Skip to content

Microsoft Entra ID (Azure AD)

Overview

Microsoft Entra ID (Azure AD) is a cloud-based Identity and Rights management service. The service is developed and managed by Microsoft Corp.

The following Sekoia.io built-in rules match the intake Microsoft Entra ID / Azure AD. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Microsoft Entra ID / Azure AD on ATT&CK Navigator

Microsoft Entra ID (Azure AD) Abnormal Token

Detects when Microsoft Entra ID (Azure AD) indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: intermediate
Microsoft Entra ID (Azure AD) Anonymous IP

Detects when Microsoft Entra ID (Azure AD) identifies sign-ins from a risky IP address, for example, using an anonymous browser or VPN. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: advanced
Microsoft Entra ID (Azure AD) Device Code Authentication

Authentication via a device code is designed for use with input constrained devices. This method can however be abused, particularly in social engineering attacks. Whitelisting based on the organisation's practices is likely required to make this rule useful (e.g. excluding the public IP ranges of the organisation, excluding authentications attempt from managed devices, etc.)

  • Effort: master
Microsoft Entra ID (Azure AD) Domain Trust Modification

Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Confirm the added or modified target domain/URL is legitimate administrator behavior.

  • Effort: elementary
Microsoft Entra ID (Azure AD) Impossible Travel

Detects when Microsoft Entra ID (Azure AD) identifies two user activities (a single or multiple sessions) originating from geographically distant locations within a time period shorter than the time it would have taken the user to travel from the first location to the second. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: master
Microsoft Entra ID (Azure AD) Leaked Credentials

Detects when Microsoft Entra ID (Azure AD) identifies that the user's valid credentials have been leaked. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: master
Microsoft Entra ID (Azure AD) Malicious IP

Detects when Microsoft Entra ID (Azure AD) identifies a malicious IP address. An IP address is considered malicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: intermediate
Microsoft Entra ID (Azure AD) Password Spray

Detects when Microsoft Entra ID (Azure AD) indicates that multiple usernames are attacked using common passwords in a unified brute force manner to gain unauthorized access. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: intermediate
Microsoft Entra ID (Azure AD) Self Service Password Reset In Failure

Detects self-service password reset in failure for various reasons (except licence or policy ones)

  • Effort: master
Microsoft Entra ID (Azure AD) Sign-in From Unlikely Country

Detects when Microsoft Entra ID (Azure AD) identifies sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: master
Microsoft Entra ID (Azure AD) Suspicious Browser

Detects when Microsoft Entra ID (Azure AD) identifies suspicious sign-in activity across multiple tenants from different countries in the same browser. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: master
Microsoft Entra ID (Azure AD) Suspicious IP

Detects when Microsoft Entra ID (Azure AD) identifies a suspicious IP address. An IP address is considered suspicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: intermediate
Microsoft Entra ID (Azure AD) Suspicious Inbox Forwarding

Detects when Microsoft Entra ID (Azure AD) identifies suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: master
Microsoft Entra ID (Azure AD) Threat Intelligence

Detects when Microsoft Entra ID (Azure AD) identifies a sign-in activity that is unusual for the given user or is consistent with known attack patterns based on Microsoft's internal and external threat intelligence sources. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: intermediate
Microsoft Entra ID (Azure AD) Token Issuer Anomaly

Detects when Microsoft Entra ID (Azure AD) indicates that The SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: advanced
Microsoft Entra ID (Azure AD) Unfamiliar Features

Detects when Microsoft Entra ID (Azure AD) identifies sign-ins with characteristics that deviate from past sign-in properties. To use this feature, you must have an Microsoft Entra ID (Azure AD) Premium P2 license (https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection).

  • Effort: intermediate
Nimbo-C2 User Agent

Nimbo-C2 Uses an unusual User-Agent format in its implants.

  • Effort: intermediate
Potential Bazar Loader User-Agents

Detects potential Bazar loader communications through the user-agent

  • Effort: elementary
Potential Lemon Duck User-Agent

Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".

  • Effort: elementary
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Application logs information on AD activities are collected: domain/user/group creation, password change, token update
Authentication logs Azure AD logs provide details on authentication: status, user, IP address

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind ``
Category authentication
Type connection, start

