Microsoft Entra ID (Azure AD)
Overview
Microsoft Entra ID (Azure AD) is a cloud-based Identity and Rights management service. The service is developed and managed by Microsoft Corp.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake Microsoft Entra ID / Azure AD. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x Microsoft Entra ID / Azure AD on ATT&CK Navigator
Microsoft Entra ID (Azure AD) Abnormal Token
Detects when Microsoft Entra ID (Azure AD) indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Anonymous IP
Detects when Microsoft Entra ID (Azure AD) identifies sign-ins from a risky IP address, for example, using an anonymous browser or VPN. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: advanced
Microsoft Entra ID (Azure AD) Device Code Authentication
Authentication via a device code is designed for use with input constrained devices. This method can however be abused, particularly in social engineering attacks. Whitelisting based on the organisation's practices is likely required to make this rule useful (e.g. excluding the public IP ranges of the organisation, excluding authentications attempt from managed devices, etc.)
- Effort: master
Microsoft Entra ID (Azure AD) Domain Trust Modification
Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Confirm the added or modified target domain/URL is legitimate administrator behavior.
- Effort: elementary
Microsoft Entra ID (Azure AD) Impossible Travel
Detects when Microsoft Entra ID (Azure AD) identifies two user activities (a single or multiple sessions) originating from geographically distant locations within a time period shorter than the time it would have taken the user to travel from the first location to the second. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Leaked Credentials
Detects when Microsoft Entra ID (Azure AD) identifies that the user's valid credentials have been leaked. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) MFA Method Change
This rule detects when an user makes a change to the multifactor authentication methods for their account. In environments where this rule is too noisy, alert filters should be applied, e.g. to focus on privileged accounts, or unusual source network locations.
- Effort: master
Microsoft Entra ID (Azure AD) Malicious IP
Detects when Microsoft Entra ID (Azure AD) identifies a malicious IP address. An IP address is considered malicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Password Spray
Detects when Microsoft Entra ID (Azure AD) indicates that multiple usernames are attacked using common passwords in a unified brute force manner to gain unauthorized access. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Self Service Password Reset In Failure
Detects self-service password reset in failure for various reasons (except licence or policy ones)
- Effort: master
Microsoft Entra ID (Azure AD) Sign-in From Unlikely Country
Detects when Microsoft Entra ID (Azure AD) identifies sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Suspicious Browser
Detects when Microsoft Entra ID (Azure AD) identifies suspicious sign-in activity across multiple tenants from different countries in the same browser. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Suspicious IP
Detects when Microsoft Entra ID (Azure AD) identifies a suspicious IP address. An IP address is considered suspicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Suspicious Inbox Forwarding
Detects when Microsoft Entra ID (Azure AD) identifies suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: master
Microsoft Entra ID (Azure AD) Threat Intelligence
Detects when Microsoft Entra ID (Azure AD) identifies a sign-in activity that is unusual for the given user or is consistent with known attack patterns based on Microsoft's internal and external threat intelligence sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Microsoft Entra ID (Azure AD) Token Issuer Anomaly
Detects when Microsoft Entra ID (Azure AD) indicates that The SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: advanced
Microsoft Entra ID (Azure AD) Unfamiliar Features
Detects when Microsoft Entra ID (Azure AD) identifies sign-ins with characteristics that deviate from past sign-in properties. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).
- Effort: intermediate
Nimbo-C2 User Agent
Nimbo-C2 Uses an unusual User-Agent format in its implants.
- Effort: intermediate
Potential Bazar Loader User-Agents
Detects potential Bazar loader communications through the user-agent
- Effort: elementary
Potential Lemon Duck User-Agent
Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".
- Effort: elementary
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Application logs |
information on AD activities are collected: domain/user/group creation, password change, token update |
Authentication logs |
Azure AD logs provide details on authentication: status, user, IP address |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | `` |
| Category | authentication |
| Type | connection, start |
Event Samples
Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "{\"time\": \"2019-06-24T09:21:27.3694184Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add unverified domain\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"2f006047-a6d9-4fca-847a-fffdb209fa4d\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_5P1YA_52883815\",\"category\": \"DirectoryManagement\",\"correlationId\": \"2f006047-a6d9-4fca-847a-fffdb209fa4d\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Add unverified domain\",\"activityDateTime\": \"2019-06-24T09:21:27.3694184+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": null,\"displayName\": \"examplecorp.onmicrosoft.com\",\"modifiedProperties\": [{\"displayName\": \"Name\",\"oldValue\": \"[\\\"\\\"]\",\"newValue\": \"[\\\"examplecorp.onmicrosoft.com\\\"]\"},{\"displayName\": \"LiveType\",\"oldValue\": \"[\\\"None\\\"]\",\"newValue\": \"[\\\"Managed\\\"]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"Name,LiveType\\\"\"}]}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:21:27.369418Z",
"action": {
"name": "Add unverified domain",
"outcome": "success",
"properties": [
{
"name": "Name",
"newValue": "[\"examplecorp.onmicrosoft.com\"]",
"oldValue": "[\"\"]"
},
{
"name": "LiveType",
"newValue": "[\"Managed\"]",
"oldValue": "[\"None\"]"
}
],
"target": "user",
"type": "add"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "2f006047-a6d9-4fca-847a-fffdb209fa4d",
"durationMs": 0,
"operationName": "Add unverified domain",
"operationVersion": "1.0",
"properties": {
"correlationId": "2f006047-a6d9-4fca-847a-fffdb209fa4d",
"id": "Directory_5P1YA_52883815"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
"name": "exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com"
}
}
{
"message": "{\"category\":\"AuditLogs\",\"correlationId\":\"93154481-5703-42a7-89a5-b7de6fbace8e\",\"durationMs\":0,\"identity\":\"Microsoft Teams Services\",\"level\":\"Informational\",\"operationName\":\"Add member to group\",\"operationVersion\":\"1.0\",\"properties\":{\"activityDateTime\":\"2020-01-02T13:36:37.9515687+00:00\",\"activityDisplayName\":\"Add member to group\",\"additionalDetails\":[{\"key\":\"User-Agent\",\"value\":\"SkypeSpaces/1.0a$*+\"}],\"category\":\"GroupManagement\",\"correlationId\":\"93154481-5703-42a7-89a5-b7de6fbace8e\",\"id\":\"Directory_FI4U8_64698073\",\"initiatedBy\":{\"app\":{\"appId\":null,\"displayName\":\"Microsoft Teams Services\",\"servicePrincipalId\":\"1de0a2d4-340e-4d98-b060-2dec8434481a\",\"servicePrincipalName\":null}},\"loggedByService\":\"Core Directory\",\"operationType\":\"Assign\",\"result\":\"success\",\"resultReason\":\"\",\"targetResources\":[{\"displayName\":null,\"id\":\"e6285600-5ec8-4ea4-89fc-40db84049b26\",\"modifiedProperties\":[{\"displayName\":\"Group.ObjectID\",\"newValue\":\"\\\"f3bccb88-a12b-4bbd-a971-e6e616946872\\\"\",\"oldValue\":null},{\"displayName\":\"Group.DisplayName\",\"newValue\":\"\\\"NEWCORP\\\"\",\"oldValue\":null},{\"displayName\":\"Group.WellKnownObjectName\",\"newValue\":null,\"oldValue\":null}],\"type\":\"User\",\"userPrincipalName\":\"example.user@corp.net\"},{\"displayName\":null,\"groupType\":\"azureAD\",\"id\":\"f3bccb88-a12b-4bbd-a971-e6e616946872\",\"modifiedProperties\":[],\"type\":\"Group\"}]},\"resourceId\":\"/tenants/29218bde-dc31-4e0d-969b-bac924ce3216/providers/Microsoft.aadiam\",\"resultSignature\":\"None\",\"tenantId\":\"29218bde-dc31-4e0d-969b-bac924ce3216\",\"time\":\"2020-01-02T13:36:37.9515687Z\"}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2020-01-02T13:36:37.951568Z",
