f76-45ef-99aa-214805418498\\\"]\"},{\"displayName\": \"Credential\",\"oldValue\": \"[]\",\"newValue\": \"[{\\\"CredentialType\\\":2,\\\"KeyStoreId\\\":\\\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\\\",\\\"KeyGroupId\\\":\\\"375eb77d-1d23-462b-9be7-cb51db9123e3\\\"}]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"AccountEnabled, AppAddress, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\\\"\"},{\"displayName\": \"MethodExecutionResult.\",\"oldValue\": null,\"newValue\": \"\\\"Microsoft.Online.Workflows.SpnValidationException\\\"\"},{\"displayName\": \"TargetId.ServicePrincipalNames\",\"oldValue\": null,\"newValue\": \"\\\"https://s2.cloudappdiscovery.ext.azure.com/;https://main.protectioncenter.ext.azure.com;fc68d9e5-1f76-45ef-99aa-214805418498\\\"\"}]}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "failure",
"reason": "Microsoft.Online.Workflows.SpnValidationException"
},
"@timestamp": "2019-06-24T09:18:23.586020Z",
"action": {
"name": "Add service principal",
"outcome": "failure",
"outcome_reason": "Microsoft.Online.Workflows.SpnValidationException",
"properties": [
{
"name": "AccountEnabled",
"newValue": "[true]",
"oldValue": "[]"
},
{
"name": "AppAddress",
"newValue": "[{\"AddressType\":0,\"Address\":\"https://main.protectioncenter.ext.azure.com\",\"ReplyAddressClientType\":0},{\"AddressType\":0,\"Address\":\"https://s2.cloudappdiscovery.ext.azure.com/\",\"ReplyAddressClientType\":0}]",
"oldValue": "[]"
},
{
"name": "AppPrincipalId",
"newValue": "[\"fc68d9e5-1f76-45ef-99aa-214805418498\"]",
"oldValue": "[]"
},
{
"name": "DisplayName",
"newValue": "[\"Azure AD Identity Protection\"]",
"oldValue": "[]"
},
{
"name": "ServicePrincipalName",
"newValue": "[\"https://s2.cloudappdiscovery.ext.azure.com/\",\"https://main.protectioncenter.ext.azure.com\",\"fc68d9e5-1f76-45ef-99aa-214805418498\"]",
"oldValue": "[]"
},
{
"name": "Credential",
"newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"375eb77d-1d23-462b-9be7-cb51db9123e3\"}]",
"oldValue": "[]"
},
{
"name": "MethodExecutionResult.",
"newValue": "\"Microsoft.Online.Workflows.SpnValidationException\"",
"oldValue": ""
},
{
"name": "TargetId.ServicePrincipalNames",
"newValue": "\"https://s2.cloudappdiscovery.ext.azure.com/;https://main.protectioncenter.ext.azure.com;fc68d9e5-1f76-45ef-99aa-214805418498\"",
"oldValue": ""
}
],
"type": "add"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "191e390a-0c29-41e1-874b-c57ca3599213",
"durationMs": 0,
"identity": "Microsoft Azure AD Internal - Jit Provisioning",
"operationName": "Add service principal",
"operationVersion": "1.0",
"properties": {
"correlationId": "191e390a-0c29-41e1-874b-c57ca3599213",
"id": "Directory_GMR7H_185505965"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
}
}
{
"message": "{\"time\": \"2019-06-24T09:29:28.6242725Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add user\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"d40fb664-9901-4cfa-bd3b-afeff8d6b0de\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_HR9C4_45223131\",\"category\": \"UserManagement\",\"correlationId\": \"d40fb664-9901-4cfa-bd3b-afeff8d6b0de\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Add user\",\"activityDateTime\": \"2019-06-24T09:29:28.6242725+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"user_gmail.com#EXT#@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": [{\"displayName\": \"AccountEnabled\",\"oldValue\": \"[]\",\"newValue\": \"[true]\"},{\"displayName\": \"StsRefreshTokensValidFrom\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"2019-06-24T09:29:28Z\\\"]\"},{\"displayName\": \"UserPrincipalName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"jean.dupont@usergmail.onmicrosoft.com\\\"]\"},{\"displayName\": \"UserType\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"Member\\\"]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"AccountEnabled, StsRefreshTokensValidFrom, UserPrincipalName, UserType\\\"\"}]}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:29:28.624272Z",
"action": {
"name": "Add user",
"outcome": "success",
"properties": [
{
"name": "AccountEnabled",
"newValue": "[true]",
"oldValue": "[]"
},
{
"name": "StsRefreshTokensValidFrom",
"newValue": "[\"2019-06-24T09:29:28Z\"]",
"oldValue": "[]"
},
{
"name": "UserPrincipalName",
"newValue": "[\"jean.dupont@usergmail.onmicrosoft.com\"]",
"oldValue": "[]"
},
{
"name": "UserType",
"newValue": "[\"Member\"]",
"oldValue": "[]"
},
{
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com",
"type": "targetedUser"
}
],
"target": "user",
"type": "add"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "d40fb664-9901-4cfa-bd3b-afeff8d6b0de",
"durationMs": 0,
"operationName": "Add user",
"operationVersion": "1.0",
"properties": {
"correlationId": "d40fb664-9901-4cfa-bd3b-afeff8d6b0de",
"id": "Directory_HR9C4_45223131",
"targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"user_gmail.com#EXT#@usergmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
"name": "user_gmail.com#EXT#@usergmail.onmicrosoft.com"
}
}
{
"message": "{\"time\": \"2019-06-24T09:32:07.4637225Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Change user password\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_1PF86_84995790\",\"category\": \"UserManagement\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Change user password\",\"activityDateTime\": \"2019-06-24T09:32:07.4637225+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Update\",\"initiatedBy\": {\"user\": {\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:32:07.463722Z",
"action": {
"name": "Change user password",
"outcome": "success",
"properties": [
{
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com",
"type": "targetedUser"
}
],
"target": "user",
"type": "update"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"durationMs": 0,
