azure_active_directory_sign_in_activity.yml

name: Azure Active Directory Sign-in activity
id: f9ed0a3a-9e20-4198-a035-d0a29593fbe0
version: 1
date: "2024-07-18"
author: Patrick Bareiss, Splunk
description: Data source object for Azure Active Directory Sign-in activity
source: Azure AD
sourcetype: azure:monitor:aad
separator: operationName
supported_TA:
  - name: Splunk Add-on for Microsoft Cloud Services
    url: https://splunkbase.splunk.com/app/3110
    version: 5.4.3
fields:
  - _time
  - Level
  - callerIpAddress
  - category
  - correlationId
  - date_hour
  - date_mday
  - date_minute
  - date_month
  - date_second
  - date_wday
  - date_year
  - date_zone
  - durationMs
  - host
  - identity
  - index
  - linecount
  - location
  - operationName
  - operationVersion
  - properties.alternateSignInName
  - properties.appDisplayName
  - properties.appId
  - properties.appServicePrincipalId
  - properties.authenticationDetails{}.RequestSequence
  - properties.authenticationDetails{}.StatusSequence
  - properties.authenticationDetails{}.authenticationMethod
  - properties.authenticationDetails{}.authenticationMethodDetail
  - properties.authenticationDetails{}.authenticationStepDateTime
  - properties.authenticationDetails{}.authenticationStepRequirement
  - properties.authenticationDetails{}.authenticationStepResultDetail
  - properties.authenticationDetails{}.succeeded
  - properties.authenticationProcessingDetails{}.key
  - properties.authenticationProcessingDetails{}.value
  - properties.authenticationProtocol
  - properties.authenticationRequirement
  - properties.authenticationRequirementPolicies{}.detail
  - properties.authenticationRequirementPolicies{}.requirementProvider
  - properties.autonomousSystemNumber
  - properties.clientAppUsed
  - properties.clientCredentialType
  - properties.conditionalAccessStatus
  - properties.correlationId
  - properties.createdDateTime
  - properties.crossTenantAccessType
  - properties.deviceDetail.deviceId
  - properties.deviceDetail.operatingSystem
  - properties.flaggedForReview
  - properties.homeTenantId
  - properties.id
  - properties.incomingTokenType
  - properties.ipAddress
  - properties.isInteractive
  - properties.isTenantRestricted
  - properties.location.city
  - properties.location.countryOrRegion
  - properties.location.geoCoordinates.latitude
  - properties.location.geoCoordinates.longitude
  - properties.location.state
  - properties.originalRequestId
  - properties.originalTransferMethod
  - properties.processingTimeInMilliseconds
  - properties.resourceDisplayName
  - properties.resourceId
  - properties.resourceServicePrincipalId
  - properties.resourceTenantId
  - properties.riskDetail
  - properties.riskLevelAggregated
  - properties.riskLevelDuringSignIn
  - properties.riskState
  - properties.rngcStatus
  - properties.servicePrincipalId
  - properties.signInIdentifier
  - properties.signInTokenProtectionStatus
  - properties.ssoExtensionVersion
  - properties.status.additionalDetails
  - properties.status.errorCode
  - properties.status.failureReason
  - properties.tenantId
  - properties.tokenIssuerName
  - properties.tokenIssuerType
  - properties.uniqueTokenIdentifier
  - properties.userAgent
  - properties.userDisplayName
  - properties.userId
  - properties.userPrincipalName
  - properties.userType
  - punct
  - resourceId
  - resultDescription
  - resultSignature
  - resultType
  - source
  - sourcetype
  - splunk_server
  - tenantId
  - time
  - timeendpos
  - timestartpos
example_log:
  '{"time": "2023-10-24T20:13:31.4449614Z", "resourceId": "/tenants/887c9144-28b8-431b-885b-764fdeefcf62/providers/Microsoft.aadiam",
  "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs",
  "tenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "resultType": "50076", "resultSignature":
  "None", "resultDescription": "Due to a configuration change made by your administrator,
  or because you moved to a new location, you must use multi-factor authentication
  to access the resource.", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId":
  "1f577997-0710-4bd4-848e-5854f748f7dc", "identity": "user15", "Level": 4, "location":
  "US", "properties": {"id": "22608a25-1d9b-44b5-b0f2-cb94f06b2d00", "createdDateTime":
  "2023-10-24T20:01:11.9490387+00:00", "userDisplayName": "user15", "userPrincipalName":
  "user15@splunkresearch.onmicrosoft.com", "userId": "57e4bd36-9722-4a4a-9729-7203d8e00b72",
  "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active
  Directory PowerShell", "ipAddress": "1.2.3.4", "status": {"errorCode": 50076, "failureReason":
  "Due to a configuration change made by your administrator, or because you moved
  to a new location, you must use multi-factor authentication to access the resource.",
  "additionalDetails": "MFA required in Azure AD"}, "clientAppUsed": "Mobile Apps
  and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US)
  WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem":
  "Windows"}, "location": {"city": "Rochester", "state": "New York", "countryOrRegion":
  "US", "geoCoordinates": {"latitude": 20.756160123483984, "longitude": -73.99697875976562}},
  "mfaDetail": {}, "correlationId": "1f577997-0710-4bd4-848e-5854f748f7dc", "conditionalAccessStatus":
  "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences":
  [], "originalRequestId": "22608a25-1d9b-44b5-b0f2-cb94f06b2d00", "isInteractive":
  true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails":
  [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token",
  "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none",
  "processingTimeInMilliseconds": 72, "riskDetail": "none", "riskLevelAggregated":
  "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes":
  [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory",
  "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "887c9144-28b8-431b-885b-764fdeefcf62",
  "homeTenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "tenantId": "887c9144-28b8-431b-885b-764fdeefcf62",
  "authenticationDetails": [{"authenticationStepDateTime": "2023-10-24T20:01:11.9490387+00:00",
  "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the
  cloud", "succeeded": true, "authenticationStepResultDetail": "Correct password",
  "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0,
  "RequestSequence": 1}, {"authenticationStepDateTime": "2023-10-24T20:01:11.9490387+00:00",
  "succeeded": false, "authenticationStepResultDetail": "MFA required in Azure AD",
  "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies":
  [{"requirementProvider": "user", "detail": "Per-user MFA"}], "sessionLifetimePolicies":
  [], "authenticationRequirement": "multiFactorAuthentication", "alternateSignInName":
  "user15@splunkresearch.onmicrosoft.com", "signInIdentifier": "user15@splunkresearch.onmicrosoft.com",
  "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted":
  false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails":
  {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "JYpgIpsdtUSw8suU8GstAA",
  "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol":
  "ropc", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575",
  "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod":
  "none"}}'