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "{\"time\": \"2019-06-24T09:21:27.3694184Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add unverified domain\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"2f006047-a6d9-4fca-847a-fffdb209fa4d\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_5P1YA_52883815\",\"category\": \"DirectoryManagement\",\"correlationId\": \"2f006047-a6d9-4fca-847a-fffdb209fa4d\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Add unverified domain\",\"activityDateTime\": \"2019-06-24T09:21:27.3694184+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": null,\"displayName\": \"examplecorp.onmicrosoft.com\",\"modifiedProperties\": [{\"displayName\": \"Name\",\"oldValue\": \"[\\\"\\\"]\",\"newValue\": \"[\\\"examplecorp.onmicrosoft.com\\\"]\"},{\"displayName\": \"LiveType\",\"oldValue\": \"[\\\"None\\\"]\",\"newValue\": \"[\\\"Managed\\\"]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"Name,LiveType\\\"\"}]}],\"additionalDetails\": []}}",
    "event": {
        "category": [
            "iam"
        ],
        "outcome": "success"
    },
    "@timestamp": "2019-06-24T09:21:27.369418Z",
    "action": {
        "name": "Add unverified domain",
        "outcome": "success",
        "properties": [
            {
                "name": "Name",
                "newValue": "[\"examplecorp.onmicrosoft.com\"]",
                "oldValue": "[\"\"]"
            },
            {
                "name": "LiveType",
                "newValue": "[\"Managed\"]",
                "oldValue": "[\"None\"]"
            }
        ],
        "target": "user",
        "type": "add"
    },
    "azuread": {
        "category": "AuditLogs",
        "correlationId": "2f006047-a6d9-4fca-847a-fffdb209fa4d",
        "durationMs": 0,
        "operationName": "Add unverified domain",
        "operationVersion": "1.0",
        "properties": {
            "correlationId": "2f006047-a6d9-4fca-847a-fffdb209fa4d",
            "id": "Directory_5P1YA_52883815"
        },
        "resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
        "tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
    },
    "related": {
        "user": [
            "exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "user": {
        "id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
        "name": "exampleuser_gmail.com#EXT#@exampleuser.onmicrosoft.com"
    }
}
{
    "message": "{\"category\":\"AuditLogs\",\"correlationId\":\"93154481-5703-42a7-89a5-b7de6fbace8e\",\"durationMs\":0,\"identity\":\"Microsoft Teams Services\",\"level\":\"Informational\",\"operationName\":\"Add member to group\",\"operationVersion\":\"1.0\",\"properties\":{\"activityDateTime\":\"2020-01-02T13:36:37.9515687+00:00\",\"activityDisplayName\":\"Add member to group\",\"additionalDetails\":[{\"key\":\"User-Agent\",\"value\":\"SkypeSpaces/1.0a$*+\"}],\"category\":\"GroupManagement\",\"correlationId\":\"93154481-5703-42a7-89a5-b7de6fbace8e\",\"id\":\"Directory_FI4U8_64698073\",\"initiatedBy\":{\"app\":{\"appId\":null,\"displayName\":\"Microsoft Teams Services\",\"servicePrincipalId\":\"1de0a2d4-340e-4d98-b060-2dec8434481a\",\"servicePrincipalName\":null}},\"loggedByService\":\"Core Directory\",\"operationType\":\"Assign\",\"result\":\"success\",\"resultReason\":\"\",\"targetResources\":[{\"displayName\":null,\"id\":\"e6285600-5ec8-4ea4-89fc-40db84049b26\",\"modifiedProperties\":[{\"displayName\":\"Group.ObjectID\",\"newValue\":\"\\\"f3bccb88-a12b-4bbd-a971-e6e616946872\\\"\",\"oldValue\":null},{\"displayName\":\"Group.DisplayName\",\"newValue\":\"\\\"NEWCORP\\\"\",\"oldValue\":null},{\"displayName\":\"Group.WellKnownObjectName\",\"newValue\":null,\"oldValue\":null}],\"type\":\"User\",\"userPrincipalName\":\"example.user@corp.net\"},{\"displayName\":null,\"groupType\":\"azureAD\",\"id\":\"f3bccb88-a12b-4bbd-a971-e6e616946872\",\"modifiedProperties\":[],\"type\":\"Group\"}]},\"resourceId\":\"/tenants/29218bde-dc31-4e0d-969b-bac924ce3216/providers/Microsoft.aadiam\",\"resultSignature\":\"None\",\"tenantId\":\"29218bde-dc31-4e0d-969b-bac924ce3216\",\"time\":\"2020-01-02T13:36:37.9515687Z\"}",
    "event": {
        "category": [
            "iam"
        ],
        "outcome": "success"
    },
    "@timestamp": "2020-01-02T13:36:37.951568Z",
    "action": {
        "name": "Add member to group",
        "outcome": "success",
        "properties": [
            {
                "name": "Group.ObjectID",
                "newValue": "\"f3bccb88-a12b-4bbd-a971-e6e616946872\"",
                "oldValue": ""
            },
            {
                "name": "Group.DisplayName",
                "newValue": "\"NEWCORP\"",
                "oldValue": ""
            },
            {
                "name": "Group.WellKnownObjectName",
                "newValue": "",
                "oldValue": ""
            },
            {
                "id": "e6285600-5ec8-4ea4-89fc-40db84049b26",
                "name": "example.user@corp.net",
                "type": "targetedUser"
            }
        ],
        "target": "user",
        "type": "assign"
    },
    "azuread": {
        "category": "AuditLogs",
        "correlationId": "93154481-5703-42a7-89a5-b7de6fbace8e",
        "durationMs": 0,
        "identity": "Microsoft Teams Services",
        "operationName": "Add member to group",
        "operationVersion": "1.0",
        "properties": {
            "correlationId": "93154481-5703-42a7-89a5-b7de6fbace8e",
            "id": "Directory_FI4U8_64698073"
        },
        "resourceId": "/tenants/29218bde-dc31-4e0d-969b-bac924ce3216/providers/Microsoft.aadiam",
        "tenantId": "29218bde-dc31-4e0d-969b-bac924ce3216"
    },
    "related": {
        "user": [
            "Microsoft Teams Services"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "user": {
        "id": "1de0a2d4-340e-4d98-b060-2dec8434481a",
        "name": "Microsoft Teams Services"
    }
}
{
    "message": "{\"time\": \"2019-06-24T09:18:23.5860200Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add service principal\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"resultDescription\": \"Microsoft.Online.Workflows.SpnValidationException\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"191e390a-0c29-41e1-874b-c57ca3599213\",\"identity\": \"Microsoft Azure AD Internal - Jit Provisioning\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_GMR7H_185505965\",\"category\": \"ApplicationManagement\",\"correlationId\": \"191e390a-0c29-41e1-874b-c57ca3599213\",\"result\": \"failure\",\"resultReason\": \"Microsoft.Online.Workflows.SpnValidationException\",\"activityDisplayName\": \"Add service principal\",\"activityDateTime\": \"2019-06-24T09:18:23.58602+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {},\"targetResources\": [{\"id\": \"224fe45d-b5c4-44e7-ace4-7bea31600122\",\"displayName\": \"Azure AD Identity Protection\",\"type\": \"ServicePrincipal\",\"modifiedProperties\": [{\"displayName\": \"AccountEnabled\",\"oldValue\": \"[]\",\"newValue\": \"[true]\"},{\"displayName\": \"AppAddress\",\"oldValue\": \"[]\",\"newValue\": \"[{\\\"AddressType\\\":0,\\\"Address\\\":\\\"https://main.protectioncenter.ext.azure.com\\\",\\\"ReplyAddressClientType\\\":0},{\\\"AddressType\\\":0,\\\"Address\\\":\\\"https://s2.cloudappdiscovery.ext.azure.com/\\\",\\\"ReplyAddressClientType\\\":0}]\"},{\"displayName\": \"AppPrincipalId\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"fc68d9e5-1f76-45ef-99aa-214805418498\\\"]\"},{\"displayName\": \"DisplayName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"Azure AD Identity Protection\\\"]\"},{\"displayName\": \"ServicePrincipalName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"https://s2.cloudappdiscovery.ext.azure.com/\\\",\\\"https://main.protectioncenter.ext.azure.com\\\",\\\"fc68d9e5-1f76-45ef-99aa-214805418498\\\"]\"},{\"displayName\": \"Credential\",\"oldValue\": \"[]\",\"newValue\": \"[{\\\"CredentialType\\\":2,\\\"KeyStoreId\\\":\\\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\\\",\\\"KeyGroupId\\\":\\\"375eb77d-1d23-462b-9be7-cb51db9123e3\\\"}]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"AccountEnabled, AppAddress, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\\\"\"},{\"displayName\": \"MethodExecutionResult.\",\"oldValue\": null,\"newValue\": \"\\\"Microsoft.Online.Workflows.SpnValidationException\\\"\"},{\"displayName\": \"TargetId.ServicePrincipalNames\",\"oldValue\": null,\"newValue\": \"\\\"https://s2.cloudappdiscovery.ext.azure.com/;https://main.protectioncenter.ext.azure.com;fc68d9e5-1f76-45ef-99aa-214805418498\\\"\"}]}],\"additionalDetails\": []}}",
    "event": {
        "category": [
            "iam"
        ],
        "outcome": "failure",
        "reason": "Microsoft.Online.Workflows.SpnValidationException"
    },
    "@timestamp": "2019-06-24T09:18:23.586020Z",
    "action": {
        "name": "Add service principal",
        "outcome": "failure",
        "outcome_reason": "Microsoft.Online.Workflows.SpnValidationException",
        "properties": [
            {
                "name": "AccountEnabled",
                "newValue": "[true]",
                "oldValue": "[]"
            },
            {
                "name": "AppAddress",
                "newValue": "[{\"AddressType\":0,\"Address\":\"https://main.protectioncenter.ext.azure.com\",\"ReplyAddressClientType\":0},{\"AddressType\":0,\"Address\":\"https://s2.cloudappdiscovery.ext.azure.com/\",\"ReplyAddressClientType\":0}]",
                "oldValue": "[]"
            },
            {
                "name": "AppPrincipalId",
                "newValue": "[\"fc68d9e5-1f76-45ef-99aa-214805418498\"]",
                "oldValue": "[]"
            },
            {
                "name": "DisplayName",
                "newValue": "[\"Azure AD Identity Protection\"]",
                "oldValue": "[]"
            },
            {
                "name": "ServicePrincipalName",
                "newValue": "[\"https://s2.cloudappdiscovery.ext.azure.com/\",\"https://main.protectioncenter.ext.azure.com\",\"fc68d9e5-1f76-45ef-99aa-214805418498\"]",
                "oldValue": "[]"
            },
            {
                "name": "Credential",
                "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"375eb77d-1d23-462b-9be7-cb51db9123e3\"}]",
                "oldValue": "[]"
            },
            {
                "name": "MethodExecutionResult.",
                "newValue": "\"Microsoft.Online.Workflows.SpnValidationException\"",
                "oldValue": ""
            },
            {
                "name": "TargetId.ServicePrincipalNames",