"operationName": "Change user password",
"operationVersion": "1.0",
"properties": {
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"id": "Directory_1PF86_84995790",
"targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"jean.dupont@usergmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com"
}
}
{
"message": "{\"time\":\"2022-04-05T13:07:16.7796535Z\",\"resourceId\":\"/tenants/e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"resultType\":\"0\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"2001:0db8:85a3:0000:0000:8a2e:0370:7334\",\"correlationId\":\"7ee10819-f631-4ab1-8edb-4efb7286baba\",\"identity\":\"DUPONT Jean\",\"Level\":4,\"properties\":{\"id\":\"b2fdcc8f-954d-4d88-a035-58daefab4f00\",\"createdDateTime\":\"2022-04-05T13:07:16.7796535+00:00\",\"userDisplayName\":\"DUPONT Jean\",\"userPrincipalName\":\"jean.dupont@corp.com\",\"userId\":\"a1c4edf3-59b6-40a8-a1cd-820691c0bab0\",\"appId\":\"00000002-0000-0ff1-ce00-000000000000\",\"appDisplayName\":\"Office 365 Exchange Online\",\"ipAddress\":\"2001:0db8:85a3:0000:0000:8a2e:0370:7334\",\"status\":{\"errorCode\":0},\"clientAppUsed\":\"Exchange Web Services\",\"userAgent\":\"Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.14326; Pro)\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Microsoft Office 16.0\"},\"location\":{\"geoCoordinates\":{}},\"correlationId\":\"7ee10819-f631-4ab1-8edb-4efb7286baba\",\"conditionalAccessStatus\":\"notApplied\",\"appliedConditionalAccessPolicies\":[{\"id\":\"57b51b76-0ff5-41fe-b9be-49449a02e65a\",\"displayName\":\"MFA conditionnel BE\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"ccb983ba-87fb-41bd-bf12-40fd651ff48c\",\"displayName\":\"MFA-Office365-Test\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"3a723733-f1ed-472e-bbe0-51cadafa2a44\",\"displayName\":\"MFA-Docusign-Test\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0}],\"authenticationContextClassReferences\":[],\"originalRequestId\":\"b2fdcc8f-954d-4d88-a035-58daefab4f00\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"[\\\"AuditLog.Create\\\",\\\"Chat.Read\\\",\\\"DataLossPreventionPolicy.Evaluate\\\",\\\"Directory.Read.All\\\",\\\"EduRoster.ReadBasic\\\",\\\"Files.ReadWrite.All\\\",\\\"Group.ReadWrite.All\\\",\\\"InformationProtectionPolicy.Read\\\",\\\"Notes.Create\\\",\\\"OnlineMeetings.Read\\\",\\\"OnlineMeetings.ReadWrite\\\",\\\"People.Read\\\",\\\"SensitiveInfoType.Detect\\\",\\\"SensitiveInfoType.Read.All\\\",\\\"SensitivityLabel.Evaluate\\\",\\\"User.Invite.All\\\",\\\"User.Read\\\",\\\"User.ReadBasic.All\\\"]\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[],\"processingTimeInMilliseconds\":143,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Office 365 Exchange Online\",\"resourceId\":\"00000002-0000-0ff1-ce00-000000000000\",\"resourceTenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"homeTenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-04-05T13:07:16.7796535+00:00\",\"authenticationMethod\":\"Password\",\"authenticationMethodDetail\":\"Password Hash Sync\",\"succeeded\":true,\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":1}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"alternateSignInName\":\"jean.dupont@corp.com\",\"signInIdentifier\":\"jean.dupont@corp.com\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"11111111111111111111111111\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"ropc\",\"appServicePrincipalId\":null,\"resourceServicePrincipalId\":\"51e8e487-e7b3-4d36-ae84-13f30beca934\"}}",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"@timestamp": "2022-04-05T13:07:16.779653Z",
"action": {
"name": "Sign-in activity",
"outcome": "success"
},
"azuread": {
"Level": 4,
"authenticationDetails": [
{
"RequestSequence": 1,
"StatusSequence": 0,
"authenticationMethod": "Password",
"authenticationMethodDetail": "Password Hash Sync",
"authenticationStepDateTime": "2022-04-05T13:07:16.7796535+00:00",
"authenticationStepRequirement": "Primary authentication",
"succeeded": true
}
],
"callerIpAddress": "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
"category": "SignInLogs",
"correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
"durationMs": 0,
"identity": "DUPONT Jean",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office 365 Exchange Online",
"appId": "00000002-0000-0ff1-ce00-000000000000",
"authenticationProtocol": "ropc",
"correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
"id": "b2fdcc8f-954d-4d88-a035-58daefab4f00",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0"
}
},
"resourceId": "/tenants/e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2/providers/Microsoft.aadiam",
"tenantId": "e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2"
},
"error": {
"code": "0"
},
"host": {
"os": {
"type": "Windows 10"
}
},
"related": {
"ip": [
"2001:db8:85a3::8a2e:370:7334"
]
},
"service": {
"name": "Office 365 Exchange Online",
"type": "ldap"
},
"source": {
"address": "2001:db8:85a3::8a2e:370:7334",
"ip": "2001:db8:85a3::8a2e:370:7334"
},
"user": {
"email": "jean.dupont@corp.com",
"full_name": "DUPONT Jean",
"id": "a1c4edf3-59b6-40a8-a1cd-820691c0bab0"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Outlook",
"original": "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.14326; Pro)",
"os": {
"name": "Windows",
"version": "10"
},
"version": "2016"
}
}
{
"message": "{\"time\": \"2019-06-24T09:21:50.0418907Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Remove unverified domain\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"d60a1c27-11fa-4777-a349-c6c26ef33348\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_NFSWZ_16832133\",\"category\": \"DirectoryManagement\",\"correlationId\": \"d60a1c27-11fa-4777-a349-c6c26ef33348\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Remove unverified domain\",\"activityDateTime\": \"2019-06-24T09:21:50.0418907+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Delete\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"use_gmail.com#EXT#@usegmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": null,\"displayName\": \"sekoiacorp.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:21:50.041890Z",
