Data Source: Azure Active Directory

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 51ca21e5-bda2-4652-bb29-27c7bc18a81c

Author: Patrick Bareiss, Splunk

Description

All Azure Active Directory events

Details

Property	Value
Source	`Azure AD`
Sourcetype	`azure:monitor:aad`
Separator	operationName

Name ▲▼	Technique ▲▼	Type ▲▼
Azure AD Multiple Users Failing To Authenticate From Ip	Password Spraying, Credential Stuffing, Cloud Accounts	Anomaly
Azure AD Successful Authentication From Different Ips	Password Guessing, Password Spraying	TTP
Azure AD Federated Identity Credential Added To Service Principal	Cloud Accounts, Additional Cloud Credentials, Cloud Accounts	TTP
Azure AD High Number Of Failed Authentications For User	Password Guessing	TTP
Azure AD Multi-Source Failed Authentications Spike	Password Spraying, Credential Stuffing, Cloud Accounts	Hunting
Azure AD High Number Of Failed Authentications From Ip	Password Guessing, Password Spraying	TTP
Azure AD Concurrent Sessions From Different Ips	Browser Session Hijacking	TTP
Azure AD Successful PowerShell Authentication	Cloud Accounts, Cloud Accounts	TTP
Azure AD Authentication Failed During MFA Challenge	Cloud Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
Azure Active Directory High Risk Sign-in	Password Spraying, Cloud Accounts	TTP
Azure AD PIM Role Assignment Activated	Additional Cloud Roles	TTP
Azure AD Device Code Authentication	Steal Application Access Token, Spearphishing Link	TTP
Azure AD Temporary Access Pass Created	Cloud Accounts, Multi-Factor Authentication, Cloud Accounts	TTP
Azure AD Successful Single-Factor Authentication	Cloud Accounts, Cloud Accounts	TTP
Azure AD Unusual Number of Failed Authentications From Ip	Password Spraying, Credential Stuffing, Cloud Accounts	Anomaly
Azure AD PIM Role Assigned	Additional Cloud Roles	TTP
Azure AD Service Principal New Client Credentials	Additional Cloud Credentials	TTP
Azure AD Suspicious Device Registration	Device Registration, Cloud Accounts	Anomaly

Supported Apps

Splunk Add-on for Microsoft Cloud Services (version 6.3.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">additional_details</span>
  
  <span class="pill kill-chain">additional_details_name</span>
  
  <span class="pill kill-chain">additional_details_value</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">authentication_service</span>
  
  <span class="pill kill-chain">callerIpAddress</span>
  
  <span class="pill kill-chain">category</span>
  
  <span class="pill kill-chain">change_type</span>
  
  <span class="pill kill-chain">command</span>
  
  <span class="pill kill-chain">correlationId</span>
  
  <span class="pill kill-chain">dataset_name</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">description</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_type</span>
  
  <span class="pill kill-chain">durationMs</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">identity</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">location</span>
  
  <span class="pill kill-chain">object</span>
  
  <span class="pill kill-chain">object_attrs</span>
  
  <span class="pill kill-chain">object_category</span>
  
  <span class="pill kill-chain">object_id</span>
  
  <span class="pill kill-chain">operationName</span>
  
  <span class="pill kill-chain">operationVersion</span>
  
  <span class="pill kill-chain">path_from_resourceId</span>
  
  <span class="pill kill-chain">properties.activity</span>
  
  <span class="pill kill-chain">properties.activityDateTime</span>
  
  <span class="pill kill-chain">properties.activityDisplayName</span>
  
  <span class="pill kill-chain">properties.additionalDetails{}.key</span>
  
  <span class="pill kill-chain">properties.additionalDetails{}.value</span>
  
  <span class="pill kill-chain">properties.additionalInfo</span>
  
  <span class="pill kill-chain">properties.category</span>
  
  <span class="pill kill-chain">properties.correlationId</span>
  
  <span class="pill kill-chain">properties.crossTenantAccessType</span>
  
  <span class="pill kill-chain">properties.detectedDateTime</span>
  
  <span class="pill kill-chain">properties.detectionTimingType</span>
  
  <span class="pill kill-chain">properties.homeTenantId</span>
  
  <span class="pill kill-chain">properties.id</span>
  
  <span class="pill kill-chain">properties.initiatedBy.user.displayName</span>
  
  <span class="pill kill-chain">properties.initiatedBy.user.id</span>
  
  <span class="pill kill-chain">properties.initiatedBy.user.ipAddress</span>
  
  <span class="pill kill-chain">properties.initiatedBy.user.userPrincipalName</span>
  