"action": {
"name": "Add member to group",
"outcome": "success",
"properties": [
{
"name": "Group.ObjectID",
"newValue": "\"f3bccb88-a12b-4bbd-a971-e6e616946872\"",
"oldValue": ""
},
{
"name": "Group.DisplayName",
"newValue": "\"NEWCORP\"",
"oldValue": ""
},
{
"name": "Group.WellKnownObjectName",
"newValue": "",
"oldValue": ""
},
{
"id": "e6285600-5ec8-4ea4-89fc-40db84049b26",
"name": "example.user@corp.net",
"type": "targetedUser"
}
],
"target": "user",
"type": "assign"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "93154481-5703-42a7-89a5-b7de6fbace8e",
"durationMs": 0,
"identity": "Microsoft Teams Services",
"operationName": "Add member to group",
"operationVersion": "1.0",
"properties": {
"correlationId": "93154481-5703-42a7-89a5-b7de6fbace8e",
"id": "Directory_FI4U8_64698073"
},
"resourceId": "/tenants/29218bde-dc31-4e0d-969b-bac924ce3216/providers/Microsoft.aadiam",
"tenantId": "29218bde-dc31-4e0d-969b-bac924ce3216"
},
"related": {
"user": [
"Microsoft Teams Services"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "1de0a2d4-340e-4d98-b060-2dec8434481a",
"name": "Microsoft Teams Services"
}
}
{
"message": "{\"time\": \"2019-06-24T09:18:23.5860200Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add service principal\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"resultDescription\": \"Microsoft.Online.Workflows.SpnValidationException\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"191e390a-0c29-41e1-874b-c57ca3599213\",\"identity\": \"Microsoft Azure AD Internal - Jit Provisioning\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_GMR7H_185505965\",\"category\": \"ApplicationManagement\",\"correlationId\": \"191e390a-0c29-41e1-874b-c57ca3599213\",\"result\": \"failure\",\"resultReason\": \"Microsoft.Online.Workflows.SpnValidationException\",\"activityDisplayName\": \"Add service principal\",\"activityDateTime\": \"2019-06-24T09:18:23.58602+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {},\"targetResources\": [{\"id\": \"224fe45d-b5c4-44e7-ace4-7bea31600122\",\"displayName\": \"Azure AD Identity Protection\",\"type\": \"ServicePrincipal\",\"modifiedProperties\": [{\"displayName\": \"AccountEnabled\",\"oldValue\": \"[]\",\"newValue\": \"[true]\"},{\"displayName\": \"AppAddress\",\"oldValue\": \"[]\",\"newValue\": \"[{\\\"AddressType\\\":0,\\\"Address\\\":\\\"https://main.protectioncenter.ext.azure.com\\\",\\\"ReplyAddressClientType\\\":0},{\\\"AddressType\\\":0,\\\"Address\\\":\\\"https://s2.cloudappdiscovery.ext.azure.com/\\\",\\\"ReplyAddressClientType\\\":0}]\"},{\"displayName\": \"AppPrincipalId\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"fc68d9e5-1f76-45ef-99aa-214805418498\\\"]\"},{\"displayName\": \"DisplayName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"Azure AD Identity Protection\\\"]\"},{\"displayName\": \"ServicePrincipalName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"https://s2.cloudappdiscovery.ext.azure.com/\\\",\\\"https://main.protectioncenter.ext.azure.com\\\",\\\"fc68d9e5-1f76-45ef-99aa-214805418498\\\"]\"},{\"displayName\": \"Credential\",\"oldValue\": \"[]\",\"newValue\": \"[{\\\"CredentialType\\\":2,\\\"KeyStoreId\\\":\\\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\\\",\\\"KeyGroupId\\\":\\\"375eb77d-1d23-462b-9be7-cb51db9123e3\\\"}]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"AccountEnabled, AppAddress, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\\\"\"},{\"displayName\": \"MethodExecutionResult.\",\"oldValue\": null,\"newValue\": \"\\\"Microsoft.Online.Workflows.SpnValidationException\\\"\"},{\"displayName\": \"TargetId.ServicePrincipalNames\",\"oldValue\": null,\"newValue\": \"\\\"https://s2.cloudappdiscovery.ext.azure.com/;https://main.protectioncenter.ext.azure.com;fc68d9e5-1f76-45ef-99aa-214805418498\\\"\"}]}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "failure",
"reason": "Microsoft.Online.Workflows.SpnValidationException"
},
"@timestamp": "2019-06-24T09:18:23.586020Z",
"action": {
"name": "Add service principal",
"outcome": "failure",
"outcome_reason": "Microsoft.Online.Workflows.SpnValidationException",
"properties": [
{
"name": "AccountEnabled",
"newValue": "[true]",
"oldValue": "[]"
},
{
"name": "AppAddress",
"newValue": "[{\"AddressType\":0,\"Address\":\"https://main.protectioncenter.ext.azure.com\",\"ReplyAddressClientType\":0},{\"AddressType\":0,\"Address\":\"https://s2.cloudappdiscovery.ext.azure.com/\",\"ReplyAddressClientType\":0}]",
"oldValue": "[]"
},
{
"name": "AppPrincipalId",
"newValue": "[\"fc68d9e5-1f76-45ef-99aa-214805418498\"]",
"oldValue": "[]"
},
{
"name": "DisplayName",
"newValue": "[\"Azure AD Identity Protection\"]",
"oldValue": "[]"
},
{
"name": "ServicePrincipalName",
"newValue": "[\"https://s2.cloudappdiscovery.ext.azure.com/\",\"https://main.protectioncenter.ext.azure.com\",\"fc68d9e5-1f76-45ef-99aa-214805418498\"]",
"oldValue": "[]"
},
{
"name": "Credential",
"newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"375eb77d-1d23-462b-9be7-cb51db9123e3\"}]",
"oldValue": "[]"
},
{
"name": "MethodExecutionResult.",
"newValue": "\"Microsoft.Online.Workflows.SpnValidationException\"",
"oldValue": ""
},
{
"name": "TargetId.ServicePrincipalNames",
"newValue": "\"https://s2.cloudappdiscovery.ext.azure.com/;https://main.protectioncenter.ext.azure.com;fc68d9e5-1f76-45ef-99aa-214805418498\"",
"oldValue": ""
}
],
"type": "add"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "191e390a-0c29-41e1-874b-c57ca3599213",
"durationMs": 0,
"identity": "Microsoft Azure AD Internal - Jit Provisioning",
"operationName": "Add service principal",
"operationVersion": "1.0",
"properties": {
"correlationId": "191e390a-0c29-41e1-874b-c57ca3599213",
"id": "Directory_GMR7H_185505965"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
}
}
{
"message": "{\"time\": \"2019-06-24T09:29:28.6242725Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add user\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"d40fb664-9901-4cfa-bd3b-afeff8d6b0de\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_HR9C4_45223131\",\"category\": \"UserManagement\",\"correlationId\": \"d40fb664-9901-4cfa-bd3b-afeff8d6b0de\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Add user\",\"activityDateTime\": \"2019-06-24T09:29:28.6242725+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"user_gmail.com#EXT#@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": [{\"displayName\": \"AccountEnabled\",\"oldValue\": \"[]\",\"newValue\": \"[true]\"},{\"displayName\": \"StsRefreshTokensValidFrom\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"2019-06-24T09:29:28Z\\\"]\"},{\"displayName\": \"UserPrincipalName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"jean.dupont@usergmail.onmicrosoft.com\\\"]\"},{\"displayName\": \"UserType\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"Member\\\"]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"AccountEnabled, StsRefreshTokensValidFrom, UserPrincipalName, UserType\\\"\"}]}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:29:28.624272Z",
"action": {
"name": "Add user",
"outcome": "success",
"properties": [
{
"name": "AccountEnabled",
"newValue": "[true]",
"oldValue": "[]"
},
{
"name": "StsRefreshTokensValidFrom",
"newValue": "[\"2019-06-24T09:29:28Z\"]",
"oldValue": "[]"
},
{
"name": "UserPrincipalName",
"newValue": "[\"jean.dupont@usergmail.onmicrosoft.com\"]",
"oldValue": "[]"
},
{
"name": "UserType",
"newValue": "[\"Member\"]",
"oldValue": "[]"
},
{
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com",
"type": "targetedUser"
}
],
"target": "user",
"type": "add"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "d40fb664-9901-4cfa-bd3b-afeff8d6b0de",
"durationMs": 0,
"operationName": "Add user",
"operationVersion": "1.0",
"properties": {
"correlationId": "d40fb664-9901-4cfa-bd3b-afeff8d6b0de",
"id": "Directory_HR9C4_45223131",
"targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"user_gmail.com#EXT#@usergmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
"name": "user_gmail.com#EXT#@usergmail.onmicrosoft.com"
}
}
{