"action": {
"name": "Remove unverified domain",
"outcome": "success",
"properties": [],
"target": "user",
"type": "delete"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "d60a1c27-11fa-4777-a349-c6c26ef33348",
"durationMs": 0,
"operationName": "Remove unverified domain",
"operationVersion": "1.0",
"properties": {
"correlationId": "d60a1c27-11fa-4777-a349-c6c26ef33348",
"id": "Directory_NFSWZ_16832133"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"use_gmail.com#EXT#@usegmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
"name": "use_gmail.com#EXT#@usegmail.onmicrosoft.com"
}
}
{
"message": "{\"time\":\"2022-03-30T14:52:21.7062186Z\",\"resourceId\":\"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"resultType\":\"50158\",\"resultSignature\":\"None\",\"resultDescription\":\"External security challenge was not satisfied.\",\"durationMs\":0,\"callerIpAddress\":\"11.11.11.11\",\"correlationId\":\"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\",\"identity\":\"User Name\",\"Level\":4,\"location\":\"FR\",\"properties\":{\"id\":\"22253f56-6fc4-45f2-b148-d7fe15504900\",\"createdDateTime\":\"2022-03-30T14:52:21.7062186+00:00\",\"userDisplayName\":\"User Name\",\"userPrincipalName\":\"User.Name@corp.name\",\"userId\":\"469a0b32-4a8d-4b73-89aa-25ab78df7523\",\"appId\":\"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7\",\"appDisplayName\":\"Office365 Shell WCSS-Client\",\"ipAddress\":\"11.11.11.11\",\"status\":{\"errorCode\":50158,\"failureReason\":\"External security challenge was not satisfied.\"},\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Chrome 99.0.4844\"},\"location\":{\"city\":\"Bordeaux\",\"state\":\"Gironde\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"latitude\":44.84040069580078,\"longitude\":-0.5805000066757202}},\"correlationId\":\"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\",\"conditionalAccessStatus\":\"failure\",\"appliedConditionalAccessPolicies\":[{\"id\":\"bc737765-a8db-4902-8000-f389a97feefd\",\"displayName\":\"Check Point Harmony MFA\",\"enforcedGrantControls\":[\"Checkpoint Custom Control\"],\"enforcedSessionControls\":[],\"result\":\"failure\",\"conditionsSatisfied\":3,\"conditionsNotSatisfied\":0},{\"id\":\"174e7650-f969-47fc-bbd5-83e633e0925e\",\"displayName\":\"Access Control Nine Work for Android\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"5fbf9306-99b8-4781-b5fc-81a0787fb289\",\"displayName\":\"Access Control PowerBI (Poste de travail)\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"d1144840-7d4a-44eb-83f1-543c15f89eb8\",\"displayName\":\"Access Control Snowflake\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"90c5434d-decc-4195-b7f9-024cd39fdca4\",\"displayName\":\"Access Control PowerBI (Mobile)\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"989ecd36-d0e1-4990-bd92-b08250fd45f3\",\"displayName\":\"Access Control Gmail\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"fead0f30-10f4-4472-8bc1-c119d511154d\",\"displayName\":\"MFA Cycloid\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"6d0db7f6-3263-48b4-84e9-9c37c3959161\",\"displayName\":\"Block - Webmail Exchange Online\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"0ba349bc-748a-4108-b103-298ccd5b1d3f\",\"displayName\":\"Require MFA - Privileged accounts\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":1,\"conditionsNotSatisfied\":2}],\"originalRequestId\":\"22253f56-6fc4-45f2-b148-d7fe15504900\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Login Hint Present\",\"value\":\"True\"},{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[{\"networkType\":\"trustedNamedLocation\",\"networkNames\":[\"IP corp\"]}],\"processingTimeInMilliseconds\":91,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Office365 Shell WCSS-Server\",\"resourceId\":\"5f09333a-842c-47da-a157-57da27fcbca5\",\"resourceTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"homeTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-03-30T14:52:21.7062186+00:00\",\"authenticationMethod\":\"Previously satisfied\",\"succeeded\":true,\"authenticationStepResultDetail\":\"First factor requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":0}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"autonomousSystemNumber\":48744,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"none\"}}",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"reason": "External security challenge was not satisfied.",
"type": [
"start"
]
},
"@timestamp": "2022-03-30T14:52:21.706218Z",
"action": {
"name": "Sign-in activity",
"outcome": "failure"
},
"azuread": {
"Level": 4,
"authenticationDetails": [
{
"RequestSequence": 0,
"StatusSequence": 0,
"authenticationMethod": "Previously satisfied",
"authenticationStepDateTime": "2022-03-30T14:52:21.7062186+00:00",
"authenticationStepRequirement": "Primary authentication",
"authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
"succeeded": true
}
],
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"durationMs": 0,
"identity": "User Name",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office365 Shell WCSS-Client",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "none",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"id": "22253f56-6fc4-45f2-b148-d7fe15504900",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "50158",
"failureReason": "External security challenge was not satisfied."
}
},
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "50158",
"message": "External security challenge was not satisfied."