                "newValue": "\"https://s2.cloudappdiscovery.ext.azure.com/;https://main.protectioncenter.ext.azure.com;fc68d9e5-1f76-45ef-99aa-214805418498\"",
                "oldValue": ""
            }
        ],
        "type": "add"
    },
    "azuread": {
        "category": "AuditLogs",
        "correlationId": "191e390a-0c29-41e1-874b-c57ca3599213",
        "durationMs": 0,
        "identity": "Microsoft Azure AD Internal - Jit Provisioning",
        "operationName": "Add service principal",
        "operationVersion": "1.0",
        "properties": {
            "correlationId": "191e390a-0c29-41e1-874b-c57ca3599213",
            "id": "Directory_GMR7H_185505965"
        },
        "resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
        "tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    }
}
{
    "message": "{\"time\": \"2019-06-24T09:29:28.6242725Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Add user\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"d40fb664-9901-4cfa-bd3b-afeff8d6b0de\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_HR9C4_45223131\",\"category\": \"UserManagement\",\"correlationId\": \"d40fb664-9901-4cfa-bd3b-afeff8d6b0de\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Add user\",\"activityDateTime\": \"2019-06-24T09:29:28.6242725+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Add\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"user_gmail.com#EXT#@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": [{\"displayName\": \"AccountEnabled\",\"oldValue\": \"[]\",\"newValue\": \"[true]\"},{\"displayName\": \"StsRefreshTokensValidFrom\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"2019-06-24T09:29:28Z\\\"]\"},{\"displayName\": \"UserPrincipalName\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"jean.dupont@usergmail.onmicrosoft.com\\\"]\"},{\"displayName\": \"UserType\",\"oldValue\": \"[]\",\"newValue\": \"[\\\"Member\\\"]\"},{\"displayName\": \"Included Updated Properties\",\"oldValue\": null,\"newValue\": \"\\\"AccountEnabled, StsRefreshTokensValidFrom, UserPrincipalName, UserType\\\"\"}]}],\"additionalDetails\": []}}",
    "event": {
        "category": [
            "iam"
        ],
        "outcome": "success"
    },
    "@timestamp": "2019-06-24T09:29:28.624272Z",
    "action": {
        "name": "Add user",
        "outcome": "success",
        "properties": [
            {
                "name": "AccountEnabled",
                "newValue": "[true]",
                "oldValue": "[]"
            },
            {
                "name": "StsRefreshTokensValidFrom",
                "newValue": "[\"2019-06-24T09:29:28Z\"]",
                "oldValue": "[]"
            },
            {
                "name": "UserPrincipalName",
                "newValue": "[\"jean.dupont@usergmail.onmicrosoft.com\"]",
                "oldValue": "[]"
            },
            {
                "name": "UserType",
                "newValue": "[\"Member\"]",
                "oldValue": "[]"
            },
            {
                "id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
                "name": "jean.dupont@usergmail.onmicrosoft.com",
                "type": "targetedUser"
            }
        ],
        "target": "user",
        "type": "add"
    },
    "azuread": {
        "category": "AuditLogs",
        "correlationId": "d40fb664-9901-4cfa-bd3b-afeff8d6b0de",
        "durationMs": 0,
        "operationName": "Add user",
        "operationVersion": "1.0",
        "properties": {
            "correlationId": "d40fb664-9901-4cfa-bd3b-afeff8d6b0de",
            "id": "Directory_HR9C4_45223131",
            "targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
        },
        "resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
        "tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
    },
    "related": {
        "user": [
            "user_gmail.com#EXT#@usergmail.onmicrosoft.com"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "user": {
        "id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
        "name": "user_gmail.com#EXT#@usergmail.onmicrosoft.com"
    }
}
{
    "message": "{\"id\":\"39e3a81e-99b9-4a30-8000-f38a970e5100\",\"createdDateTime\":\"2020-09-28T10:12:41.4104242Z\",\"userDisplayName\":\"Jane Doe\",\"userPrincipalName\":\"jane.doe@sekoiacorp.onmicrosoft.com\",\"userId\":\"913f4b76-e10f-4f1c-aaf1-09356389319b\",\"appId\":\"4345a7b9-9a63-4910-a426-35363201d503\",\"appDisplayName\":\"O365 Suite UX\",\"ipAddress\":\"11.11.11.11\",\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0\",\"correlationId\":\"26e7584c-876b-425f-9119-49b411e21365\",\"conditionalAccessStatus\":\"notApplied\",\"originalRequestId\":\"39e3a81e-99b9-4a30-8000-f38a970e5100\",\"isInteractive\":false,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"processingTimeInMilliseconds\":101,\"riskDetail\":\"hidden\",\"riskLevelAggregated\":\"hidden\",\"riskLevelDuringSignIn\":\"hidden\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Windows Azure Active Directory\",\"resourceId\":\"00000002-0000-0000-c000-000000000000\",\"resourceTenantId\":\"aa09a079-7796-46a8-a4d4-4d21b0dcf1b2\",\"authenticationMethodsUsed\":[],\"authenticationRequirement\":\"multiFactorAuthentication\",\"alternateSignInName\":null,\"servicePrincipalName\":null,\"signInEventTypes\":[],\"servicePrincipalId\":\"\",\"status\":{\"errorCode\":0,\"failureReason\":\"Other.\",\"additionalDetails\":\"MFA requirement satisfied by claim in the token\"},\"deviceDetail\":{\"deviceId\":\"\",\"displayName\":null,\"operatingSystem\":\"Windows 10\",\"browser\":\"Firefox 81.0\",\"isCompliant\":null,\"isManaged\":null,\"trustType\":null},\"location\":{\"city\":\"Paris\",\"state\":\"Paris\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"altitude\":null,\"latitude\":48.861000061035156,\"longitude\":2.3380000591278076}},\"mfaDetail\":{\"authMethod\":null,\"authDetail\":null},\"appliedConditionalAccessPolicies\":[],\"authenticationProcessingDetails\":[{\"key\":\"Login Hint Present\",\"value\":\"True\"},{\"key\":\"IsCAEToken\",\"value\":\"False\"}],\"networkLocationDetails\":[],\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2020-09-28T10:12:41.4104242Z\",\"authenticationMethod\":null,\"authenticationMethodDetail\":null,\"succeeded\":true,\"authenticationStepResultDetail\":\"MFA requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"User\"}],\"authenticationRequirementPolicies\":[]}",
    "event": {
        "category": [
            "authentication"
        ],
        "type": [
            "start"
        ]
    },
    "@timestamp": "2020-09-28T10:12:41.410424Z",
    "action": {
        "name": "authentication",
        "target": "user"
    },
    "azuread": {
        "authenticationDetails": [
            {
                "authenticationMethod": null,
                "authenticationMethodDetail": null,
                "authenticationStepDateTime": "2020-09-28T10:12:41.4104242Z",
                "authenticationStepRequirement": "User",
                "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
                "succeeded": true
            }
        ],
        "authenticationRequirement": "multiFactorAuthentication",
        "authenticationRequirementPolicies": [],
        "correlationId": "26e7584c-876b-425f-9119-49b411e21365",
        "resourceId": "00000002-0000-0000-c000-000000000000",
        "resourceTenantId": "aa09a079-7796-46a8-a4d4-4d21b0dcf1b2",
        "tokenIssuerType": "AzureAD"
    },
    "host": {
        "os": {
            "name": "Windows 10"
        }
    },
    "related": {
        "ip": [
            "11.11.11.11"
        ],
        "user": [
            "jane.doe@sekoiacorp.onmicrosoft.com"
        ]
    },
    "service": {
        "name": "Windows Azure Active Directory",
        "type": "ldap"
    },
    "source": {
        "address": "11.11.11.11",
        "ip": "11.11.11.11"
    },
    "user": {
        "id": "913f4b76-e10f-4f1c-aaf1-09356389319b",
        "name": "jane.doe@sekoiacorp.onmicrosoft.com"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Firefox",
        "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0",
        "os": {
            "name": "Windows",
            "version": "10"
        },
        "version": "81.0"
    }
}
{
    "message": "{\"time\": \"2019-06-24T09:32:07.4637225Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Change user password\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_1PF86_84995790\",\"category\": \"UserManagement\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Change user password\",\"activityDateTime\": \"2019-06-24T09:32:07.4637225+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Update\",\"initiatedBy\": {\"user\": {\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
    "event": {
        "category": [
            "iam"
        ],
        "outcome": "success"
    },
    "@timestamp": "2019-06-24T09:32:07.463722Z",
    "action": {
        "name": "Change user password",
        "outcome": "success",
        "properties": [
            {
                "id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
                "name": "jean.dupont@usergmail.onmicrosoft.com",
                "type": "targetedUser"
            }
        ],
        "target": "user",
        "type": "update"
    },
    "azuread": {
        "category": "AuditLogs",
        "correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
        "durationMs": 0,
        "operationName": "Change user password",
        "operationVersion": "1.0",
        "properties": {
            "correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
            "id": "Directory_1PF86_84995790",
            "targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
        },
        "resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
        "tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
    },
    "related": {
        "user": [
            "jean.dupont@usergmail.onmicrosoft.com"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "user": {
        "id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
        "name": "jean.dupont@usergmail.onmicrosoft.com"
    }
}
{