"message": "{\"id\":\"39e3a81e-99b9-4a30-8000-f38a970e5100\",\"createdDateTime\":\"2020-09-28T10:12:41.4104242Z\",\"userDisplayName\":\"Jane Doe\",\"userPrincipalName\":\"jane.doe@sekoiacorp.onmicrosoft.com\",\"userId\":\"913f4b76-e10f-4f1c-aaf1-09356389319b\",\"appId\":\"4345a7b9-9a63-4910-a426-35363201d503\",\"appDisplayName\":\"O365 Suite UX\",\"ipAddress\":\"11.11.11.11\",\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0\",\"correlationId\":\"26e7584c-876b-425f-9119-49b411e21365\",\"conditionalAccessStatus\":\"notApplied\",\"originalRequestId\":\"39e3a81e-99b9-4a30-8000-f38a970e5100\",\"isInteractive\":false,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"processingTimeInMilliseconds\":101,\"riskDetail\":\"hidden\",\"riskLevelAggregated\":\"hidden\",\"riskLevelDuringSignIn\":\"hidden\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Windows Azure Active Directory\",\"resourceId\":\"00000002-0000-0000-c000-000000000000\",\"resourceTenantId\":\"aa09a079-7796-46a8-a4d4-4d21b0dcf1b2\",\"authenticationMethodsUsed\":[],\"authenticationRequirement\":\"multiFactorAuthentication\",\"alternateSignInName\":null,\"servicePrincipalName\":null,\"signInEventTypes\":[],\"servicePrincipalId\":\"\",\"status\":{\"errorCode\":0,\"failureReason\":\"Other.\",\"additionalDetails\":\"MFA requirement satisfied by claim in the token\"},\"deviceDetail\":{\"deviceId\":\"\",\"displayName\":null,\"operatingSystem\":\"Windows 10\",\"browser\":\"Firefox 81.0\",\"isCompliant\":null,\"isManaged\":null,\"trustType\":null},\"location\":{\"city\":\"Paris\",\"state\":\"Paris\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"altitude\":null,\"latitude\":48.861000061035156,\"longitude\":2.3380000591278076}},\"mfaDetail\":{\"authMethod\":null,\"authDetail\":null},\"appliedConditionalAccessPolicies\":[],\"authenticationProcessingDetails\":[{\"key\":\"Login Hint Present\",\"value\":\"True\"},{\"key\":\"IsCAEToken\",\"value\":\"False\"}],\"networkLocationDetails\":[],\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2020-09-28T10:12:41.4104242Z\",\"authenticationMethod\":null,\"authenticationMethodDetail\":null,\"succeeded\":true,\"authenticationStepResultDetail\":\"MFA requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"User\"}],\"authenticationRequirementPolicies\":[]}",
"event": {
"category": [
"authentication"
],
"type": [
"start"
]
},
"@timestamp": "2020-09-28T10:12:41.410424Z",
"action": {
"name": "authentication",
"target": "user"
},
"azuread": {
"authenticationDetails": [
{
"authenticationMethod": null,
"authenticationMethodDetail": null,
"authenticationStepDateTime": "2020-09-28T10:12:41.4104242Z",
"authenticationStepRequirement": "User",
"authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
"succeeded": true
}
],
"authenticationRequirement": "multiFactorAuthentication",
"authenticationRequirementPolicies": [],
"correlationId": "26e7584c-876b-425f-9119-49b411e21365",
"resourceId": "00000002-0000-0000-c000-000000000000",
"resourceTenantId": "aa09a079-7796-46a8-a4d4-4d21b0dcf1b2",
"tokenIssuerType": "AzureAD"
},
"host": {
"os": {
"name": "Windows 10"
}
},
"related": {
"ip": [
"11.11.11.11"
],
"user": [
"jane.doe@sekoiacorp.onmicrosoft.com"
]
},
"service": {
"name": "Windows Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"ip": "11.11.11.11"
},
"user": {
"id": "913f4b76-e10f-4f1c-aaf1-09356389319b",
"name": "jane.doe@sekoiacorp.onmicrosoft.com"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Firefox",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0",
"os": {
"name": "Windows",
"version": "10"
},
"version": "81.0"
}
}
{
"message": "{\"time\": \"2019-06-24T09:32:07.4637225Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Change user password\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_1PF86_84995790\",\"category\": \"UserManagement\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Change user password\",\"activityDateTime\": \"2019-06-24T09:32:07.4637225+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Update\",\"initiatedBy\": {\"user\": {\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:32:07.463722Z",
"action": {
"name": "Change user password",
"outcome": "success",
"properties": [
{
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com",
"type": "targetedUser"
}
],
"target": "user",
"type": "update"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"durationMs": 0,
"operationName": "Change user password",
"operationVersion": "1.0",
"properties": {
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"id": "Directory_1PF86_84995790",
"targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"jean.dupont@usergmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com"
}
}
{
"message": "{\"time\":\"2022-04-05T13:07:16.7796535Z\",\"resourceId\":\"/tenants/e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"resultType\":\"0\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"2001:0db8:85a3:0000:0000:8a2e:0370:7334\",\"correlationId\":\"7ee10819-f631-4ab1-8edb-4efb7286baba\",\"identity\":\"DUPONT Jean\",\"Level\":4,\"properties\":{\"id\":\"b2fdcc8f-954d-4d88-a035-58daefab4f00\",\"createdDateTime\":\"2022-04-05T13:07:16.7796535+00:00\",\"userDisplayName\":\"DUPONT Jean\",\"userPrincipalName\":\"jean.dupont@corp.com\",\"userId\":\"a1c4edf3-59b6-40a8-a1cd-820691c0bab0\",\"appId\":\"00000002-0000-0ff1-ce00-000000000000\",\"appDisplayName\":\"Office 365 Exchange Online\",\"ipAddress\":\"2001:0db8:85a3:0000:0000:8a2e:0370:7334\",\"status\":{\"errorCode\":0},\"clientAppUsed\":\"Exchange Web Services\",\"userAgent\":\"Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.14326; Pro)\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Microsoft Office 16.0\"},\"location\":{\"geoCoordinates\":{}},\"correlationId\":\"7ee10819-f631-4ab1-8edb-4efb7286baba\",\"conditionalAccessStatus\":\"notApplied\",\"appliedConditionalAccessPolicies\":[{\"id\":\"57b51b76-0ff5-41fe-b9be-49449a02e65a\",\"displayName\":\"MFA conditionnel BE\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"ccb983ba-87fb-41bd-bf12-40fd651ff48c\",\"displayName\":\"MFA-Office365-Test\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"3a723733-f1ed-472e-bbe0-51cadafa2a44\",\"displayName\":\"MFA-Docusign-Test\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0}],\"authenticationContextClassReferences\":[],\"originalRequestId\":\"b2fdcc8f-954d-4d88-a035-58daefab4f00\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"[\\\"AuditLog.Create\\\",\\\"Chat.Read\\\",\\\"DataLossPreventionPolicy.Evaluate\\\",\\\"Directory.Read.All\\\",\\\"EduRoster.ReadBasic\\\",\\\"Files.ReadWrite.All\\\",\\\"Group.ReadWrite.All\\\",\\\"InformationProtectionPolicy.Read\\\",\\\"Notes.Create\\\",\\\"OnlineMeetings.Read\\\",\\\"OnlineMeetings.ReadWrite\\\",\\\"People.Read\\\",\\\"SensitiveInfoType.Detect\\\",\\\"SensitiveInfoType.Read.All\\\",\\\"SensitivityLabel.Evaluate\\\",\\\"User.Invite.All\\\",\\\"User.Read\\\",\\\"User.ReadBasic.All\\\"]\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[],\"processingTimeInMilliseconds\":143,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Office 365 Exchange Online\",\"resourceId\":\"00000002-0000-0ff1-ce00-000000000000\",\"resourceTenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"homeTenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-04-05T13:07:16.7796535+00:00\",\"authenticationMethod\":\"Password\",\"authenticationMethodDetail\":\"Password Hash Sync\",\"succeeded\":true,\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":1}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"alternateSignInName\":\"jean.dupont@corp.com\",\"signInIdentifier\":\"jean.dupont@corp.com\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"11111111111111111111111111\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"ropc\",\"appServicePrincipalId\":null,\"resourceServicePrincipalId\":\"51e8e487-e7b3-4d36-ae84-13f30beca934\"}}",
"event": {
"category": [
"authentication"
]
},
"@timestamp": "2022-04-05T13:07:16.779653Z",
"action": {
"name": "Sign-in activity"
},
"azuread": {
"Level": 4,
"callerIpAddress": "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
"category": "SignInLogs",
"correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
"durationMs": 0,
"identity": "DUPONT Jean",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office 365 Exchange Online",
"appId": "00000002-0000-0ff1-ce00-000000000000",
"authenticationProtocol": "ropc",
"correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
"id": "b2fdcc8f-954d-4d88-a035-58daefab4f00",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0"
}
},
"resourceId": "/tenants/e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2/providers/Microsoft.aadiam",
"tenantId": "e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2"
},
"error": {
"code": "0"
},
"host": {
"os": {
"type": "Windows 10"
}
},
"related": {
"ip": [
"2001:db8:85a3::8a2e:370:7334"
]
},
"service": {
"name": "Office 365 Exchange Online",
"type": "ldap"
},
"source": {
"address": "2001:db8:85a3::8a2e:370:7334",
"ip": "2001:db8:85a3::8a2e:370:7334"
},
"user": {
"email": "jean.dupont@corp.com",