},
"host": {
"os": {
"type": "Windows 10"
}
},
"related": {
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Office365 Shell WCSS-Server",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"ip": "11.11.11.11"
},
"user": {
"email": "User.Name@corp.name",
"full_name": "User Name",
"id": "469a0b32-4a8d-4b73-89aa-25ab78df7523"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36",
"os": {
"name": "Windows",
"version": "10"
},
"version": "99.0.4844"
}
}
{
"message": "{\"time\":\"2022-03-31T12:26:46.0190957Z\",\"resourceId\":\"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"resultType\":\"0\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"11.11.11.11\",\"correlationId\":\"467c1340-0762-40d2-b6fb-339235633ebb\",\"identity\":\"Admin Jean Dupont\",\"Level\":4,\"location\":\"FR\",\"properties\":{\"id\":\"8795994f-0bb8-46d7-8797-8c9c385d5900\",\"createdDateTime\":\"2022-03-31T12:26:46.0190957+00:00\",\"userDisplayName\":\"Admin Jean Dupont\",\"userPrincipalName\":\"admin.jdupont@corp.net\",\"userId\":\"16cc2d55-637f-4e04-850d-a1048b659112\",\"appId\":\"0000000c-0000-0000-c000-000000000000\",\"appDisplayName\":\"Microsoft App Access Panel\",\"ipAddress\":\"11.11.11.11\",\"status\":{\"errorCode\":0,\"additionalDetails\":\"MFA requirement satisfied by claim in the token\"},\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Firefox 98.0\"},\"location\":{\"city\":\"Bordeaux\",\"state\":\"Gironde\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"latitude\":44.84040069580078,\"longitude\":-0.5805000066757202}},\"mfaDetail\":{},\"correlationId\":\"467c1340-0762-40d2-b6fb-339235633ebb\",\"conditionalAccessStatus\":\"success\",\"appliedConditionalAccessPolicies\":[{\"id\":\"174e7650-f969-47fc-bbd5-83e633e0925e\",\"displayName\":\"Access Control Nine Work for Android\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"5fbf9306-99b8-4781-b5fc-81a0787fb289\",\"displayName\":\"Access Control PowerBI (Poste de travail)\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"d1144840-7d4a-44eb-83f1-543c15f89eb8\",\"displayName\":\"Access Control Snowflake\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"90c5434d-decc-4195-b7f9-024cd39fdca4\",\"displayName\":\"Access Control PowerBI (Mobile)\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"989ecd36-d0e1-4990-bd92-b08250fd45f3\",\"displayName\":\"Access Control Gmail\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"fead0f30-10f4-4472-8bc1-c119d511154d\",\"displayName\":\"MFA Cycloid\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"bc737765-a8db-4902-8000-f389a97feefd\",\"displayName\":\"Check Point Harmony MFA\",\"enforcedGrantControls\":[\"Checkpoint Custom Control\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"6d0db7f6-3263-48b4-84e9-9c37c3959161\",\"displayName\":\"Block - Webmail Exchange Online\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"0ba349bc-748a-4108-b103-298ccd5b1d3f\",\"displayName\":\"Require MFA - Privileged accounts\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":3,\"conditionsNotSatisfied\":8}],\"originalRequestId\":\"8795994f-0bb8-46d7-8797-8c9c385d5900\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[{\"networkType\":\"trustedNamedLocation\",\"networkNames\":[\"IP network\"]}],\"processingTimeInMilliseconds\":80,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Windows Azure Active Directory\",\"resourceId\":\"00000002-0000-0000-c000-000000000000\",\"resourceTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"homeTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-03-31T12:26:46.0190957+00:00\",\"authenticationMethod\":\"Previously satisfied\",\"succeeded\":true,\"authenticationStepResultDetail\":\"First factor requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":0}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"autonomousSystemNumber\":48744,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"ODc5NTk5NGYtMGJiOC00NmQ3LTg3OTctOGM5YzM4NWQ1OTAw\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"none\"}}",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"@timestamp": "2022-03-31T12:26:46.019095Z",
"action": {
"name": "Sign-in activity",
"outcome": "success"
},
"azuread": {
"Level": 4,
"authenticationDetails": [
{
"RequestSequence": 0,
"StatusSequence": 0,
"authenticationMethod": "Previously satisfied",
"authenticationStepDateTime": "2022-03-31T12:26:46.0190957+00:00",
"authenticationStepRequirement": "Primary authentication",
"authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
"succeeded": true
}
],
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
"durationMs": 0,
"identity": "Admin Jean Dupont",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft App Access Panel",
"appId": "0000000c-0000-0000-c000-000000000000",
"authenticationProtocol": "none",
"correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
"id": "8795994f-0bb8-46d7-8797-8c9c385d5900",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"additionalDetails": "MFA requirement satisfied by claim in the token",
"errorCode": "0"
}
},
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "0",
"message": "MFA requirement satisfied by claim in the token"
},
"host": {
"os": {
"type": "Windows 10"
}
},
"related": {
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Windows Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"ip": "11.11.11.11"
},
"user": {
"email": "admin.jdupont@corp.net",
"full_name": "Admin Jean Dupont",
"id": "16cc2d55-637f-4e04-850d-a1048b659112"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Firefox",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0",
"os": {
"name": "Windows",
"version": "10"
},
"version": "98.0"
}
}
{