    "message": "{\"time\":\"2022-04-05T13:07:16.7796535Z\",\"resourceId\":\"/tenants/e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"resultType\":\"0\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"2001:0db8:85a3:0000:0000:8a2e:0370:7334\",\"correlationId\":\"7ee10819-f631-4ab1-8edb-4efb7286baba\",\"identity\":\"DUPONT Jean\",\"Level\":4,\"properties\":{\"id\":\"b2fdcc8f-954d-4d88-a035-58daefab4f00\",\"createdDateTime\":\"2022-04-05T13:07:16.7796535+00:00\",\"userDisplayName\":\"DUPONT Jean\",\"userPrincipalName\":\"jean.dupont@corp.com\",\"userId\":\"a1c4edf3-59b6-40a8-a1cd-820691c0bab0\",\"appId\":\"00000002-0000-0ff1-ce00-000000000000\",\"appDisplayName\":\"Office 365 Exchange Online\",\"ipAddress\":\"2001:0db8:85a3:0000:0000:8a2e:0370:7334\",\"status\":{\"errorCode\":0},\"clientAppUsed\":\"Exchange Web Services\",\"userAgent\":\"Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.14326; Pro)\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Microsoft Office 16.0\"},\"location\":{\"geoCoordinates\":{}},\"correlationId\":\"7ee10819-f631-4ab1-8edb-4efb7286baba\",\"conditionalAccessStatus\":\"notApplied\",\"appliedConditionalAccessPolicies\":[{\"id\":\"57b51b76-0ff5-41fe-b9be-49449a02e65a\",\"displayName\":\"MFA conditionnel BE\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"ccb983ba-87fb-41bd-bf12-40fd651ff48c\",\"displayName\":\"MFA-Office365-Test\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"3a723733-f1ed-472e-bbe0-51cadafa2a44\",\"displayName\":\"MFA-Docusign-Test\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0}],\"authenticationContextClassReferences\":[],\"originalRequestId\":\"b2fdcc8f-954d-4d88-a035-58daefab4f00\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"[\\\"AuditLog.Create\\\",\\\"Chat.Read\\\",\\\"DataLossPreventionPolicy.Evaluate\\\",\\\"Directory.Read.All\\\",\\\"EduRoster.ReadBasic\\\",\\\"Files.ReadWrite.All\\\",\\\"Group.ReadWrite.All\\\",\\\"InformationProtectionPolicy.Read\\\",\\\"Notes.Create\\\",\\\"OnlineMeetings.Read\\\",\\\"OnlineMeetings.ReadWrite\\\",\\\"People.Read\\\",\\\"SensitiveInfoType.Detect\\\",\\\"SensitiveInfoType.Read.All\\\",\\\"SensitivityLabel.Evaluate\\\",\\\"User.Invite.All\\\",\\\"User.Read\\\",\\\"User.ReadBasic.All\\\"]\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[],\"processingTimeInMilliseconds\":143,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Office 365 Exchange Online\",\"resourceId\":\"00000002-0000-0ff1-ce00-000000000000\",\"resourceTenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"homeTenantId\":\"e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-04-05T13:07:16.7796535+00:00\",\"authenticationMethod\":\"Password\",\"authenticationMethodDetail\":\"Password Hash Sync\",\"succeeded\":true,\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":1}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"alternateSignInName\":\"jean.dupont@corp.com\",\"signInIdentifier\":\"jean.dupont@corp.com\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"11111111111111111111111111\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"ropc\",\"appServicePrincipalId\":null,\"resourceServicePrincipalId\":\"51e8e487-e7b3-4d36-ae84-13f30beca934\"}}",
    "event": {
        "category": [
            "authentication"
        ]
    },
    "@timestamp": "2022-04-05T13:07:16.779653Z",
    "action": {
        "name": "Sign-in activity"
    },
    "azuread": {
        "Level": 4,
        "callerIpAddress": "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
        "category": "SignInLogs",
        "correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
        "durationMs": 0,
        "identity": "DUPONT Jean",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "properties": {
            "appDisplayName": "Office 365 Exchange Online",
            "appId": "00000002-0000-0ff1-ce00-000000000000",
            "authenticationProtocol": "ropc",
            "correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
            "id": "b2fdcc8f-954d-4d88-a035-58daefab4f00",
            "riskDetail": "none",
            "riskEventTypes": [],
            "riskEventTypes_v2": [],
            "riskLevelAggregated": "none",
            "riskLevelDuringSignIn": "none",
            "riskState": "none",
            "status": {
                "errorCode": "0"
            }
        },
        "resourceId": "/tenants/e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2/providers/Microsoft.aadiam",
        "tenantId": "e6eb2b5c-ad71-4c33-9856-1ed49b85bfe2"
    },
    "error": {
        "code": "0"
    },
    "host": {
        "os": {
            "type": "Windows 10"
        }
    },
    "related": {
        "ip": [
            "2001:db8:85a3::8a2e:370:7334"
        ]
    },
    "service": {
        "name": "Office 365 Exchange Online",
        "type": "ldap"
    },
    "source": {
        "address": "2001:db8:85a3::8a2e:370:7334",
        "ip": "2001:db8:85a3::8a2e:370:7334"
    },
    "user": {
        "email": "jean.dupont@corp.com",
        "full_name": "DUPONT Jean"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Outlook",
        "original": "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.14326; Pro)",
        "os": {
            "name": "Windows",
            "version": "10"
        },
        "version": "2016"
    }
}
{
    "message": "{\"time\": \"2019-06-24T09:21:50.0418907Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Remove unverified domain\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"d60a1c27-11fa-4777-a349-c6c26ef33348\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_NFSWZ_16832133\",\"category\": \"DirectoryManagement\",\"correlationId\": \"d60a1c27-11fa-4777-a349-c6c26ef33348\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Remove unverified domain\",\"activityDateTime\": \"2019-06-24T09:21:50.0418907+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Delete\",\"initiatedBy\": {\"user\": {\"id\": \"158c144c-4c1d-4eb4-be08-f2732c8338fd\",\"displayName\": null,\"userPrincipalName\": \"use_gmail.com#EXT#@usegmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": null,\"displayName\": \"sekoiacorp.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
    "event": {
        "category": [
            "iam"
        ],
        "outcome": "success"
    },
    "@timestamp": "2019-06-24T09:21:50.041890Z",
    "action": {
        "name": "Remove unverified domain",
        "outcome": "success",
        "properties": [],
        "target": "user",
        "type": "delete"
    },
    "azuread": {
        "category": "AuditLogs",
        "correlationId": "d60a1c27-11fa-4777-a349-c6c26ef33348",
        "durationMs": 0,
        "operationName": "Remove unverified domain",
        "operationVersion": "1.0",
        "properties": {
            "correlationId": "d60a1c27-11fa-4777-a349-c6c26ef33348",
            "id": "Directory_NFSWZ_16832133"
        },
        "resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
        "tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
    },
    "related": {
        "user": [
            "use_gmail.com#EXT#@usegmail.onmicrosoft.com"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "user": {
        "id": "158c144c-4c1d-4eb4-be08-f2732c8338fd",
        "name": "use_gmail.com#EXT#@usegmail.onmicrosoft.com"
    }
}
{
    "message": "{\"time\":\"2022-03-30T14:52:21.7062186Z\",\"resourceId\":\"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"resultType\":\"50158\",\"resultSignature\":\"None\",\"resultDescription\":\"External security challenge was not satisfied.\",\"durationMs\":0,\"callerIpAddress\":\"11.11.11.11\",\"correlationId\":\"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\",\"identity\":\"User Name\",\"Level\":4,\"location\":\"FR\",\"properties\":{\"id\":\"22253f56-6fc4-45f2-b148-d7fe15504900\",\"createdDateTime\":\"2022-03-30T14:52:21.7062186+00:00\",\"userDisplayName\":\"User Name\",\"userPrincipalName\":\"User.Name@corp.name\",\"userId\":\"469a0b32-4a8d-4b73-89aa-25ab78df7523\",\"appId\":\"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7\",\"appDisplayName\":\"Office365 Shell WCSS-Client\",\"ipAddress\":\"11.11.11.11\",\"status\":{\"errorCode\":50158,\"failureReason\":\"External security challenge was not satisfied.\"},\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Chrome 99.0.4844\"},\"location\":{\"city\":\"Bordeaux\",\"state\":\"Gironde\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"latitude\":44.84040069580078,\"longitude\":-0.5805000066757202}},\"correlationId\":\"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\",\"conditionalAccessStatus\":\"failure\",\"appliedConditionalAccessPolicies\":[{\"id\":\"bc737765-a8db-4902-8000-f389a97feefd\",\"displayName\":\"Check Point Harmony MFA\",\"enforcedGrantControls\":[\"Checkpoint Custom Control\"],\"enforcedSessionControls\":[],\"result\":\"failure\",\"conditionsSatisfied\":3,\"conditionsNotSatisfied\":0},{\"id\":\"174e7650-f969-47fc-bbd5-83e633e0925e\",\"displayName\":\"Access Control Nine Work for Android\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"5fbf9306-99b8-4781-b5fc-81a0787fb289\",\"displayName\":\"Access Control PowerBI (Poste de travail)\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"d1144840-7d4a-44eb-83f1-543c15f89eb8\",\"displayName\":\"Access Control Snowflake\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"90c5434d-decc-4195-b7f9-024cd39fdca4\",\"displayName\":\"Access Control PowerBI (Mobile)\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"989ecd36-d0e1-4990-bd92-b08250fd45f3\",\"displayName\":\"Access Control Gmail\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"fead0f30-10f4-4472-8bc1-c119d511154d\",\"displayName\":\"MFA Cycloid\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"6d0db7f6-3263-48b4-84e9-9c37c3959161\",\"displayName\":\"Block - Webmail Exchange Online\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"0ba349bc-748a-4108-b103-298ccd5b1d3f\",\"displayName\":\"Require MFA - Privileged accounts\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":1,\"conditionsNotSatisfied\":2}],\"originalRequestId\":\"22253f56-6fc4-45f2-b148-d7fe15504900\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Login Hint Present\",\"value\":\"True\"},{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[{\"networkType\":\"trustedNamedLocation\",\"networkNames\":[\"IP corp\"]}],\"processingTimeInMilliseconds\":91,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Office365 Shell WCSS-Server\",\"resourceId\":\"5f09333a-842c-47da-a157-57da27fcbca5\",\"resourceTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"homeTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-03-30T14:52:21.7062186+00:00\",\"authenticationMethod\":\"Previously satisfied\",\"succeeded\":true,\"authenticationStepResultDetail\":\"First factor requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":0}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"autonomousSystemNumber\":48744,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"none\"}}",