"full_name": "DUPONT Jean"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Outlook",
"original": "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.14326; Pro)",
"os": {
"name": "Windows",
"version": "10"
},
"version": "2016"
}
}
{
"message": "{\"time\": \"2019-06-24T09:21:50.0418907Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Remove unverified domain\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"d60a1c27-11fa-4777-a349-c6c26ef33348\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_NFSWZ_16832133\",\"category\": \"DirectoryManagement\",\"correlationId\": \"d60a1c27-11fa-4777-a349-c6c26ef33348\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Remove unverified domain\",\"activityDateTime\": \"2019-06-24T09:21:50.0418907+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Delete\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"use_gmail.com#EXT#@usegmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": null,\"displayName\": \"sekoiacorp.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:21:50.041890Z",
"action": {
"name": "Remove unverified domain",
"outcome": "success",
"properties": [],
"target": "user",
"type": "delete"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "d60a1c27-11fa-4777-a349-c6c26ef33348",
"durationMs": 0,
"operationName": "Remove unverified domain",
"operationVersion": "1.0",
"properties": {
"correlationId": "d60a1c27-11fa-4777-a349-c6c26ef33348",
"id": "Directory_NFSWZ_16832133"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"use_gmail.com#EXT#@usegmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
"name": "use_gmail.com#EXT#@usegmail.onmicrosoft.com"
}
}
{
"message": "{\"time\":\"2022-03-30T14:52:21.7062186Z\",\"resourceId\":\"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"resultType\":\"50158\",\"resultSignature\":\"None\",\"resultDescription\":\"External security challenge was not satisfied.\",\"durationMs\":0,\"callerIpAddress\":\"11.11.11.11\",\"correlationId\":\"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\",\"identity\":\"User Name\",\"Level\":4,\"location\":\"FR\",\"properties\":{\"id\":\"22253f56-6fc4-45f2-b148-d7fe15504900\",\"createdDateTime\":\"2022-03-30T14:52:21.7062186+00:00\",\"userDisplayName\":\"User Name\",\"userPrincipalName\":\"User.Name@corp.name\",\"userId\":\"469a0b32-4a8d-4b73-89aa-25ab78df7523\",\"appId\":\"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7\",\"appDisplayName\":\"Office365 Shell WCSS-Client\",\"ipAddress\":\"11.11.11.11\",\"status\":{\"errorCode\":50158,\"failureReason\":\"External security challenge was not satisfied.\"},\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Chrome 99.0.4844\"},\"location\":{\"city\":\"Bordeaux\",\"state\":\"Gironde\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"latitude\":44.84040069580078,\"longitude\":-0.5805000066757202}},\"correlationId\":\"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\",\"conditionalAccessStatus\":\"failure\",\"appliedConditionalAccessPolicies\":[{\"id\":\"bc737765-a8db-4902-8000-f389a97feefd\",\"displayName\":\"Check Point Harmony MFA\",\"enforcedGrantControls\":[\"Checkpoint Custom Control\"],\"enforcedSessionControls\":[],\"result\":\"failure\",\"conditionsSatisfied\":3,\"conditionsNotSatisfied\":0},{\"id\":\"174e7650-f969-47fc-bbd5-83e633e0925e\",\"displayName\":\"Access Control Nine Work for Android\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"5fbf9306-99b8-4781-b5fc-81a0787fb289\",\"displayName\":\"Access Control PowerBI (Poste de travail)\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"d1144840-7d4a-44eb-83f1-543c15f89eb8\",\"displayName\":\"Access Control Snowflake\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"90c5434d-decc-4195-b7f9-024cd39fdca4\",\"displayName\":\"Access Control PowerBI (Mobile)\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"989ecd36-d0e1-4990-bd92-b08250fd45f3\",\"displayName\":\"Access Control Gmail\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"fead0f30-10f4-4472-8bc1-c119d511154d\",\"displayName\":\"MFA Cycloid\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"6d0db7f6-3263-48b4-84e9-9c37c3959161\",\"displayName\":\"Block - Webmail Exchange Online\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"0ba349bc-748a-4108-b103-298ccd5b1d3f\",\"displayName\":\"Require MFA - Privileged accounts\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":1,\"conditionsNotSatisfied\":2}],\"originalRequestId\":\"22253f56-6fc4-45f2-b148-d7fe15504900\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Login Hint Present\",\"value\":\"True\"},{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[{\"networkType\":\"trustedNamedLocation\",\"networkNames\":[\"IP corp\"]}],\"processingTimeInMilliseconds\":91,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Office365 Shell WCSS-Server\",\"resourceId\":\"5f09333a-842c-47da-a157-57da27fcbca5\",\"resourceTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"homeTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-03-30T14:52:21.7062186+00:00\",\"authenticationMethod\":\"Previously satisfied\",\"succeeded\":true,\"authenticationStepResultDetail\":\"First factor requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":0}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"autonomousSystemNumber\":48744,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"none\"}}",
"event": {
"category": [
"authentication"
],
"reason": "External security challenge was not satisfied."
},
"@timestamp": "2022-03-30T14:52:21.706218Z",
"action": {
"name": "Sign-in activity"
},
"azuread": {
"Level": 4,
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"durationMs": 0,
"identity": "User Name",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office365 Shell WCSS-Client",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "none",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"id": "22253f56-6fc4-45f2-b148-d7fe15504900",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "50158",
"failureReason": "External security challenge was not satisfied."
}
},
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "50158",
"message": "External security challenge was not satisfied."
},
"host": {
"os": {
"type": "Windows 10"
}
},
"related": {
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Office365 Shell WCSS-Server",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"ip": "11.11.11.11"
},
"user": {
"email": "User.Name@corp.name",
"full_name": "User Name"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36",
"os": {
"name": "Windows",
"version": "10"
},
"version": "99.0.4844"
}
}
{
"message": "{\"time\":\"2022-03-31T12:26:46.0190957Z\",\"resourceId\":\"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"resultType\":\"0\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"11.11.11.11\",\"correlationId\":\"467c1340-0762-40d2-b6fb-339235633ebb\",\"identity\":\"Admin Jean Dupont\",\"Level\":4,\"location\":\"FR\",\"properties\":{\"id\":\"8795994f-0bb8-46d7-8797-8c9c385d5900\",\"createdDateTime\":\"2022-03-31T12:26:46.0190957+00:00\",\"userDisplayName\":\"Admin Jean Dupont\",\"userPrincipalName\":\"admin.jdupont@corp.net\",\"userId\":\"16cc2d55-637f-4e04-850d-a1048b659112\",\"appId\":\"0000000c-0000-0000-c000-000000000000\",\"appDisplayName\":\"Microsoft App Access Panel\",\"ipAddress\":\"11.11.11.11\",\"status\":{\"errorCode\":0,\"additionalDetails\":\"MFA requirement satisfied by claim in the token\"},\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Firefox 98.0\"},\"location\":{\"city\":\"Bordeaux\",\"state\":\"Gironde\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"latitude\":44.84040069580078,\"longitude\":-0.5805000066757202}},\"mfaDetail\":{},\"correlationId\":\"467c1340-0762-40d2-b6fb-339235633ebb\",\"conditionalAccessStatus\":\"success\",\"appliedConditionalAccessPolicies\":[{\"id\":\"174e7650-f969-47fc-bbd5-83e633e0925e\",\"displayName\":\"Access Control Nine Work for Android\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"5fbf9306-99b8-4781-b5fc-81a0787fb289\",\"displayName\":\"Access Control PowerBI (Poste de travail)\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"d1144840-7d4a-44eb-83f1-543c15f89eb8\",\"displayName\":\"Access Control Snowflake\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"90c5434d-decc-4195-b7f9-024cd39fdca4\",\"displayName\":\"Access Control PowerBI (Mobile)\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"989ecd36-d0e1-4990-bd92-b08250fd45f3\",\"displayName\":\"Access Control Gmail\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"fead0f30-10f4-4472-8bc1-c119d511154d\",\"displayName\":\"MFA