"message": "{\"time\": \"2023-08-16T15:32:05.5772601Z\", \"resourceId\": \"/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam\", \"operationName\": \"Sign-in activity\", \"operationVersion\": \"1.0\", \"category\": \"SignInLogs\", \"tenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"resultType\": \"0\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"1.2.3.4\", \"correlationId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"identity\": \"John DOE\", \"Level\": 4, \"location\": \"FR\", \"properties\": {\"id\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"createdDateTime\": \"2023-08-16T15:28:23.3045933+00:00\", \"userDisplayName\": \"John DOE\", \"userPrincipalName\": \"john.doe@example.org\", \"userId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"appId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"appDisplayName\": \"Microsoft Authentication Broker\", \"ipAddress\": \"1.2.3.4\", \"status\": {\"errorCode\": 0, \"additionalDetails\": \"MFA completed in Azure AD\"}, \"clientAppUsed\": \"Mobile Apps and Desktop clients\", \"userAgent\": \"Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\", \"deviceDetail\": {\"deviceId\": \"\", \"operatingSystem\": \"Ios\", \"browser\": \"Mobile Safari 16.6\"}, \"location\": {\"city\": \"Paris\", \"state\": \"Paris\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"latitude\": 48.856578, \"longitude\": 2.351828}}, \"mfaDetail\": {\"authMethod\": \"Mobile app notification\"}, \"correlationId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"conditionalAccessStatus\": \"notApplied\", \"appliedConditionalAccessPolicies\": [], \"authenticationContextClassReferences\": [], \"originalRequestId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"isInteractive\": true, \"tokenIssuerName\": \"\", \"tokenIssuerType\": \"AzureAD\", \"authenticationProcessingDetails\": [{\"key\": \"Domain Hint Present\", \"value\": \"True\"}, {\"key\": \"Login Hint Present\", \"value\": \"True\"}, {\"key\": \"Legacy TLS (TLS 1.0, 1.1, 3DES)\", \"value\": \"False\"}, {\"key\": \"Is CAE Token\", \"value\": \"False\"}], \"networkLocationDetails\": [{\"networkType\": \"namedNetwork\", \"networkNames\": [\"Fra\"]}], \"clientCredentialType\": \"none\", \"processingTimeInMilliseconds\": 77, \"riskDetail\": \"none\", \"riskLevelAggregated\": \"none\", \"riskLevelDuringSignIn\": \"none\", \"riskState\": \"none\", \"riskEventTypes\": [], \"riskEventTypes_v2\": [], \"resourceId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"resourceTenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"homeTenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"tenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"authenticationDetails\": [{\"authenticationStepDateTime\": \"2023-08-16T15:28:23.3045933+00:00\", \"authenticationMethod\": \"Password\", \"authenticationMethodDetail\": \"Pass-through Authentication\", \"succeeded\": true, \"authenticationStepRequirement\": \"Primary authentication\", \"StatusSequence\": 0, \"RequestSequence\": 1}, {\"authenticationStepDateTime\": \"2023-08-16T15:28:22+00:00\", \"authenticationMethod\": \"Mobile app notification\", \"succeeded\": true, \"authenticationStepResultDetail\": \"MFA successfully completed\", \"authenticationStepRequirement\": \"Primary authentication\", \"StatusSequence\": 1692199702901, \"RequestSequence\": 1692199690724}], \"authenticationRequirementPolicies\": [{\"requirementProvider\": \"user\", \"detail\": \"Per-user MFA\"}], \"sessionLifetimePolicies\": [{\"expirationRequirement\": \"rememberMultifactorAuthenticationOnTrustedDevices\", \"detail\": \"Remember MFA\"}], \"authenticationRequirement\": \"multiFactorAuthentication\", \"alternateSignInName\": \"john.doe@example.org\", \"signInIdentifier\": \"john.doe@example.org\", \"servicePrincipalId\": \"\", \"userType\": \"Member\", \"flaggedForReview\": false, \"isTenantRestricted\": false, \"autonomousSystemNumber\": 1111, \"crossTenantAccessType\": \"none\", \"privateLinkDetails\": {}, \"ssoExtensionVersion\": \"\", \"uniqueTokenIdentifier\": \"5555555555555555555555\", \"authenticationStrengths\": [], \"incomingTokenType\": \"none\", \"authenticationProtocol\": \"none\", \"appServicePrincipalId\": null, \"resourceServicePrincipalId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"rngcStatus\": 0}}",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"@timestamp": "2023-08-16T15:32:05.577260Z",
"action": {
"name": "Sign-in activity",
"outcome": "success"
},
"azuread": {
"Level": 4,
"authenticationDetails": [
{
"RequestSequence": 1,
"StatusSequence": 0,
"authenticationMethod": "Password",
"authenticationMethodDetail": "Pass-through Authentication",
"authenticationStepDateTime": "2023-08-16T15:28:23.3045933+00:00",
"authenticationStepRequirement": "Primary authentication",
"succeeded": true
},
{
"RequestSequence": 1692199690724,
"StatusSequence": 1692199702901,
"authenticationMethod": "Mobile app notification",
"authenticationStepDateTime": "2023-08-16T15:28:22+00:00",
"authenticationStepRequirement": "Primary authentication",
"authenticationStepResultDetail": "MFA successfully completed",
"succeeded": true
}
],
"callerIpAddress": "1.2.3.4",
"category": "SignInLogs",
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"durationMs": 0,
"identity": "John DOE",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft Authentication Broker",
"appId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"authenticationProtocol": "none",
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"id": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"additionalDetails": "MFA completed in Azure AD",
"errorCode": "0"
}
},
"resourceId": "/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam",
"tenantId": "93f63260-ad9a-4087-b7e0-d9010cb919dd"
},
"error": {
"code": "0",
"message": "MFA completed in Azure AD"
},
"host": {
"os": {
"type": "Ios"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "1.2.3.4",
"geo": {
"city_name": "Paris",
"country_iso_code": "FR",
"location": {
"lat": 48.856578,
"lon": 2.351828
},
"region_name": "Paris"
},
"ip": "1.2.3.4"
},
"user": {
"email": "john.doe@example.org",
"full_name": "John DOE",
"id": "93f63260-ad9a-4087-b7e0-d9010cb919dd"
},
"user_agent": {
"device": {
"name": "iPhone"