    "event": {
        "category": [
            "authentication"
        ],
        "reason": "External security challenge was not satisfied."
    },
    "@timestamp": "2022-03-30T14:52:21.706218Z",
    "action": {
        "name": "Sign-in activity"
    },
    "azuread": {
        "Level": 4,
        "callerIpAddress": "11.11.11.11",
        "category": "SignInLogs",
        "correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
        "durationMs": 0,
        "identity": "User Name",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "properties": {
            "appDisplayName": "Office365 Shell WCSS-Client",
            "appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
            "authenticationProtocol": "none",
            "correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
            "id": "22253f56-6fc4-45f2-b148-d7fe15504900",
            "riskDetail": "none",
            "riskEventTypes": [],
            "riskEventTypes_v2": [],
            "riskLevelAggregated": "none",
            "riskLevelDuringSignIn": "none",
            "riskState": "none",
            "status": {
                "errorCode": "50158",
                "failureReason": "External security challenge was not satisfied."
            }
        },
        "resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
        "tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
    },
    "error": {
        "code": "50158",
        "message": "External security challenge was not satisfied."
    },
    "host": {
        "os": {
            "type": "Windows 10"
        }
    },
    "related": {
        "ip": [
            "11.11.11.11"
        ]
    },
    "service": {
        "name": "Office365 Shell WCSS-Server",
        "type": "ldap"
    },
    "source": {
        "address": "11.11.11.11",
        "geo": {
            "city_name": "Bordeaux",
            "country_iso_code": "FR",
            "location": {
                "lat": 44.84040069580078,
                "lon": -0.5805000066757202
            },
            "region_name": "Gironde"
        },
        "ip": "11.11.11.11"
    },
    "user": {
        "email": "User.Name@corp.name",
        "full_name": "User Name"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Chrome",
        "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36",
        "os": {
            "name": "Windows",
            "version": "10"
        },
        "version": "99.0.4844"
    }
}
{
    "message": "{\"time\":\"2022-03-31T12:26:46.0190957Z\",\"resourceId\":\"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\",\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"category\":\"SignInLogs\",\"tenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"resultType\":\"0\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"11.11.11.11\",\"correlationId\":\"467c1340-0762-40d2-b6fb-339235633ebb\",\"identity\":\"Admin Jean Dupont\",\"Level\":4,\"location\":\"FR\",\"properties\":{\"id\":\"8795994f-0bb8-46d7-8797-8c9c385d5900\",\"createdDateTime\":\"2022-03-31T12:26:46.0190957+00:00\",\"userDisplayName\":\"Admin Jean Dupont\",\"userPrincipalName\":\"admin.jdupont@corp.net\",\"userId\":\"16cc2d55-637f-4e04-850d-a1048b659112\",\"appId\":\"0000000c-0000-0000-c000-000000000000\",\"appDisplayName\":\"Microsoft App Access Panel\",\"ipAddress\":\"11.11.11.11\",\"status\":{\"errorCode\":0,\"additionalDetails\":\"MFA requirement satisfied by claim in the token\"},\"clientAppUsed\":\"Browser\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0\",\"deviceDetail\":{\"deviceId\":\"\",\"operatingSystem\":\"Windows 10\",\"browser\":\"Firefox 98.0\"},\"location\":{\"city\":\"Bordeaux\",\"state\":\"Gironde\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"latitude\":44.84040069580078,\"longitude\":-0.5805000066757202}},\"mfaDetail\":{},\"correlationId\":\"467c1340-0762-40d2-b6fb-339235633ebb\",\"conditionalAccessStatus\":\"success\",\"appliedConditionalAccessPolicies\":[{\"id\":\"174e7650-f969-47fc-bbd5-83e633e0925e\",\"displayName\":\"Access Control Nine Work for Android\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"5fbf9306-99b8-4781-b5fc-81a0787fb289\",\"displayName\":\"Access Control PowerBI (Poste de travail)\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"d1144840-7d4a-44eb-83f1-543c15f89eb8\",\"displayName\":\"Access Control Snowflake\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"90c5434d-decc-4195-b7f9-024cd39fdca4\",\"displayName\":\"Access Control PowerBI (Mobile)\",\"enforcedGrantControls\":[],\"enforcedSessionControls\":[],\"result\":\"notEnabled\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":0},{\"id\":\"989ecd36-d0e1-4990-bd92-b08250fd45f3\",\"displayName\":\"Access Control Gmail\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"fead0f30-10f4-4472-8bc1-c119d511154d\",\"displayName\":\"MFA Cycloid\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"bc737765-a8db-4902-8000-f389a97feefd\",\"displayName\":\"Check Point Harmony MFA\",\"enforcedGrantControls\":[\"Checkpoint Custom Control\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"6d0db7f6-3263-48b4-84e9-9c37c3959161\",\"displayName\":\"Block - Webmail Exchange Online\",\"enforcedGrantControls\":[\"Block\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":0,\"conditionsNotSatisfied\":1},{\"id\":\"0ba349bc-748a-4108-b103-298ccd5b1d3f\",\"displayName\":\"Require MFA - Privileged accounts\",\"enforcedGrantControls\":[\"Mfa\"],\"enforcedSessionControls\":[],\"result\":\"notApplied\",\"conditionsSatisfied\":3,\"conditionsNotSatisfied\":8}],\"originalRequestId\":\"8795994f-0bb8-46d7-8797-8c9c385d5900\",\"isInteractive\":true,\"tokenIssuerName\":\"\",\"tokenIssuerType\":\"AzureAD\",\"authenticationProcessingDetails\":[{\"key\":\"Legacy TLS (TLS 1.0, 1.1, 3DES)\",\"value\":\"False\"},{\"key\":\"Oauth Scope Info\",\"value\":\"\"},{\"key\":\"Is CAE Token\",\"value\":\"False\"}],\"networkLocationDetails\":[{\"networkType\":\"trustedNamedLocation\",\"networkNames\":[\"IP network\"]}],\"processingTimeInMilliseconds\":80,\"riskDetail\":\"none\",\"riskLevelAggregated\":\"none\",\"riskLevelDuringSignIn\":\"none\",\"riskState\":\"none\",\"riskEventTypes\":[],\"riskEventTypes_v2\":[],\"resourceDisplayName\":\"Windows Azure Active Directory\",\"resourceId\":\"00000002-0000-0000-c000-000000000000\",\"resourceTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"homeTenantId\":\"34314e6e-4023-4e4b-a15e-143f63244e2b\",\"authenticationDetails\":[{\"authenticationStepDateTime\":\"2022-03-31T12:26:46.0190957+00:00\",\"authenticationMethod\":\"Previously satisfied\",\"succeeded\":true,\"authenticationStepResultDetail\":\"First factor requirement satisfied by claim in the token\",\"authenticationStepRequirement\":\"Primary authentication\",\"StatusSequence\":0,\"RequestSequence\":0}],\"authenticationRequirementPolicies\":[],\"authenticationRequirement\":\"singleFactorAuthentication\",\"servicePrincipalId\":\"\",\"userType\":\"Member\",\"flaggedForReview\":false,\"isTenantRestricted\":false,\"autonomousSystemNumber\":48744,\"crossTenantAccessType\":\"none\",\"privateLinkDetails\":{},\"ssoExtensionVersion\":\"\",\"uniqueTokenIdentifier\":\"ODc5NTk5NGYtMGJiOC00NmQ3LTg3OTctOGM5YzM4NWQ1OTAw\",\"incomingTokenType\":\"none\",\"authenticationProtocol\":\"none\"}}",
    "event": {
        "category": [
            "authentication"
        ]
    },
    "@timestamp": "2022-03-31T12:26:46.019095Z",
    "action": {
        "name": "Sign-in activity"
    },
    "azuread": {
        "Level": 4,
        "callerIpAddress": "11.11.11.11",
        "category": "SignInLogs",
        "correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
        "durationMs": 0,
        "identity": "Admin Jean Dupont",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "properties": {
            "appDisplayName": "Microsoft App Access Panel",
            "appId": "0000000c-0000-0000-c000-000000000000",
            "authenticationProtocol": "none",
            "correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
            "id": "8795994f-0bb8-46d7-8797-8c9c385d5900",
            "riskDetail": "none",
            "riskEventTypes": [],
            "riskEventTypes_v2": [],
            "riskLevelAggregated": "none",
            "riskLevelDuringSignIn": "none",
            "riskState": "none",
            "status": {
                "additionalDetails": "MFA requirement satisfied by claim in the token",
                "errorCode": "0"
            }
        },
        "resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
        "tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
    },
    "error": {
        "code": "0",
        "message": "MFA requirement satisfied by claim in the token"
    },
    "host": {
        "os": {
            "type": "Windows 10"
        }
    },
    "related": {
        "ip": [
            "11.11.11.11"
        ]
    },
    "service": {
        "name": "Windows Azure Active Directory",
        "type": "ldap"
    },
    "source": {
        "address": "11.11.11.11",
        "geo": {
            "city_name": "Bordeaux",
            "country_iso_code": "FR",
            "location": {
                "lat": 44.84040069580078,
                "lon": -0.5805000066757202
            },
            "region_name": "Gironde"
        },
        "ip": "11.11.11.11"
    },
    "user": {
        "email": "admin.jdupont@corp.net",
        "full_name": "Admin Jean Dupont"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Firefox",
        "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0",
        "os": {
            "name": "Windows",
            "version": "10"
        },
        "version": "98.0"
    }
}
{