Cycloid\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"bc737765-a8db-4902-8000-f389a97feefd\",\"displayName\":\"Check Point Harmony MFA\",\"enforcedGrantControls\":[\"Checkpoint Custom Control\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"6d0db7f6-3263-48b4-84e9-9c37c3959161\",\"displayName\":\"Block - Webmail Exchange Online\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"0ba349bc-748a-4108-b103-298ccd5b1d3f\",\"displayName\":\"Require MFA - Privileged accounts\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":3,\"conditionsNotSatisfied\":8}],\"originalRequestId\":\"8795994f-0bb8-46d7-8797-8c9c385d5900\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[{\"networkType\":\"trustedNamedLocation\",\"networkNames\":[\"IP network\"]}],\"processingTimeInMilliseconds\":80,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Windows Azure Active Directory\",\"resourceId\":\"00000002-0000-0000-c000-000000000000\",\"resourceTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"homeTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-03-31T12:26:46.0190957+00:00\",\"authenticationMethod\":\"Previously satisfied\",\"succeeded\":true,\"authenticationStepResultDetail\":\"First factor requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":0}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"autonomousSystemNumber\":48744,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"ODc5NTk5NGYtMGJiOC00NmQ3LTg3OTctOGM5YzM4NWQ1OTAw\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"none\"}}",
"event": {
"category": [
"authentication"
]
},
"@timestamp": "2022-03-31T12:26:46.019095Z",
"action": {
"name": "Sign-in activity"
},
"azuread": {
"Level": 4,
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
"durationMs": 0,
"identity": "Admin Jean Dupont",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft App Access Panel",
"appId": "0000000c-0000-0000-c000-000000000000",
"authenticationProtocol": "none",
"correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
"id": "8795994f-0bb8-46d7-8797-8c9c385d5900",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"additionalDetails": "MFA requirement satisfied by claim in the token",
"errorCode": "0"
}
},
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "0",
"message": "MFA requirement satisfied by claim in the token"
},
"host": {
"os": {
"type": "Windows 10"
}
},
"related": {
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Windows Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"ip": "11.11.11.11"
},
"user": {
"email": "admin.jdupont@corp.net",
"full_name": "Admin Jean Dupont"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Firefox",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0",
"os": {
"name": "Windows",
"version": "10"
},
"version": "98.0"
}
}
{
"message": "{\"time\": \"2023-08-16T15:32:05.5772601Z\", \"resourceId\": \"/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam\", \"operationName\": \"Sign-in activity\", \"operationVersion\": \"1.0\", \"category\": \"SignInLogs\", \"tenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"resultType\": \"0\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"1.2.3.4\", \"correlationId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"identity\": \"John DOE\", \"Level\": 4, \"location\": \"FR\", \"properties\": {\"id\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"createdDateTime\": \"2023-08-16T15:28:23.3045933+00:00\", \"userDisplayName\": \"John DOE\", \"userPrincipalName\": \"john.doe@example.org\", \"userId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"appId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"appDisplayName\": \"Microsoft Authentication Broker\", \"ipAddress\": \"1.2.3.4\", \"status\": {\"errorCode\": 0, \"additionalDetails\": \"MFA completed in Azure AD\"}, \"clientAppUsed\": \"Mobile Apps and Desktop clients\", \"userAgent\": \"Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\", \"deviceDetail\": {\"deviceId\": \"\", \"operatingSystem\": \"Ios\", \"browser\": \"Mobile Safari 16.6\"}, \"location\": {\"city\": \"Paris\", \"state\": \"Paris\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"latitude\": 48.856578, \"longitude\": 2.351828}}, \"mfaDetail\": {\"authMethod\": \"Mobile app notification\"}, \"correlationId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"conditionalAccessStatus\": \"notApplied\", \"appliedConditionalAccessPolicies\": [], \"authenticationContextClassReferences\": [], \"originalRequestId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"isInteractive\": true, \"tokenIssuerName\": \"\", \"tokenIssuerType\": \"AzureAD\", \"authenticationProcessingDetails\": [{\"key\": \"Domain Hint Present\", \"value\": \"True\"}, {\"key\": \"Login Hint Present\", \"value\": \"True\"}, {\"key\": \"Legacy TLS (TLS 1.0, 1.1, 3DES)\", \"value\": \"False\"}, {\"key\": \"Is CAE Token\", \"value\": \"False\"}], \"networkLocationDetails\": [{\"networkType\": \"namedNetwork\", \"networkNames\": [\"Fra\"]}], \"clientCredentialType\": \"none\", \"processingTimeInMilliseconds\": 77, \"riskDetail\": \"none\", \"riskLevelAggregated\": \"none\", \"riskLevelDuringSignIn\": \"none\", \"riskState\": \"none\", \"riskEventTypes\": [], \"riskEventTypes_v2\": [], \"resourceId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"resourceTenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"homeTenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"tenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"authenticationDetails\": [{\"authenticationStepDateTime\": \"2023-08-16T15:28:23.3045933+00:00\", \"authenticationMethod\": \"Password\", \"authenticationMethodDetail\": \"Pass-through Authentication\", \"succeeded\": true, \"authenticationStepRequirement\": \"Primary authentication\", \"StatusSequence\": 0, \"RequestSequence\": 1}, {\"authenticationStepDateTime\": \"2023-08-16T15:28:22+00:00\", \"authenticationMethod\": \"Mobile app notification\", \"succeeded\": true, \"authenticationStepResultDetail\": \"MFA successfully completed\", \"authenticationStepRequirement\": \"Primary authentication\", \"StatusSequence\": 1692199702901, \"RequestSequence\": 1692199690724}], \"authenticationRequirementPolicies\": [{\"requirementProvider\": \"user\", \"detail\": \"Per-user MFA\"}], \"sessionLifetimePolicies\": [{\"expirationRequirement\": \"rememberMultifactorAuthenticationOnTrustedDevices\", \"detail\": \"Remember MFA\"}], \"authenticationRequirement\": \"multiFactorAuthentication\", \"alternateSignInName\": \"john.doe@example.org\", \"signInIdentifier\": \"john.doe@example.org\", \"servicePrincipalId\": \"\", \"userType\": \"Member\", \"flaggedForReview\": false, \"isTenantRestricted\": false, \"autonomousSystemNumber\": 1111, \"crossTenantAccessType\": \"none\", \"privateLinkDetails\": {}, \"ssoExtensionVersion\": \"\", \"uniqueTokenIdentifier\": \"5555555555555555555555\", \"authenticationStrengths\": [], \"incomingTokenType\": \"none\", \"authenticationProtocol\": \"none\", \"appServicePrincipalId\": null, \"resourceServicePrincipalId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"rngcStatus\": 0}}",
"event": {
"category": [
"authentication"
]
},
"@timestamp": "2023-08-16T15:32:05.577260Z",
"action": {
"name": "Sign-in activity"
},
"azuread": {
"Level": 4,
"callerIpAddress": "1.2.3.4",
"category": "SignInLogs",
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"durationMs": 0,
"identity": "John DOE",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft Authentication Broker",
"appId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"authenticationProtocol": "none",
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"id": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"additionalDetails": "MFA completed in Azure AD",
"errorCode": "0"
}
},
"resourceId": "/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam",
"tenantId": "93f63260-ad9a-4087-b7e0-d9010cb919dd"
},
"error": {
"code": "0",
"message": "MFA completed in Azure AD"
},
"host": {
"os": {
"type": "Ios"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "1.2.3.4",
"geo": {
"city_name": "Paris",
"country_iso_code": "FR",
"location": {
"lat": 48.856578,
"lon": 2.351828
},
"region_name": "Paris"
},
"ip": "1.2.3.4"
},
"user": {
"email": "john.doe@example.org",
"full_name": "John DOE"
},
"user_agent": {
"device": {
"name": "iPhone"
},
"name": "Mobile Safari UI/WKWebView",
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"os": {
"name": "iOS",
"version": "16.6"
}
}
}
{