},
"name": "Mobile Safari UI/WKWebView",
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"os": {
"name": "iOS",
"version": "16.6"
}
}
}
{
"message": "{\"time\": \"2023-10-04T13:09:02.6799940Z\", \"resourceId\": \"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\", \"operationName\": \"Sign-in activity\", \"operationVersion\": \"1.0\", \"category\": \"SignInLogs\", \"tenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"resultType\": \"0\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"11.11.11.11\", \"correlationId\": \"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\", \"identity\": \"DOE Jane\", \"Level\": 4, \"location\": \"FR\", \"properties\": {\"id\": \"e14254f4-4288-4c00-8689-80823c4f4cb5\", \"createdDateTime\": \"2023-10-04T13:06:18.9617194+00:00\", \"userDisplayName\": \"Jane DOE\", \"userPrincipalName\": \"jane.doe@example.org\", \"userId\": \"469a0b32-4a8d-4b73-89aa-25ab78df7523\", \"appId\": \"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7\", \"appDisplayName\": \"Microsoft Authentication Broker\", \"ipAddress\": \"11.11.11.11\", \"status\": {\"errorCode\": 0}, \"clientAppUsed\": \"Mobile Apps and Desktop clients\", \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98\", \"deviceDetail\": {\"deviceId\": \"e14254f4-4288-4c00-8689-80823c4f4cb5\", \"displayName\": \"LPTC-PC1M4VZQ\", \"operatingSystem\": \"Ios\", \"browser\": \"Edge 116.0.1938\", \"isCompliant\": true, \"isManaged\": true, \"trustType\": \"Azure AD joined\"}, \"location\": {\"city\": \"Bordeaux\", \"state\": \"Gironde\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"latitude\": 44.84040069580078, \"longitude\": -0.5805000066757202}}, \"correlationId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"conditionalAccessStatus\": \"notApplied\", \"appliedConditionalAccessPolicies\": [], \"authenticationContextClassReferences\": [], \"originalRequestId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"isInteractive\": true, \"tokenIssuerName\": \"\", \"tokenIssuerType\": \"AzureAD\", \"authenticationProcessingDetails\": [{\"key\": \"Legacy TLS (TLS 1.0, 1.1, 3DES)\", \"value\": \"False\"}, {\"key\": \"Is CAE Token\", \"value\": \"False\"}], \"networkLocationDetails\": [], \"clientCredentialType\": \"none\", \"processingTimeInMilliseconds\": 300, \"riskDetail\": \"none\", \"riskLevelAggregated\": \"none\", \"riskLevelDuringSignIn\": \"none\", \"riskState\": \"none\", \"riskEventTypes\": [], \"riskEventTypes_v2\": [], \"resourceId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"resourceTenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"homeTenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"tenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"authenticationDetails\": [], \"authenticationRequirementPolicies\": [], \"sessionLifetimePolicies\": [], \"authenticationRequirement\": \"singleFactorAuthentication\", \"alternateSignInName\": \"jane.doe@example.org\", \"signInIdentifier\": \"jane.doe@example.org\", \"servicePrincipalId\": \"\", \"userType\": \"Member\", \"flaggedForReview\": false, \"isTenantRestricted\": false, \"autonomousSystemNumber\": 5410, \"crossTenantAccessType\": \"none\", \"privateLinkDetails\": {}, \"ssoExtensionVersion\": \"\", \"uniqueTokenIdentifier\": \"aaaaaaaaaaaaaaaaaaaaaa\", \"authenticationStrengths\": [], \"incomingTokenType\": \"primaryRefreshToken\", \"authenticationProtocol\": \"deviceCode\", \"appServicePrincipalId\": null, \"resourceServicePrincipalId\": \"6c00164d-7ecd-404d-a0e1-0d0d54cf76cd\", \"rngcStatus\": 0, \"signInTokenProtectionStatus\": \"none\", \"originalTransferMethod\": \"none\"}}",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"@timestamp": "2023-10-04T13:09:02.679994Z",
"action": {
"name": "Sign-in activity",
"outcome": "success"
},
"azuread": {
"Level": 4,
"authenticationDetails": [],
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"durationMs": 0,
"identity": "DOE Jane",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft Authentication Broker",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "deviceCode",
"correlationId": "11d70870-823f-4450-828a-aba3cf69af8d",
"deviceDetail": {
"isCompliant": true,
"isManaged": true,
"trustType": "Azure AD joined"
},
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0"
}
},
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "0"
},
"host": {
"hostname": "LPTC-PC1M4VZQ",
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"name": "LPTC-PC1M4VZQ",
"os": {
"type": "Ios"
}
},
"related": {
"hosts": [
"LPTC-PC1M4VZQ"
],
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"ip": "11.11.11.11"
},
"user": {
"email": "jane.doe@example.org",
"full_name": "Jane DOE",
"id": "469a0b32-4a8d-4b73-89aa-25ab78df7523"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Edge",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98",
"os": {
"name": "Windows",
"version": "10"
},
"version": "116.0.1938"
}
}
{
"message": "{\"time\": \"2019-06-24T09:32:07.4637225Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Update StsRefreshTokenValidFrom Timestamp\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_1PF86_84995795\",\"category\": \"UserManagement\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Update StsRefreshTokenValidFrom Timestamp\",\"activityDateTime\": \"2019-06-24T09:32:07.4637225+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Update\",\"initiatedBy\": {\"user\": {\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:32:07.463722Z",
"action": {
"name": "Update StsRefreshTokenValidFrom Timestamp",
"outcome": "success",
"properties": [
{
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com",
"type": "targetedUser"
}
],
"target": "user",
"type": "update"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"durationMs": 0,
"operationName": "Update StsRefreshTokenValidFrom Timestamp",
"operationVersion": "1.0",
"properties": {
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"id": "Directory_1PF86_84995795",
"targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"jean.dupont@usergmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com"
}
}
{
"message": "{\"time\":\"3/24/2022 2:42:35 PM\",\"resourceId\":\"/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam\",\"operationName\":\"User Risk Detection\",\"operationVersion\":\"1.0\",\"category\":\"UserRiskEvents\",\"tenantId\":\"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"11.22.33.44\",\"correlationId\":\"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\",\"identity\":\"bar foo\",\"Level\":4,\"location\":\"fr\",\"properties\":{\"id\":\"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\",\"requestId\":\"d38b6ab7-65b0-419c-b83a-a5787d6fa100\",\"correlationId\":\"325294e4-4026-4cc7-889d-b4be570b3254\",\"riskType\":\"unfamiliarFeatures\",\"riskEventType\":\"unfamiliarFeatures\",\"riskState\":\"dismissed\",\"riskLevel\":\"low\",\"riskDetail\":\"aiConfirmedSigninSafe\",\"source\":\"IdentityProtection\",\"detectionTimingType\":\"realtime\",\"activity\":\"signin\",\"ipAddress\":\"11.22.33.44\",\"location\":{\"city\":\"La Guaiserie\",\"state\":\"Loir-Et-Cher\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"altitude\":0.0,\"latitude\":47.45919,\"longitude\":2.21955}},\"activityDateTime\":\"2022-03-24T14:40:04.234Z\",\"detectedDateTime\":\"2022-03-24T14:40:04.234Z\",\"lastUpdatedDateTime\":\"2022-03-24T14:42:35.066Z\",\"userId\":\"4c64c30a-7a60-4211-bef1-5e4279854e85\",\"userDisplayName\":\"bar foo\",\"userPrincipalName\":\"foo.bar@corp.eu\",\"additionalInfo\":\"[{\\\"Key\\\":\\\"userAgent\\\",\\\"Value\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}]\",\"tokenIssuerType\":\"AzureAD\",\"resourceTenantId\":null,\"homeTenantId\":\"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\",\"userType\":\"member\",\"crossTenantAccessType\":\"none\"}}",
"event": {
"category": [
"iam"
],
"reason": "unfamiliarFeatures",
"type": [
"connection"
]
},
"@timestamp": "2022-03-24T14:42:35Z",
"action": {
"name": "User Risk Detection"
},
"azuread": {
"Level": 4,
"callerIpAddress": "11.22.33.44",
"category": "UserRiskEvents",
"correlationId": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"durationMs": 0,
"identity": "bar foo",
"operationName": "User Risk Detection",
"operationVersion": "1.0",
"properties": {
"activity": "signin",
"correlationId": "325294e4-4026-4cc7-889d-b4be570b3254",
"detectionTimingType": "realtime",
"id": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"requestId": "d38b6ab7-65b0-419c-b83a-a5787d6fa100",
"riskDetail": "aiConfirmedSigninSafe",
"riskEventType": "unfamiliarFeatures",
"riskLevel": "low",
"riskState": "dismissed",
"source": "IdentityProtection"
},
"resourceId": "/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam",
"tenantId": "2d0c1986-ef7b-4bbf-8428-3c837471e7ad"
},
"related": {
"ip": [
"11.22.33.44"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.22.33.44",
"geo": {
"city_name": "La Guaiserie",
"country_iso_code": "fr",
"location": {
"lat": 47.45919,
"lon": 2.21955
},
"region_name": "Loir-Et-Cher"
},
"ip": "11.22.33.44"
},
"user": {
"email": "foo.bar@corp.eu",
"full_name": "bar foo"
},
"user_agent": {
"device": {
"name": "iPhone"
},
"name": "Mobile Safari UI/WKWebView",
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"os": {
"name": "iOS",
"version": "14.4"
}
}
}
{
"message": "{\"time\": \"3/24/2022 2:42:35 PM\", \"resourceId\": \"/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam\", \"operationName\": \"User Risk Detection\", \"operationVersion\": \"1.0\", \"category\": \"UserRiskEvents\", \"tenantId\": \"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"11.22.33.44\", \"correlationId\": \"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\", \"identity\": \"bar foo\", \"Level\": 4, \"location\": \"fr\", \"properties\": {\"id\": \"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\", \"requestId\": \"d38b6ab7-65b0-419c-b83a-a5787d6fa100\", \"correlationId\": \"325294e4-4026-4cc7-889d-b4be570b3254\", \"riskType\": \"unfamiliarFeatures\", \"riskEventType\": \"unfamiliarFeatures\", \"riskState\": \"atRisk\", \"riskLevel\": \"low\", \"riskDetail\": \"none\", \"source\": \"IdentityProtection\", \"detectionTimingType\": \"realtime\", \"activity\": \"signin\", \"ipAddress\": \"11.22.33.44\", \"location\": {\"city\": \"\", \"state\": \"\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"altitude\": 0, \"latitude\": 46, \"longitude\": 2}}, \"activityDateTime\": \"2023-10-26T5:32:08.107Z\", \"detectedDateTime\": \"2023-10-26T5:32:08.107Z\", \"lastUpdatedDateTime\": \"2023-10-26T5:35:05.938Z\", \"userId\": \"4c64c30a-7a60-4211-bef1-5e4279854e85\", \"userDisplayName\": \"bar foo\", \"userPrincipalName\": \"foo.bar@corp.eu\", \"additionalInfo\": \"[{\\\"Key\\\":\\\"riskReasons\\\",\\\"Value\\\":[\\\"UnfamiliarASN\\\",\\\"UnfamiliarBrowser\\\",\\\"UnfamiliarDevice\\\",\\\"UnfamiliarIP\\\",\\\"UnfamiliarLocation\\\",\\\"UnfamiliarEASId\\\",\\\"UnfamiliarTenantIPsubnet\\\"]},{\\\"Key\\\":\\\"userAgent\\\",\\\"Value\\\":\\\"Mozilla/5.0 (Linux; Android 12; CPH2005 Build/RKQ1.211103.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/117.0.0.0 Mobile Safari/537.36 PKeyAuth/1.0\\\"},{\\\"Key\\\":\\\"alertUrl\\\",\\\"Value\\\":null}]\", \"tokenIssuerType\": \"AzureAD\", \"resourceTenantId\": null, \"homeTenantId\": \"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\", \"userType\": \"member\", \"crossTenantAccessType\": \"none\"}}",
"event": {
"category": [
"iam"
],
"reason": "unfamiliarFeatures",
"type": [
"connection"
]
},
"@timestamp": "2022-03-24T14:42:35Z",
"action": {
"name": "User Risk Detection"
},
"azuread": {
"Level": 4,
"callerIpAddress": "11.22.33.44",
"category": "UserRiskEvents",
"correlationId": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"durationMs": 0,
"identity": "bar foo",
"operationName": "User Risk Detection",
"operationVersion": "1.0",
"properties": {
"activity": "signin",
"correlationId": "325294e4-4026-4cc7-889d-b4be570b3254",