    "message": "{\"time\": \"2023-08-16T15:32:05.5772601Z\", \"resourceId\": \"/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam\", \"operationName\": \"Sign-in activity\", \"operationVersion\": \"1.0\", \"category\": \"SignInLogs\", \"tenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"resultType\": \"0\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"1.2.3.4\", \"correlationId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"identity\": \"John DOE\", \"Level\": 4, \"location\": \"FR\", \"properties\": {\"id\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"createdDateTime\": \"2023-08-16T15:28:23.3045933+00:00\", \"userDisplayName\": \"John DOE\", \"userPrincipalName\": \"john.doe@example.org\", \"userId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"appId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"appDisplayName\": \"Microsoft Authentication Broker\", \"ipAddress\": \"1.2.3.4\", \"status\": {\"errorCode\": 0, \"additionalDetails\": \"MFA completed in Azure AD\"}, \"clientAppUsed\": \"Mobile Apps and Desktop clients\", \"userAgent\": \"Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\", \"deviceDetail\": {\"deviceId\": \"\", \"operatingSystem\": \"Ios\", \"browser\": \"Mobile Safari 16.6\"}, \"location\": {\"city\": \"Paris\", \"state\": \"Paris\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"latitude\": 48.856578, \"longitude\": 2.351828}}, \"mfaDetail\": {\"authMethod\": \"Mobile app notification\"}, \"correlationId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"conditionalAccessStatus\": \"notApplied\", \"appliedConditionalAccessPolicies\": [], \"authenticationContextClassReferences\": [], \"originalRequestId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"isInteractive\": true, \"tokenIssuerName\": \"\", \"tokenIssuerType\": \"AzureAD\", \"authenticationProcessingDetails\": [{\"key\": \"Domain Hint Present\", \"value\": \"True\"}, {\"key\": \"Login Hint Present\", \"value\": \"True\"}, {\"key\": \"Legacy TLS (TLS 1.0, 1.1, 3DES)\", \"value\": \"False\"}, {\"key\": \"Is CAE Token\", \"value\": \"False\"}], \"networkLocationDetails\": [{\"networkType\": \"namedNetwork\", \"networkNames\": [\"Fra\"]}], \"clientCredentialType\": \"none\", \"processingTimeInMilliseconds\": 77, \"riskDetail\": \"none\", \"riskLevelAggregated\": \"none\", \"riskLevelDuringSignIn\": \"none\", \"riskState\": \"none\", \"riskEventTypes\": [], \"riskEventTypes_v2\": [], \"resourceId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"resourceTenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"homeTenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"tenantId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"authenticationDetails\": [{\"authenticationStepDateTime\": \"2023-08-16T15:28:23.3045933+00:00\", \"authenticationMethod\": \"Password\", \"authenticationMethodDetail\": \"Pass-through Authentication\", \"succeeded\": true, \"authenticationStepRequirement\": \"Primary authentication\", \"StatusSequence\": 0, \"RequestSequence\": 1}, {\"authenticationStepDateTime\": \"2023-08-16T15:28:22+00:00\", \"authenticationMethod\": \"Mobile app notification\", \"succeeded\": true, \"authenticationStepResultDetail\": \"MFA successfully completed\", \"authenticationStepRequirement\": \"Primary authentication\", \"StatusSequence\": 1692199702901, \"RequestSequence\": 1692199690724}], \"authenticationRequirementPolicies\": [{\"requirementProvider\": \"user\", \"detail\": \"Per-user MFA\"}], \"sessionLifetimePolicies\": [{\"expirationRequirement\": \"rememberMultifactorAuthenticationOnTrustedDevices\", \"detail\": \"Remember MFA\"}], \"authenticationRequirement\": \"multiFactorAuthentication\", \"alternateSignInName\": \"john.doe@example.org\", \"signInIdentifier\": \"john.doe@example.org\", \"servicePrincipalId\": \"\", \"userType\": \"Member\", \"flaggedForReview\": false, \"isTenantRestricted\": false, \"autonomousSystemNumber\": 1111, \"crossTenantAccessType\": \"none\", \"privateLinkDetails\": {}, \"ssoExtensionVersion\": \"\", \"uniqueTokenIdentifier\": \"5555555555555555555555\", \"authenticationStrengths\": [], \"incomingTokenType\": \"none\", \"authenticationProtocol\": \"none\", \"appServicePrincipalId\": null, \"resourceServicePrincipalId\": \"93f63260-ad9a-4087-b7e0-d9010cb919dd\", \"rngcStatus\": 0}}",
    "event": {
        "category": [
            "authentication"
        ]
    },
    "@timestamp": "2023-08-16T15:32:05.577260Z",
    "action": {
        "name": "Sign-in activity"
    },
    "azuread": {
        "Level": 4,
        "callerIpAddress": "1.2.3.4",
        "category": "SignInLogs",
        "correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
        "durationMs": 0,
        "identity": "John DOE",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "properties": {
            "appDisplayName": "Microsoft Authentication Broker",
            "appId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
            "authenticationProtocol": "none",
            "correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
            "id": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
            "riskDetail": "none",
            "riskEventTypes": [],
            "riskEventTypes_v2": [],
            "riskLevelAggregated": "none",
            "riskLevelDuringSignIn": "none",
            "riskState": "none",
            "status": {
                "additionalDetails": "MFA completed in Azure AD",
                "errorCode": "0"
            }
        },
        "resourceId": "/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam",
        "tenantId": "93f63260-ad9a-4087-b7e0-d9010cb919dd"
    },
    "error": {
        "code": "0",
        "message": "MFA completed in Azure AD"
    },
    "host": {
        "os": {
            "type": "Ios"
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "source": {
        "address": "1.2.3.4",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.856578,
                "lon": 2.351828
            },
            "region_name": "Paris"
        },
        "ip": "1.2.3.4"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John DOE"
    },
    "user_agent": {
        "device": {
            "name": "iPhone"
        },
        "name": "Mobile Safari UI/WKWebView",
        "original": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
        "os": {
            "name": "iOS",
            "version": "16.6"
        }
    }
}
{
    "message": "{\"time\": \"2023-10-04T13:09:02.6799940Z\", \"resourceId\": \"/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam\", \"operationName\": \"Sign-in activity\", \"operationVersion\": \"1.0\", \"category\": \"SignInLogs\", \"tenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"resultType\": \"0\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"11.11.11.11\", \"correlationId\": \"e68960e2-8996-448c-ba7a-e54eeb8ff2ed\", \"identity\": \"DOE Jane\", \"Level\": 4, \"location\": \"FR\", \"properties\": {\"id\": \"e14254f4-4288-4c00-8689-80823c4f4cb5\", \"createdDateTime\": \"2023-10-04T13:06:18.9617194+00:00\", \"userDisplayName\": \"Jane DOE\", \"userPrincipalName\": \"jane.doe@example.org\", \"userId\": \"469a0b32-4a8d-4b73-89aa-25ab78df7523\", \"appId\": \"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7\", \"appDisplayName\": \"Microsoft Authentication Broker\", \"ipAddress\": \"11.11.11.11\", \"status\": {\"errorCode\": 0}, \"clientAppUsed\": \"Mobile Apps and Desktop clients\", \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98\", \"deviceDetail\": {\"deviceId\": \"e14254f4-4288-4c00-8689-80823c4f4cb5\", \"displayName\": \"LPTC-PC1M4VZQ\", \"operatingSystem\": \"Ios\", \"browser\": \"Edge 116.0.1938\", \"isCompliant\": true, \"isManaged\": true, \"trustType\": \"Azure AD joined\"}, \"location\": {\"city\": \"Bordeaux\", \"state\": \"Gironde\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"latitude\": 44.84040069580078, \"longitude\": -0.5805000066757202}}, \"correlationId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"conditionalAccessStatus\": \"notApplied\", \"appliedConditionalAccessPolicies\": [], \"authenticationContextClassReferences\": [], \"originalRequestId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"isInteractive\": true, \"tokenIssuerName\": \"\", \"tokenIssuerType\": \"AzureAD\", \"authenticationProcessingDetails\": [{\"key\": \"Legacy TLS (TLS 1.0, 1.1, 3DES)\", \"value\": \"False\"}, {\"key\": \"Is CAE Token\", \"value\": \"False\"}], \"networkLocationDetails\": [], \"clientCredentialType\": \"none\", \"processingTimeInMilliseconds\": 300, \"riskDetail\": \"none\", \"riskLevelAggregated\": \"none\", \"riskLevelDuringSignIn\": \"none\", \"riskState\": \"none\", \"riskEventTypes\": [], \"riskEventTypes_v2\": [], \"resourceId\": \"11d70870-823f-4450-828a-aba3cf69af8d\", \"resourceTenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"homeTenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"tenantId\": \"34314e6e-4023-4e4b-a15e-143f63244e2b\", \"authenticationDetails\": [], \"authenticationRequirementPolicies\": [], \"sessionLifetimePolicies\": [], \"authenticationRequirement\": \"singleFactorAuthentication\", \"alternateSignInName\": \"jane.doe@example.org\", \"signInIdentifier\": \"jane.doe@example.org\", \"servicePrincipalId\": \"\", \"userType\": \"Member\", \"flaggedForReview\": false, \"isTenantRestricted\": false, \"autonomousSystemNumber\": 5410, \"crossTenantAccessType\": \"none\", \"privateLinkDetails\": {}, \"ssoExtensionVersion\": \"\", \"uniqueTokenIdentifier\": \"aaaaaaaaaaaaaaaaaaaaaa\", \"authenticationStrengths\": [], \"incomingTokenType\": \"primaryRefreshToken\", \"authenticationProtocol\": \"deviceCode\", \"appServicePrincipalId\": null, \"resourceServicePrincipalId\": \"6c00164d-7ecd-404d-a0e1-0d0d54cf76cd\", \"rngcStatus\": 0, \"signInTokenProtectionStatus\": \"none\", \"originalTransferMethod\": \"none\"}}",
    "event": {
        "category": [
            "authentication"
        ]
    },
    "@timestamp": "2023-10-04T13:09:02.679994Z",
    "action": {
        "name": "Sign-in activity"
    },
    "azuread": {
        "Level": 4,
        "callerIpAddress": "11.11.11.11",
        "category": "SignInLogs",
        "correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
        "durationMs": 0,
        "identity": "DOE Jane",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "properties": {
            "appDisplayName": "Microsoft Authentication Broker",
            "appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
            "authenticationProtocol": "deviceCode",
            "correlationId": "11d70870-823f-4450-828a-aba3cf69af8d",
            "deviceDetail": {
                "isCompliant": true,
                "isManaged": true,
                "trustType": "Azure AD joined"
            },
            "id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
            "riskDetail": "none",
            "riskEventTypes": [],
            "riskEventTypes_v2": [],
            "riskLevelAggregated": "none",
            "riskLevelDuringSignIn": "none",
            "riskState": "none",
            "status": {
                "errorCode": "0"
            }
        },
        "resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
        "tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
    },
    "error": {
        "code": "0"
    },
    "host": {
        "hostname": "LPTC-PC1M4VZQ",
        "id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
        "name": "LPTC-PC1M4VZQ",
        "os": {
            "type": "Ios"
        }