"message": "{\"time\": \"2023-10-04T13:09:02.6799940Z\", \"resourceId\": \"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\", \"operationName\": \"Sign-in activity\", \"operationVersion\": \"1.0\", \"category\": \"SignInLogs\", \"tenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"resultType\": \"0\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"11.11.11.11\", \"correlationId\": \"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\", \"identity\": \"DOE Jane\", \"Level\": 4, \"location\": \"FR\", \"properties\": {\"id\": \"e14254f4-4288-4c00-8689-80823c4f4cb5\", \"createdDateTime\": \"2023-10-04T13:06:18.9617194+00:00\", \"userDisplayName\": \"Jane DOE\", \"userPrincipalName\": \"jane.doe@example.org\", \"userId\": \"469a0b32-4a8d-4b73-89aa-25ab78df7523\", \"appId\": \"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7\", \"appDisplayName\": \"Microsoft Authentication Broker\", \"ipAddress\": \"11.11.11.11\", \"status\": {\"errorCode\": 0}, \"clientAppUsed\": \"Mobile Apps and Desktop clients\", \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98\", \"deviceDetail\": {\"deviceId\": \"e14254f4-4288-4c00-8689-80823c4f4cb5\", \"displayName\": \"LPTC-PC1M4VZQ\", \"operatingSystem\": \"Ios\", \"browser\": \"Edge 116.0.1938\", \"isCompliant\": true, \"isManaged\": true, \"trustType\": \"Azure AD joined\"}, \"location\": {\"city\": \"Bordeaux\", \"state\": \"Gironde\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"latitude\": 44.84040069580078, \"longitude\": -0.5805000066757202}}, \"correlationId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"conditionalAccessStatus\": \"notApplied\", \"appliedConditionalAccessPolicies\": [], \"authenticationContextClassReferences\": [], \"originalRequestId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"isInteractive\": true, \"tokenIssuerName\": \"\", \"tokenIssuerType\": \"AzureAD\", \"authenticationProcessingDetails\": [{\"key\": \"Legacy TLS (TLS 1.0, 1.1, 3DES)\", \"value\": \"False\"}, {\"key\": \"Is CAE Token\", \"value\": \"False\"}], \"networkLocationDetails\": [], \"clientCredentialType\": \"none\", \"processingTimeInMilliseconds\": 300, \"riskDetail\": \"none\", \"riskLevelAggregated\": \"none\", \"riskLevelDuringSignIn\": \"none\", \"riskState\": \"none\", \"riskEventTypes\": [], \"riskEventTypes_v2\": [], \"resourceId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"resourceTenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"homeTenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"tenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"authenticationDetails\": [], \"authenticationRequirementPolicies\": [], \"sessionLifetimePolicies\": [], \"authenticationRequirement\": \"singleFactorAuthentication\", \"alternateSignInName\": \"jane.doe@example.org\", \"signInIdentifier\": \"jane.doe@example.org\", \"servicePrincipalId\": \"\", \"userType\": \"Member\", \"flaggedForReview\": false, \"isTenantRestricted\": false, \"autonomousSystemNumber\": 5410, \"crossTenantAccessType\": \"none\", \"privateLinkDetails\": {}, \"ssoExtensionVersion\": \"\", \"uniqueTokenIdentifier\": \"aaaaaaaaaaaaaaaaaaaaaa\", \"authenticationStrengths\": [], \"incomingTokenType\": \"primaryRefreshToken\", \"authenticationProtocol\": \"deviceCode\", \"appServicePrincipalId\": null, \"resourceServicePrincipalId\": \"6c00164d-7ecd-404d-a0e1-0d0d54cf76cd\", \"rngcStatus\": 0, \"signInTokenProtectionStatus\": \"none\", \"originalTransferMethod\": \"none\"}}",
"event": {
"category": [
"authentication"
]
},
"@timestamp": "2023-10-04T13:09:02.679994Z",
"action": {
"name": "Sign-in activity"
},
"azuread": {
"Level": 4,
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"durationMs": 0,
"identity": "DOE Jane",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft Authentication Broker",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "deviceCode",
"correlationId": "11d70870-823f-4450-828a-aba3cf69af8d",
"deviceDetail": {
"isCompliant": true,
"isManaged": true,
"trustType": "Azure AD joined"
},
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"riskDetail": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0"
}
},
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "0"
},
"host": {
"hostname": "LPTC-PC1M4VZQ",
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"name": "LPTC-PC1M4VZQ",
"os": {
"type": "Ios"
}
},
"related": {
"hosts": [
"LPTC-PC1M4VZQ"
],
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"ip": "11.11.11.11"
},
"user": {
"email": "jane.doe@example.org",
"full_name": "Jane DOE"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Edge",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98",
"os": {
"name": "Windows",
"version": "10"
},
"version": "116.0.1938"
}
}
{
"message": "{\"time\": \"2019-06-24T09:32:07.4637225Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Update StsRefreshTokenValidFrom Timestamp\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_1PF86_84995795\",\"category\": \"UserManagement\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Update StsRefreshTokenValidFrom Timestamp\",\"activityDateTime\": \"2019-06-24T09:32:07.4637225+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Update\",\"initiatedBy\": {\"user\": {\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
"event": {
"category": [
"iam"
],
"outcome": "success"
},
"@timestamp": "2019-06-24T09:32:07.463722Z",
"action": {
"name": "Update StsRefreshTokenValidFrom Timestamp",
"outcome": "success",
"properties": [
{
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com",
"type": "targetedUser"
}
],
"target": "user",
"type": "update"
},
"azuread": {
"category": "AuditLogs",
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"durationMs": 0,
"operationName": "Update StsRefreshTokenValidFrom Timestamp",
"operationVersion": "1.0",
"properties": {
"correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
"id": "Directory_1PF86_84995795",
"targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
},
"resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
"tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
},
"related": {
"user": [
"jean.dupont@usergmail.onmicrosoft.com"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"user": {
"id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
"name": "jean.dupont@usergmail.onmicrosoft.com"
}
}
{
"message": "{\"time\":\"3/24/2022 2:42:35 PM\",\"resourceId\":\"/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam\",\"operationName\":\"User Risk Detection\",\"operationVersion\":\"1.0\",\"category\":\"UserRiskEvents\",\"tenantId\":\"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"11.22.33.44\",\"correlationId\":\"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\",\"identity\":\"bar foo\",\"Level\":4,\"location\":\"fr\",\"properties\":{\"id\":\"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\",\"requestId\":\"d38b6ab7-65b0-419c-b83a-a5787d6fa100\",\"correlationId\":\"325294e4-4026-4cc7-889d-b4be570b3254\",\"riskType\":\"unfamiliarFeatures\",\"riskEventType\":\"unfamiliarFeatures\",\"riskState\":\"dismissed\",\"riskLevel\":\"low\",\"riskDetail\":\"aiConfirmedSigninSafe\",\"source\":\"IdentityProtection\",\"detectionTimingType\":\"realtime\",\"activity\":\"signin\",\"ipAddress\":\"11.22.33.44\",\"location\":{\"city\":\"La Guaiserie\",\"state\":\"Loir-Et-Cher\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"altitude\":0.0,\"latitude\":47.45919,\"longitude\":2.21955}},\"activityDateTime\":\"2022-03-24T14:40:04.234Z\",\"detectedDateTime\":\"2022-03-24T14:40:04.234Z\",\"lastUpdatedDateTime\":\"2022-03-24T14:42:35.066Z\",\"userId\":\"4c64c30a-7a60-4211-bef1-5e4279854e85\",\"userDisplayName\":\"bar foo\",\"userPrincipalName\":\"foo.bar@corp.eu\",\"additionalInfo\":\"[{\\\"Key\\\":\\\"userAgent\\\",\\\"Value\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}]\",\"tokenIssuerType\":\"AzureAD\",\"resourceTenantId\":null,\"homeTenantId\":\"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\",\"userType\":\"member\",\"crossTenantAccessType\":\"none\"}}",
"event": {
"category": [
"iam"
],
"reason": "unfamiliarFeatures",
"type": [
"connection"
]
},
"@timestamp": "2022-03-24T14:42:35Z",
"action": {
"name": "User Risk Detection"
},
"azuread": {
"Level": 4,
"callerIpAddress": "11.22.33.44",
"category": "UserRiskEvents",
"correlationId": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"durationMs": 0,
"identity": "bar foo",
"operationName": "User Risk Detection",
"operationVersion": "1.0",
"properties": {
"activity": "signin",
"correlationId": "325294e4-4026-4cc7-889d-b4be570b3254",
"detectionTimingType": "realtime",
"id": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"requestId": "d38b6ab7-65b0-419c-b83a-a5787d6fa100",