"detectionTimingType": "realtime",
"id": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"requestId": "d38b6ab7-65b0-419c-b83a-a5787d6fa100",
"riskDetail": "none",
"riskEventType": "unfamiliarFeatures",
"riskLevel": "low",
"riskReasons": [
"UnfamiliarASN",
"UnfamiliarBrowser",
"UnfamiliarDevice",
"UnfamiliarEASId",
"UnfamiliarIP",
"UnfamiliarLocation",
"UnfamiliarTenantIPsubnet"
],
"riskState": "atRisk",
"source": "IdentityProtection"
},
"resourceId": "/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam",
"tenantId": "2d0c1986-ef7b-4bbf-8428-3c837471e7ad"
},
"related": {
"ip": [
"11.22.33.44"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.22.33.44",
"geo": {
"country_iso_code": "fr",
"location": {
"lat": 46,
"lon": 2
}
},
"ip": "11.22.33.44"
},
"user": {
"email": "foo.bar@corp.eu",
"full_name": "bar foo"
},
"user_agent": {
"device": {
"name": "Oppo CPH2005"
},
"name": "Chrome Mobile WebView",
"original": "Mozilla/5.0 (Linux; Android 12; CPH2005 Build/RKQ1.211103.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/117.0.0.0 Mobile Safari/537.36 PKeyAuth/1.0",
"os": {
"name": "Android",
"version": "12"
},
"version": "117.0.0"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
action.properties |
array |
action.properties |
action.target |
keyword |
action.target |
azuread.Level |
long |
|
azuread.activityDateTime |
keyword |
|
azuread.additionalInfo |
keyword |
|
azuread.authenticationDetails |
array |
|
azuread.authenticationProtocol |
keyword |
|
azuread.authenticationRequirement |
keyword |
|
azuread.authenticationRequirementPolicies |
array |
|
azuread.autonomousSystemNumber |
long |
|
azuread.callerIpAddress |
keyword |
|
azuread.category |
keyword |
|
azuread.correlationId |
keyword |
|
azuread.crossTenantAccessType |
keyword |
|
azuread.detectedDateTime |
keyword |
|
azuread.durationMs |
long |
|
azuread.flaggedForReview |
bool |
|
azuread.homeTenantId |
keyword |
|
azuread.identity |
keyword |
|
azuread.incomingTokenType |
keyword |
|
azuread.isTenantRestricted |
bool |
|
azuread.lastUpdatedDateTime |
keyword |
|
azuread.operationName |
keyword |
|
azuread.operationVersion |
keyword |
|
azuread.privateLinkDetails |
list |
|
azuread.properties.activity |
keyword |
|
azuread.properties.appDisplayName |
keyword |
appDisplayName |
azuread.properties.appId |
keyword |
appId |
azuread.properties.authenticationProtocol |
keyword |
authenticationProtocol |
azuread.properties.correlationId |
keyword |
|
azuread.properties.detectionTimingType |
keyword |
|
azuread.properties.deviceDetail.isCompliant |
bool |
|
azuread.properties.deviceDetail.isManaged |
bool |
|
azuread.properties.deviceDetail.trustType |
keyword |
|
azuread.properties.id |
keyword |
|
azuread.properties.requestId |
keyword |
|
azuread.properties.riskDetail |
keyword |
|
azuread.properties.riskEventType |
keyword |
|
azuread.properties.riskEventTypes |
keyword |
riskEventTypes |
azuread.properties.riskEventTypes_v2 |
keyword |
riskEventTypes_v2 |
azuread.properties.riskLevel |
keyword |
|
azuread.properties.riskLevelAggregated |
keyword |
riskLevelAggregated |
azuread.properties.riskLevelDuringSignIn |
keyword |
riskLevelDuringSignIn |
azuread.properties.riskReasons |
array |
|
azuread.properties.riskState |
keyword |
|
azuread.properties.source |
keyword |
|
azuread.properties.status.additionalDetails |
keyword |
|
azuread.properties.status.errorCode |
keyword |
|
azuread.properties.status.failureReason |
keyword |
|
azuread.properties.targetDevicePrincipalName |
keyword |
|
azuread.properties.targetUserPrincipalName |
keyword |
|
azuread.resourceId |
keyword |
|
azuread.resourceTenantId |
keyword |
|
azuread.resultSignature |
keyword |
|
azuread.servicePrincipalId |
keyword |
|
azuread.ssoExtensionVersion |
keyword |
|
azuread.tenantId |
keyword |
|
azuread.tokenIssuerType |
keyword |
|
azuread.uniqueTokenIdentifier |
keyword |
|
azuread.userType |
keyword |
|
error.code |
keyword |
Error code describing the error. |
error.message |
match_only_text |
Error message. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
host.hostname |
keyword |
Hostname of the host. |
host.id |
keyword |
Unique host id. |
host.os.name |
keyword |
Operating system name, without the version. |
host.os.type |
keyword |
Which commercial OS family (one of: linux, macos, unix or windows). |
service.name |
keyword |
Name of the service. |
service.type |
keyword |
The type of the service. |
source.geo.city_name |
keyword |
City name. |
source.geo.country_iso_code |
keyword |
Country ISO code. |
source.geo.location |
geo_point |
Longitude and latitude. |
source.geo.region_name |
keyword |
Region name. |
source.ip |
ip |
IP address of the source. |
user.email |
keyword |
User email address. |
user.full_name |
keyword |
User's full name, if available. |
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
user_agent.name |
keyword |
Name of the user agent. |
user_agent.original |
keyword |
Unparsed user_agent string. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.
Further Readings
Create the intake
Go to the intake page and create a new intake from the format Microsoft Entra ID (Azure AD).
Create and configure a playbook on Sekoia.io to collect logs from an Azure Event Hub
- In the playbook section, create a playbook with the Trigger module Consume Eventhub messages in Microsoft Azure technology
- Setup Module configuration (= default)
- Setup Trigger configuration:
- Event Hub informations: use the table completed during the creation of the Event Hub.
- Intake informations:
- intake_key = Intake key that can be found on intake page
- intake_server =
https://intake.sekoia.io
Troubleshoot
Go to events page and search events in last 5 minutes by intake key customer.intake_key:"<Your_Intake_Key>"
No events - Please check the configuration and fill the fields with the right information
- It is possible to investigate on the tab Run and see the response by clicking on the module