    },
    "related": {
        "hosts": [
            "LPTC-PC1M4VZQ"
        ],
        "ip": [
            "11.11.11.11"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "source": {
        "address": "11.11.11.11",
        "geo": {
            "city_name": "Bordeaux",
            "country_iso_code": "FR",
            "location": {
                "lat": 44.84040069580078,
                "lon": -0.5805000066757202
            },
            "region_name": "Gironde"
        },
        "ip": "11.11.11.11"
    },
    "user": {
        "email": "jane.doe@example.org",
        "full_name": "Jane DOE"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Edge",
        "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98",
        "os": {
            "name": "Windows",
            "version": "10"
        },
        "version": "116.0.1938"
    }
}
{
    "message": "{\"time\": \"2019-06-24T09:32:07.4637225Z\",\"resourceId\": \"/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam\",\"operationName\": \"Update StsRefreshTokenValidFrom Timestamp\",\"operationVersion\": \"1.0\",\"category\": \"AuditLogs\",\"tenantId\": \"f6b9ca1d-c995-41bd-ac32-5fba5580215d\",\"resultSignature\": \"None\",\"durationMs\": 0,\"callerIpAddress\": \"<null>\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"level\": \"Informational\",\"properties\": {\"id\": \"Directory_1PF86_84995795\",\"category\": \"UserManagement\",\"correlationId\": \"fd39aead-f711-4c4f-b6a9-ced2c67f3fca\",\"result\": \"success\",\"resultReason\": \"\",\"activityDisplayName\": \"Update StsRefreshTokenValidFrom Timestamp\",\"activityDateTime\": \"2019-06-24T09:32:07.4637225+00:00\",\"loggedByService\": \"Core Directory\",\"operationType\": \"Update\",\"initiatedBy\": {\"user\": {\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"ipAddress\": \"<null>\"}},\"targetResources\": [{\"id\": \"bd8a55aa-6079-4742-8b1b-3f55a398dfc3\",\"displayName\": null,\"type\": \"User\",\"userPrincipalName\": \"jean.dupont@usergmail.onmicrosoft.com\",\"modifiedProperties\": []}],\"additionalDetails\": []}}",
    "event": {
        "category": [
            "iam"
        ],
        "outcome": "success"
    },
    "@timestamp": "2019-06-24T09:32:07.463722Z",
    "action": {
        "name": "Update StsRefreshTokenValidFrom Timestamp",
        "outcome": "success",
        "properties": [
            {
                "id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
                "name": "jean.dupont@usergmail.onmicrosoft.com",
                "type": "targetedUser"
            }
        ],
        "target": "user",
        "type": "update"
    },
    "azuread": {
        "category": "AuditLogs",
        "correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
        "durationMs": 0,
        "operationName": "Update StsRefreshTokenValidFrom Timestamp",
        "operationVersion": "1.0",
        "properties": {
            "correlationId": "fd39aead-f711-4c4f-b6a9-ced2c67f3fca",
            "id": "Directory_1PF86_84995795",
            "targetUserPrincipalName": "jean.dupont@usergmail.onmicrosoft.com"
        },
        "resourceId": "/tenants/f6b9ca1d-c995-41bd-ac32-5fba5580215d/providers/Microsoft.aadiam",
        "tenantId": "f6b9ca1d-c995-41bd-ac32-5fba5580215d"
    },
    "related": {
        "user": [
            "jean.dupont@usergmail.onmicrosoft.com"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "user": {
        "id": "bd8a55aa-6079-4742-8b1b-3f55a398dfc3",
        "name": "jean.dupont@usergmail.onmicrosoft.com"
    }
}
{
    "message": "{\"time\":\"3/24/2022 2:42:35 PM\",\"resourceId\":\"/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam\",\"operationName\":\"User Risk Detection\",\"operationVersion\":\"1.0\",\"category\":\"UserRiskEvents\",\"tenantId\":\"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\",\"resultSignature\":\"None\",\"durationMs\":0,\"callerIpAddress\":\"11.22.33.44\",\"correlationId\":\"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\",\"identity\":\"bar foo\",\"Level\":4,\"location\":\"fr\",\"properties\":{\"id\":\"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\",\"requestId\":\"d38b6ab7-65b0-419c-b83a-a5787d6fa100\",\"correlationId\":\"325294e4-4026-4cc7-889d-b4be570b3254\",\"riskType\":\"unfamiliarFeatures\",\"riskEventType\":\"unfamiliarFeatures\",\"riskState\":\"dismissed\",\"riskLevel\":\"low\",\"riskDetail\":\"aiConfirmedSigninSafe\",\"source\":\"IdentityProtection\",\"detectionTimingType\":\"realtime\",\"activity\":\"signin\",\"ipAddress\":\"11.22.33.44\",\"location\":{\"city\":\"La Guaiserie\",\"state\":\"Loir-Et-Cher\",\"countryOrRegion\":\"FR\",\"geoCoordinates\":{\"altitude\":0.0,\"latitude\":47.45919,\"longitude\":2.21955}},\"activityDateTime\":\"2022-03-24T14:40:04.234Z\",\"detectedDateTime\":\"2022-03-24T14:40:04.234Z\",\"lastUpdatedDateTime\":\"2022-03-24T14:42:35.066Z\",\"userId\":\"4c64c30a-7a60-4211-bef1-5e4279854e85\",\"userDisplayName\":\"bar foo\",\"userPrincipalName\":\"foo.bar@corp.eu\",\"additionalInfo\":\"[{\\\"Key\\\":\\\"userAgent\\\",\\\"Value\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}]\",\"tokenIssuerType\":\"AzureAD\",\"resourceTenantId\":null,\"homeTenantId\":\"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\",\"userType\":\"member\",\"crossTenantAccessType\":\"none\"}}",
    "event": {
        "category": [
            "iam"
        ],
        "reason": "unfamiliarFeatures",
        "type": [
            "connection"
        ]
    },
    "@timestamp": "2022-03-24T14:42:35Z",
    "action": {
        "name": "User Risk Detection"
    },
    "azuread": {
        "Level": 4,
        "callerIpAddress": "11.22.33.44",
        "category": "UserRiskEvents",
        "correlationId": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
        "durationMs": 0,
        "identity": "bar foo",
        "operationName": "User Risk Detection",
        "operationVersion": "1.0",
        "properties": {
            "activity": "signin",
            "correlationId": "325294e4-4026-4cc7-889d-b4be570b3254",
            "detectionTimingType": "realtime",
            "id": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080",
            "requestId": "d38b6ab7-65b0-419c-b83a-a5787d6fa100",
            "riskDetail": "aiConfirmedSigninSafe",
            "riskEventType": "unfamiliarFeatures",
            "riskLevel": "low",
            "riskState": "dismissed",
            "source": "IdentityProtection"
        },
        "resourceId": "/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam",
        "tenantId": "2d0c1986-ef7b-4bbf-8428-3c837471e7ad"
    },
    "related": {
        "ip": [
            "11.22.33.44"
        ]
    },
    "service": {
        "name": "Azure Active Directory",
        "type": "ldap"
    },
    "source": {
        "address": "11.22.33.44",
        "geo": {
            "city_name": "La Guaiserie",
            "country_iso_code": "fr",
            "location": {
                "lat": 47.45919,
                "lon": 2.21955
            },
            "region_name": "Loir-Et-Cher"
        },
        "ip": "11.22.33.44"
    },
    "user": {
        "email": "foo.bar@corp.eu",
        "full_name": "bar foo"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
action.properties array action.properties
action.target keyword action.target
azuread.Level long
azuread.activityDateTime keyword
azuread.additionalInfo keyword
azuread.authenticationDetails array
azuread.authenticationProtocol keyword
azuread.authenticationRequirement keyword
azuread.authenticationRequirementPolicies array
azuread.autonomousSystemNumber long
azuread.callerIpAddress keyword
azuread.category keyword
azuread.correlationId keyword
azuread.crossTenantAccessType keyword
azuread.detectedDateTime keyword
azuread.durationMs long
azuread.flaggedForReview bool
azuread.homeTenantId keyword
azuread.identity keyword
azuread.incomingTokenType keyword
azuread.isTenantRestricted bool
azuread.lastUpdatedDateTime keyword
azuread.operationName keyword
azuread.operationVersion keyword
azuread.privateLinkDetails list
azuread.properties.activity keyword
azuread.properties.appDisplayName keyword appDisplayName
azuread.properties.appId keyword appId
azuread.properties.authenticationProtocol keyword authenticationProtocol
azuread.properties.correlationId keyword
azuread.properties.detectionTimingType keyword
azuread.properties.deviceDetail.isCompliant bool
azuread.properties.deviceDetail.isManaged bool
azuread.properties.deviceDetail.trustType keyword
azuread.properties.id keyword
azuread.properties.requestId keyword
azuread.properties.riskDetail keyword
azuread.properties.riskEventType keyword
azuread.properties.riskEventTypes keyword riskEventTypes
azuread.properties.riskEventTypes_v2 keyword riskEventTypes_v2
azuread.properties.riskLevel keyword
azuread.properties.riskLevelAggregated keyword riskLevelAggregated
azuread.properties.riskLevelDuringSignIn keyword riskLevelDuringSignIn
azuread.properties.riskState keyword
azuread.properties.source keyword
azuread.properties.status.additionalDetails keyword
azuread.properties.status.errorCode keyword
azuread.properties.status.failureReason keyword
azuread.properties.targetDevicePrincipalName keyword
azuread.properties.targetUserPrincipalName keyword
azuread.resourceId keyword
azuread.resourceTenantId keyword
azuread.resultSignature keyword
azuread.servicePrincipalId keyword
azuread.ssoExtensionVersion keyword
azuread.tenantId keyword
azuread.tokenIssuerType keyword
azuread.uniqueTokenIdentifier keyword
azuread.userType keyword
error.code keyword Error code describing the error.
error.message match_only_text Error message.
event.category keyword Event category. The second categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.type keyword Event type. The third categorization field in the hierarchy.
host.hostname keyword Hostname of the host.
host.id keyword Unique host id.
host.os.name keyword Operating system name, without the version.
host.os.type keyword Which commercial OS family (one of: linux, macos, unix or windows).
service.name keyword Name of the service.
service.type keyword The type of the service.
source.geo.city_name keyword City name.
source.geo.country_iso_code keyword Country ISO code.
source.geo.location geo_point Longitude and latitude.
source.geo.region_name keyword Region name.
source.ip ip IP address of the source.
user.email keyword User email address.
user.full_name keyword User's full name, if available.
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.
user_agent.name keyword Name of the user agent.
user_agent.original keyword Unparsed user_agent string.