"riskDetail": "aiConfirmedSigninSafe",
"riskEventType": "unfamiliarFeatures",
"riskLevel": "low",
"riskState": "dismissed",
"source": "IdentityProtection"
},
"resourceId": "/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam",
"tenantId": "2d0c1986-ef7b-4bbf-8428-3c837471e7ad"
},
"related": {
"ip": [
"11.22.33.44"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.22.33.44",
"geo": {
"city_name": "La Guaiserie",
"country_iso_code": "fr",
"location": {
"lat": 47.45919,
"lon": 2.21955
},
"region_name": "Loir-Et-Cher"
},
"ip": "11.22.33.44"
},
"user": {
"email": "foo.bar@corp.eu",
"full_name": "bar foo"
},
"user_agent": {
"device": {
"name": "iPhone"
},
"name": "Mobile Safari UI/WKWebView",
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"os": {
"name": "iOS",
"version": "14.4"
}
}
}
{
"message": "{\"time\": \"3/24/2022 2:42:35 PM\", \"resourceId\": \"/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam\", \"operationName\": \"User Risk Detection\", \"operationVersion\": \"1.0\", \"category\": \"UserRiskEvents\", \"tenantId\": \"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"11.22.33.44\", \"correlationId\": \"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\", \"identity\": \"bar foo\", \"Level\": 4, \"location\": \"fr\", \"properties\": {\"id\": \"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\", \"requestId\": \"d38b6ab7-65b0-419c-b83a-a5787d6fa100\", \"correlationId\": \"325294e4-4026-4cc7-889d-b4be570b3254\", \"riskType\": \"unfamiliarFeatures\", \"riskEventType\": \"unfamiliarFeatures\", \"riskState\": \"atRisk\", \"riskLevel\": \"low\", \"riskDetail\": \"none\", \"source\": \"IdentityProtection\", \"detectionTimingType\": \"realtime\", \"activity\": \"signin\", \"ipAddress\": \"11.22.33.44\", \"location\": {\"city\": \"\", \"state\": \"\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"altitude\": 0, \"latitude\": 46, \"longitude\": 2}}, \"activityDateTime\": \"2023-10-26T5:32:08.107Z\", \"detectedDateTime\": \"2023-10-26T5:32:08.107Z\", \"lastUpdatedDateTime\": \"2023-10-26T5:35:05.938Z\", \"userId\": \"4c64c30a-7a60-4211-bef1-5e4279854e85\", \"userDisplayName\": \"bar foo\", \"userPrincipalName\": \"foo.bar@corp.eu\", \"additionalInfo\": \"[{\\\"Key\\\":\\\"riskReasons\\\",\\\"Value\\\":[\\\"UnfamiliarASN\\\",\\\"UnfamiliarBrowser\\\",\\\"UnfamiliarDevice\\\",\\\"UnfamiliarIP\\\",\\\"UnfamiliarLocation\\\",\\\"UnfamiliarEASId\\\",\\\"UnfamiliarTenantIPsubnet\\\"]},{\\\"Key\\\":\\\"userAgent\\\",\\\"Value\\\":\\\"Mozilla/5.0 (Linux; Android 12; CPH2005 Build/RKQ1.211103.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/117.0.0.0 Mobile Safari/537.36 PKeyAuth/1.0\\\"},{\\\"Key\\\":\\\"alertUrl\\\",\\\"Value\\\":null}]\", \"tokenIssuerType\": \"AzureAD\", \"resourceTenantId\": null, \"homeTenantId\": \"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\", \"userType\": \"member\", \"crossTenantAccessType\": \"none\"}}",
"event": {
"category": [
"iam"
],
"reason": "unfamiliarFeatures",
"type": [
"connection"
]
},
"@timestamp": "2022-03-24T14:42:35Z",
"action": {
"name": "User Risk Detection"
},
"azuread": {
"Level": 4,
"callerIpAddress": "11.22.33.44",
"category": "UserRiskEvents",
"correlationId": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"durationMs": 0,
"identity": "bar foo",
"operationName": "User Risk Detection",
"operationVersion": "1.0",
"properties": {
"activity": "signin",
"correlationId": "325294e4-4026-4cc7-889d-b4be570b3254",
"detectionTimingType": "realtime",
"id": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
"requestId": "d38b6ab7-65b0-419c-b83a-a5787d6fa100",
"riskDetail": "none",
"riskEventType": "unfamiliarFeatures",
"riskLevel": "low",
"riskReasons": [
"UnfamiliarASN",
"UnfamiliarBrowser",
"UnfamiliarDevice",
"UnfamiliarEASId",
"UnfamiliarIP",
"UnfamiliarLocation",
"UnfamiliarTenantIPsubnet"
],
"riskState": "atRisk",
"source": "IdentityProtection"
},
"resourceId": "/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam",
"tenantId": "2d0c1986-ef7b-4bbf-8428-3c837471e7ad"
},
"related": {
"ip": [
"11.22.33.44"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.22.33.44",
"geo": {
"country_iso_code": "fr",
"location": {
"lat": 46,
"lon": 2
}
},
"ip": "11.22.33.44"
},
"user": {
"email": "foo.bar@corp.eu",
"full_name": "bar foo"
},
"user_agent": {
"device": {
"name": "Oppo CPH2005"
},
"name": "Chrome Mobile WebView",
"original": "Mozilla/5.0 (Linux; Android 12; CPH2005 Build/RKQ1.211103.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/117.0.0.0 Mobile Safari/537.36 PKeyAuth/1.0",
"os": {
"name": "Android",
"version": "12"
},
"version": "117.0.0"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
action.properties |
array |
action.properties |
action.target |
keyword |
action.target |
azuread.Level |
long |
|
azuread.activityDateTime |
keyword |
|
azuread.additionalInfo |
keyword |
|
azuread.authenticationDetails |
array |
|
azuread.authenticationProtocol |
keyword |
|
azuread.authenticationRequirement |
keyword |
|
azuread.authenticationRequirementPolicies |
array |
|
azuread.autonomousSystemNumber |
long |
|
azuread.callerIpAddress |
keyword |
|
azuread.category |
keyword |
|
azuread.correlationId |
keyword |
|
azuread.crossTenantAccessType |
keyword |
|
azuread.detectedDateTime |
keyword |
|
azuread.durationMs |
long |
|
azuread.flaggedForReview |
bool |
|
azuread.homeTenantId |
keyword |
|
azuread.identity |
keyword |
|
azuread.incomingTokenType |
keyword |
|
azuread.isTenantRestricted |
bool |
|
azuread.lastUpdatedDateTime |
keyword |
|
azuread.operationName |
keyword |
|
azuread.operationVersion |
keyword |
|
azuread.privateLinkDetails |
list |
|
azuread.properties.activity |
keyword |
|
azuread.properties.appDisplayName |
keyword |
appDisplayName |
azuread.properties.appId |
keyword |
appId |
azuread.properties.authenticationProtocol |
keyword |
authenticationProtocol |
azuread.properties.correlationId |
keyword |
|
azuread.properties.detectionTimingType |
keyword |
|
azuread.properties.deviceDetail.isCompliant |
bool |
|
azuread.properties.deviceDetail.isManaged |
bool |
|
azuread.properties.deviceDetail.trustType |
keyword |
|
azuread.properties.id |
keyword |
|
azuread.properties.requestId |
keyword |
|
azuread.properties.riskDetail |
keyword |
|
azuread.properties.riskEventType |
keyword |
|
azuread.properties.riskEventTypes |
keyword |
riskEventTypes |
azuread.properties.riskEventTypes_v2 |
keyword |
riskEventTypes_v2 |
azuread.properties.riskLevel |
keyword |
|
azuread.properties.riskLevelAggregated |
keyword |
riskLevelAggregated |
azuread.properties.riskLevelDuringSignIn |
keyword |
riskLevelDuringSignIn |
azuread.properties.riskReasons |
array |
|
azuread.properties.riskState |
keyword |
|
azuread.properties.source |
keyword |
|
azuread.properties.status.additionalDetails |
keyword |
|
azuread.properties.status.errorCode |
keyword |
|
azuread.properties.status.failureReason |
keyword |
|
azuread.properties.targetDevicePrincipalName |
keyword |
|
azuread.properties.targetUserPrincipalName |
keyword |
|
azuread.resourceId |
keyword |
|
azuread.resourceTenantId |
keyword |
|
azuread.resultSignature |
keyword |
|
azuread.servicePrincipalId |
keyword |
|
azuread.ssoExtensionVersion |
keyword |
|
azuread.tenantId |
keyword |
|
azuread.tokenIssuerType |
keyword |
|
azuread.uniqueTokenIdentifier |
keyword |
|
azuread.userType |
keyword |
|
error.code |
keyword |
Error code describing the error. |
error.message |
match_only_text |
Error message. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
host.hostname |
keyword |
Hostname of the host. |
host.id |
keyword |
Unique host id. |
host.os.name |
keyword |
Operating system name, without the version. |
host.os.type |
keyword |
Which commercial OS family (one of: linux, macos, unix or windows). |
service.name |
keyword |
Name of the service. |
service.type |
keyword |
The type of the service. |
source.geo.city_name |
keyword |
City name. |
source.geo.country_iso_code |
keyword |
Country ISO code. |
source.geo.location |
geo_point |
Longitude and latitude. |
source.geo.region_name |
keyword |
Region name. |
source.ip |
ip |
IP address of the source. |
user.email |
keyword |
User email address. |
user.full_name |
keyword |
User's full name, if available. |
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
user_agent.name |
keyword |
Name of the user agent. |
user_agent.original |
keyword |
Unparsed user_agent string. |
Configure
To forward Microsoft Entra ID (Azure AD) events from Azure to Sekoia.io you need to send your event to an Azure Event Hub where Sekoia.io will collect the events.