  <span class="pill kill-chain">properties.ipAddress</span>
  
  <span class="pill kill-chain">properties.lastUpdatedDateTime</span>
  
  <span class="pill kill-chain">properties.location.city</span>
  
  <span class="pill kill-chain">properties.location.countryOrRegion</span>
  
  <span class="pill kill-chain">properties.location.geoCoordinates.altitude</span>
  
  <span class="pill kill-chain">properties.location.geoCoordinates.latitude</span>
  
  <span class="pill kill-chain">properties.location.geoCoordinates.longitude</span>
  
  <span class="pill kill-chain">properties.location.state</span>
  
  <span class="pill kill-chain">properties.loggedByService</span>
  
  <span class="pill kill-chain">properties.operationType</span>
  
  <span class="pill kill-chain">properties.requestId</span>
  
  <span class="pill kill-chain">properties.resourceTenantId</span>
  
  <span class="pill kill-chain">properties.result</span>
  
  <span class="pill kill-chain">properties.resultReason</span>
  
  <span class="pill kill-chain">properties.riskDetail</span>
  
  <span class="pill kill-chain">properties.riskEventType</span>
  
  <span class="pill kill-chain">properties.riskLevel</span>
  
  <span class="pill kill-chain">properties.riskState</span>
  
  <span class="pill kill-chain">properties.riskType</span>
  
  <span class="pill kill-chain">properties.source</span>
  
  <span class="pill kill-chain">properties.targetResources{}.displayName</span>
  
  <span class="pill kill-chain">properties.targetResources{}.id</span>
  
  <span class="pill kill-chain">properties.targetResources{}.modifiedProperties{}.displayName</span>
  
  <span class="pill kill-chain">properties.targetResources{}.modifiedProperties{}.newValue</span>
  
  <span class="pill kill-chain">properties.targetResources{}.modifiedProperties{}.oldValue</span>
  
  <span class="pill kill-chain">properties.targetResources{}.type</span>
  
  <span class="pill kill-chain">properties.tokenIssuerType</span>
  
  <span class="pill kill-chain">properties.userAgent</span>
  
  <span class="pill kill-chain">properties.userDisplayName</span>
  
  <span class="pill kill-chain">properties.userId</span>
  
  <span class="pill kill-chain">properties.userPrincipalName</span>
  
  <span class="pill kill-chain">properties.userType</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">resourceId</span>
  
  <span class="pill kill-chain">result</span>
  
  <span class="pill kill-chain">result_id</span>
  
  <span class="pill kill-chain">resultSignature</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">src_user</span>
  
  <span class="pill kill-chain">src_user_name</span>
  
  <span class="pill kill-chain">src_user_type</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">tenantId</span>
  
  <span class="pill kill-chain">time</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">type</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_agent</span>
  
  <span class="pill kill-chain">user_id</span>
  
  <span class="pill kill-chain">user_name</span>
  
  <span class="pill kill-chain">user_type</span>
  
  <span class="pill kill-chain">vendor_account</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">vendor_region</span>
  
</div>

Example Log

1{"time": "8/2/2023 1:08:44 PM", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/microsoft.aadiam", "operationName": "User Risk Detection", "operationVersion": "1.0", "category": "UserRiskEvents", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "72.43.122.40", "correlationId": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "identity": "ava.brown", "Level": 4, "location": "us", "properties": {"id": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "requestId": "14066cab-a7bf-4e12-ba3d-17a026373700", "correlationId": "20afe6ab-d103-42c9-a810-97c25b61b279", "riskType": "maliciousIPAddress", "riskEventType": "maliciousIPAddress", "riskState": "atRisk", "riskLevel": "high", "riskDetail": "none", "source": "IdentityProtection", "detectionTimingType": "offline", "activity": "signin", "ipAddress": "72.43.122.40", "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"altitude": 0.0, "latitude": 0, "longitude": -0}}, "activityDateTime": "2023-08-01T19:55:29.638Z", "detectedDateTime": "2023-08-02T9:12:15.353Z", "lastUpdatedDateTime": "2023-08-02T13:08:44.445Z", "userId": "bd4a5efd-ffd5-4e27-9d7d-96e9094a74ec", "userDisplayName": "Ava.Brown", "userPrincipalName": "Ava.Brown@splunkresearch.com", "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar  6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4\"}]", "tokenIssuerType": "AzureAD", "resourceTenantId": null, "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "userType": "member", "crossTenantAccessType": "none"}}

Required Output Fields

dest
user
src
vendor_account
vendor_product

Source: GitHub | Version: 3

Data Source: Azure Active Directory

Description

Details

Related Detections

Supported Apps

Event Fields

Example Log

Required Output Fields