Configure

To forward Microsoft Entra ID (Azure AD) events from Azure to Sekoia.io you need to send your event to an Azure Event Hub where Sekoia.io will collect the events.

image

Prerequisite

You must have Contributor write on Azure to perform the following installation.

Azure Event Hubs is a cloud-based event streaming platform and event ingestion service provided by Microsoft Azure. It is designed to handle large amounts of event data generated by various applications, devices, and services in real-time. Event Hubs enables you to ingest, process, and store events, logs, telemetry data, and other streaming data for further analysis, monitoring, and processing. Two ways are suggested in order to set up everything you need to forward your events on Sekoia.io.

If you are not an expert and want an easy way to configure the ressources on Azure, we recommend to use to Automatic way as it is easier to set up.

These two ways will create an Azure Event Hub and a Storage Account.

Use the template to create the ressources

To get started, click on the button below and fill the form on Azure to set up the required environment for Sekoia Deploy to Azure

Some fields must be filled in.

Project details

  • Subscription: select the Azure subscription you want to use
  • Resource Group: select or create a new Resource Group. A Resource Group is a container that holds related resources

Instance details

  • Region: select the appropriated region
  • Project Name: give a name for this project. Here is how the names of the resources will be affected by this project name
Ressource Name
Event Hub Namespace <project_name>ehns
Event Hub <project_name>eh
Shared Access Policy <project_name>ap
Consumer Group <project_name>cp
Storage Account <project_name>sa
  • Event Hub Sku: Select the messaging tier for Event Hub Namespace between Basic , Standard or Premium. We do not recommend Basic model due to its limitation. Please follow this Microsoft web page to get more information avec the different messaging tier.
  • Troughput Unit: A unit gives you up to 1 MB/s or 1,000 events per second (whichever comes first) per Event Hub Namespace. Please adapt it to your need.
  • Enable Auto Inflate: When checked, the Auto-inflate feature of Event Hubs automatically scales up by increasing the number of troughput units, to meet usage needs.
  • Auto Inflate Maximum Throughput Unit: When Enable Auto Inflate is checked, you can specify the maximum throughput units you allow.
  • Partition Count: The number of event hub partitions. Microsoft recommends a maximum throughput of 1 MB/s per partition. Unless you plan to add more Event hubs to the Event Hub Namespace, the Partition Count and Throughput Unit variables should have the same values.
  • Retention Time: How long you will keep events in the Event hub in days.

Use the output variables to create a Sekoia playbook

When the message Your deployment is complete is displayed, click on Outputs.

Keep these 5 pieces of information displayed carefully, it will used to configure the Trigger Configuration of the Sekoia playbook.

Overview

This setup guide will show you how to create an Event Hub manually.

Theses changes have to be made from the Azure Web Portal.

Some resources created during this procedure are needed to connect Sekoia.io to the Event Hub, you can complete the following table to save all the useful informations for later use.

Name Value Description Example
hub_name To be completed at step 3 Name of the Event Hub sekoia_event_hub
hub_connection_string To be completed at step 5 Connection string–primary key Endpoint=sb://company-eventhub.servicebus.windows.net/;SharedAccessKeyName=sekoiaio;SharedAccessKey=XXXXXX;EntityPath=sekoia_event_hub
hub_consumer_group To be completed at step 6 Name of the comsumer group consumergroup_sekoiaio
storage_container_name To be completed at step 7 Name of your container (same as the Event Hub name) sekoia_event_hub
storage_connection_string To be completed at step 8 Storage connection string DefaultEndpointsProtocol=https;AccountName=sekoiaiocheckpoint;AccountKey=XXXXX

As a prerequisite, you need to choose an existing Resource group, or create a new one (e.g. company-resource-group).

Step 1: Find your Subscription ID

  1. Go to: Home > Cost Management + Billing > Subscriptions.
  2. From there, keep the relevant “Subscription ID” that will be used along the process.
    image

Step 2: Create Event Hub Namespace

  1. Navigate to Home > Event Hubs.
  2. Create an Event Hub Namespace.
  3. Select your Subscription and your Resource group.
    Click on create new if you want your Event Hub Namespace in a new Resource group.
  4. Choose a namespace name.
  5. Select a location based on your events location.
  6. Select the pricing tier plan based on your utilisation: Standard or Premimum (We don't recommend to choose the Basic plan due to its limitations.)
  7. Select the throughput units number based on your events, or enable the auto inflate mode:
    1 throughput unit can process up to 1 MB per second or 1000 events per second (whichever comes first).
    image

Step 3: Create Event Hub Instance

When your Event Hub Namespace is created you can create an Event Hub inside:
1. Navigate to Home > Event Hubs > company-eventhubnamespace.
2. Create an Event Hub.

Info

We advise at least the following values:
- cleanup policy: Delete
- retention time: 168h (7 days)

image

Info

Carefully store the Event Hub name that will be used for sekoia playbook configuration.

Step 4: Create “Shared Access Policies” for the Event Hub

  1. Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Shared access policies.
  2. Create a policy (e.g. sekoiaio) with the claims Listen.

    image

  3. Once created, click on the policy.


    image

Info

Carefully store the connection string–primary key that will be used for sekoia playbook configuration.

Step 5: Create a Consumer group

  1. Navigate to Home > Event Hubs > company-eventhubnamespace > eventhubname | Consumer groups.
  2. Create a Consumer group (e.g. consumergroup_sekoiaio).
    image

Info

Carefully store the Consumer group name that will be used for sekoia playbook configuration.

Step 6: Create a Storage Account with a container

In order to allow Sekoia.io keep track of the consumed events, the next step consists in creating a dedicated Storage account.

  1. Navigate to Home > Storage accounts.
  2. Create a Storage account.
  3. Select your Subscription and your Resource group.
  4. Choose a Storage account name.
  5. Select a Region.

    Info

    You must choose the Region used during the Event Hub Namespace creation.

  6. Select your perfomance and redundancy parameters.

    Info

    We advise at least the following values:
    - performance: standard
    - redundancy: Geo-Redundancy storage (GRS)

image

When your storage account is created you can create an container inside.
1. Navigate to Home > Storage accounts > storageaccoutname | containers.
2. Create an container.

Keep the Public Acces Level to Private.

Info

The container name should be the same as the Event Hub name. Carefully store that container name that will be used for sekoia playbook configuration.

Step 7: Retrieve Connection String

You have to retrieve the connection string from Azure Web Portal.

  1. Go to Home > Storage accounts > storageaccoutname | Access Keys.
  2. Click on "Show Keys" on the first Connection String.
    image

Info

Carefully store the Connection String that will be used for sekoia playbook configuration.

Further Readings

Send logs from Microsoft Entra ID (Azure AD) to Azure Event Hub

When you have an Event Hub follow this guide to send your Microsoft Entra ID (Azure AD) events from Azure to the Event Hub:

You need to activate and configure the Microsoft Entra ID (Azure AD) diagnostic settings (e.g. company-ad), to receive logs from the Microsoft Entra ID (Azure AD) into your Event Hub.

Navigate to Home > Microsoft Entra ID (Azure AD) (e.g. company-ad) > Monitoring > Diagnostic settings:

  1. Add a new diagnostic setting, and select “Stream to an event hub” and click on configure.
  2. Select the previously created “Event hubs”, “Event Hub” and “SharedAccessKey” (see step 3 of the event hub guide).
  3. In the log section, select all log categories (as shown below).
  4. Choose a name for this configuration and click on “Save”.

diag

Further Readings

Create the intake

Go to the intake page and create a new intake from the format Microsoft Entra ID (Azure AD).

Create and configure a playbook on Sekoia.io to collect logs from an Azure Event Hub

  1. In the playbook section, create a playbook with the Trigger module Consume Eventhub messages in Microsoft Azure technology
  2. Setup Module configuration (= default)
  3. Setup Trigger configuration:
    • Event Hub informations: use the table completed during the creation of the Event Hub.
    • Intake informations:
      • intake_key = Intake key that can be found on intake page
      • intake_server = https://intake.sekoia.io
image

Troubleshoot

Go to events page and search events in last 5 minutes by intake key customer.intake_key:"<Your_Intake_Key>"

No events - Please check the configuration and fill the fields with the right information

  • It is possible to investigate on the tab Run and see the response by clicking on the module
image