Prerequisite
You must have Contributor write on Azure to perform the following installation.
Azure Event Hubs is a cloud-based event streaming platform and event ingestion service provided by Microsoft Azure. It is designed to handle large amounts of event data generated by various applications, devices, and services in real-time. Event Hubs enables you to ingest, process, and store events, logs, telemetry data, and other streaming data for further analysis, monitoring, and processing. Two ways are suggested in order to set up everything you need to forward your events on Sekoia.io.
If you are not an expert and want an easy way to configure the ressources on Azure, we recommend to use to Automatic way as it is easier to set up.
These two ways will create an Azure Event Hub and a Storage Account.
Use the template to create the ressources
To get started, click on the button below and fill the form on Azure to set up the required environment for Sekoia
Some fields must be filled in.
Project details
- Subscription: select the Azure subscription you want to use
- Resource Group: select or create a new Resource Group. A Resource Group is a container that holds related resources
Instance details
- Region: select the appropriated region
- Project Name: give a name for this project. Here is how the names of the resources will be affected by this project name
| Ressource | Name |
|---|---|
| Event Hub Namespace | <project_name>ehns |
| Event Hub | <project_name>eh |
| Shared Access Policy | <project_name>ap |
| Consumer Group | <project_name>cp |
| Storage Account | <project_name>sa |
- Event Hub Sku: Select the messaging tier for Event Hub Namespace between
Basic,StandardorPremium. We do not recommendBasicmodel due to its limitation. Please follow this Microsoft web page to get more information avec the different messaging tier. - Troughput Unit: A unit gives you up to 1 MB/s or 1,000 events per second (whichever comes first) per Event Hub Namespace. Please adapt it to your need.
- Enable Auto Inflate: When checked, the Auto-inflate feature of Event Hubs automatically scales up by increasing the number of troughput units, to meet usage needs.
- Auto Inflate Maximum Throughput Unit: When Enable Auto Inflate is checked, you can specify the maximum throughput units you allow.
- Partition Count: The number of event hub partitions. Microsoft recommends a maximum throughput of 1 MB/s per partition. Unless you plan to add more Event hubs to the Event Hub Namespace, the Partition Count and Throughput Unit variables should have the same values.
- Retention Time: How long you will keep events in the Event hub in days.
Use the output variables to create a Sekoia playbook
When the message Your deployment is complete is displayed, click on Outputs.
Keep these 5 pieces of information displayed carefully, it will used to configure the Trigger Configuration of the Sekoia playbook.
Overview
This setup guide will show you how to create an Event Hub manually.
Theses changes have to be made from the Azure Web Portal.
Some resources created during this procedure are needed to connect Sekoia.io to the Event Hub, you can complete the following table to save all the useful informations for later use.
| Name | Value | Description | Example |
|---|---|---|---|
| hub_name | To be completed at step 3 | Name of the Event Hub | sekoia_event_hub |
| hub_connection_string | To be completed at step 5 | Connection string–primary key | Endpoint=sb://company-eventhub.servicebus.windows.net/;SharedAccessKeyName=sekoiaio;SharedAccessKey=XXXXXX;EntityPath=sekoia_event_hub |
| hub_consumer_group | To be completed at step 6 | Name of the comsumer group | consumergroup_sekoiaio |
| storage_container_name | To be completed at step 7 | Name of your container | sekoiaio |
| storage_connection_string | To be completed at step 8 | Storage connection string | DefaultEndpointsProtocol=https;AccountName=sekoiaiocheckpoint;AccountKey=XXXXX |
As a prerequisite, you need to choose an existing Resource group, or create a new one (e.g. company-resource-group).
Step 1: Find your Subscription ID
- Go to: Home > Cost Management + Billing > Subscriptions.
- From there, keep the relevant “Subscription ID” that will be used along the process.
Step 2: Create Event Hub Namespace
- Navigate to Home > Event Hubs.
- Create an Event Hub Namespace.
- Select your Subscription and your Resource group.
Click on create new if you want your Event Hub Namespace in a new Resource group. - Choose a namespace name.
- Select a location based on your events location.
- Select the pricing tier plan based on your utilisation: Standard or Premimum (We don't recommend to choose the Basic plan due to its limitations.)
- Select the throughput units number based on your events, or enable the auto inflate mode:
1 throughput unit can process up to 1 MB per second or 1000 events per second (whichever comes first).
Step 3: Create Event Hub Instance
When your Event Hub Namespace is created you can create an Event Hub inside:
1. Navigate to Home > Event Hubs > company-eventhubnamespace.
2. Create an Event Hub.
Info
We advise at least the following values:
- cleanup policy: Delete
- retention time: 168h (7 days)
Info
Carefully store the Event Hub name that will be used for sekoia playbook configuration.
Step 4: Create “Shared Access Policies” for the Event Hub
- Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Shared access policies.
-
Create a policy (e.g.
sekoiaio) with the claimsListen.
-
Once created, click on the policy.
Info
Carefully store the connection string–primary key that will be used for sekoia playbook configuration.
Step 5: Create a Consumer group
- Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Consumer groups.
- Create a Consumer group (e.g.
consumergroup_sekoiaio).
Info
Carefully store the Consumer group name that will be used for sekoia playbook configuration.
Step 6: Create a Storage Account with a container
In order to allow Sekoia.io keep track of the consumed events, the next step consists in creating a dedicated Storage account.
- Navigate to Home > Storage accounts.
- Create a Storage account.
- Select your Subscription and your Resource group.
- Choose a Storage account name.
-
Select a Region.
Info
You must choose the Region used during the Event Hub Namespace creation.
-
Select your perfomance and redundancy parameters.
Info
We advise at least the following values:
- performance: standard
- redundancy: Geo-Redundancy storage (GRS)
When your storage account is created you can create an container inside.
1. Navigate to Home > Storage accounts > storageaccoutname | containers.
2. Create an container.
Keep the Public Acces Level to Private.
Info
The container name should be the same as the Event Hub name. Carefully store that container name that will be used for sekoia playbook configuration.
Step 7: Retrieve Connection String
You have to retrieve the connection string from Azure Web Portal.
- Go to Home > Storage accounts > storageaccoutname | Access Keys.
- Click on "Show Keys" on the first Connection String.
Info
Carefully store the Connection String that will be used for sekoia playbook configuration.
Further Readings
Send logs from Microsoft Entra ID (Azure AD) to Azure Event Hub
When you have an Event Hub follow this guide to send your Microsoft Entra ID (Azure AD) events from Azure to the Event Hub:
You need to activate and configure the Microsoft Entra ID (Azure AD) diagnostic settings (e.g. company-ad),
to receive logs from the Microsoft Entra ID (Azure AD) into your Event Hub.
Navigate to Home > Microsoft Entra ID (Azure AD) (e.g. company-ad) > Monitoring > Diagnostic settings:
- Add a new diagnostic setting, and select “Stream to an event hub” and click on configure.
- Select the previously created “Event hubs”, “Event Hub” and “SharedAccessKey” (see step 3 of the event hub guide).
- In the log section, select all log categories (as shown below).
- Choose a name for this configuration and click on “Save”.
Further Readings
Create the intake
Go to the intake page and create a new intake from the format Microsoft Entra ID (Azure AD).
Create and configure a playbook on Sekoia.io to collect logs from an Azure Event Hub
- In the playbook section, create a playbook with the Trigger module Consume Eventhub messages in Microsoft Azure technology
- Setup Module configuration (= default)
- Setup Trigger configuration:
- Event Hub informations: use the table completed during the creation of the Event Hub.
- Intake informations:
- intake_key = Intake key that can be found on intake page
- intake_server =
https://intake.sekoia.io
Troubleshoot
Go to events page and search events in last 5 minutes by intake key customer.intake_key:"<Your_Intake_Key>"
No events - Please check the configuration and fill the fields with the right information
- It is possible to investigate on the tab Run and see the response by clicking on the module
