Data Source: Azure Active Directory Sign-in activity

Created: 2024-05-22

Last Updated: 2026-10-14

ID: f9ed0a3a-9e20-4198-a035-d0a29593fbe0

Author: Patrick Bareiss, Splunk

Description

Logs an event when a user attempts to sign into Azure Active Directory, capturing authentication details and outcomes.

Details

Property	Value
Source	`Azure AD`
Sourcetype	`azure:monitor:aad`
Separator	operationName

Name ▲▼	Technique ▲▼	Type ▲▼
Azure AD Service Principal Authentication	Cloud Accounts	TTP
Azure AD User Consent Denied for OAuth Application	Steal Application Access Token	TTP
Azure AD Multiple AppIDs and UserAgents Authentication Spike	Valid Accounts	Anomaly
Azure AD Multiple Denied MFA Requests For User	Multi-Factor Authentication Request Generation	TTP
Azure AD Multiple Failed MFA Requests For User	Cloud Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
Detect Distributed Password Spray Attempts	Password Spraying	Hunting

Supported Apps

Splunk Add-on for Microsoft Cloud Services (version 6.3.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">authentication_method</span>
  
  <span class="pill kill-chain">authentication_service</span>
  
  <span class="pill kill-chain">callerIpAddress</span>
  
  <span class="pill kill-chain">category</span>
  
  <span class="pill kill-chain">command</span>
  
  <span class="pill kill-chain">correlationId</span>
  
  <span class="pill kill-chain">dataset_name</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_type</span>
  
  <span class="pill kill-chain">duration</span>
  
  <span class="pill kill-chain">durationMs</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">identity</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">location</span>
  
  <span class="pill kill-chain">object_id</span>
  
  <span class="pill kill-chain">operationName</span>
  
  <span class="pill kill-chain">operationVersion</span>
  
  <span class="pill kill-chain">path_from_resourceId</span>
  
  <span class="pill kill-chain">properties.alternateSignInName</span>
  
  <span class="pill kill-chain">properties.appDisplayName</span>
  
  <span class="pill kill-chain">properties.appId</span>
  
  <span class="pill kill-chain">properties.appServicePrincipalId</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.authenticationMethod</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.authenticationMethodDetail</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.authenticationStepDateTime</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.authenticationStepRequirement</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.authenticationStepResultDetail</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.RequestSequence</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.StatusSequence</span>
  
  <span class="pill kill-chain">properties.authenticationDetails{}.succeeded</span>
  
  <span class="pill kill-chain">properties.authenticationProcessingDetails{}.key</span>
  
  <span class="pill kill-chain">properties.authenticationProcessingDetails{}.value</span>
  
  <span class="pill kill-chain">properties.authenticationProtocol</span>
  
  <span class="pill kill-chain">properties.authenticationRequirement</span>
  
  <span class="pill kill-chain">properties.authenticationRequirementPolicies{}.detail</span>
  
  <span class="pill kill-chain">properties.authenticationRequirementPolicies{}.requirementProvider</span>
  
  <span class="pill kill-chain">properties.autonomousSystemNumber</span>
  
  <span class="pill kill-chain">properties.clientAppUsed</span>
  
  <span class="pill kill-chain">properties.clientCredentialType</span>
  
  <span class="pill kill-chain">properties.conditionalAccessStatus</span>
  
  <span class="pill kill-chain">properties.correlationId</span>
  
  <span class="pill kill-chain">properties.createdDateTime</span>
  
  <span class="pill kill-chain">properties.crossTenantAccessType</span>
  
  <span class="pill kill-chain">properties.deviceDetail.browser</span>
  
  <span class="pill kill-chain">properties.deviceDetail.deviceId</span>
  
  <span class="pill kill-chain">properties.deviceDetail.operatingSystem</span>
  
  <span class="pill kill-chain">properties.flaggedForReview</span>
  
  <span class="pill kill-chain">properties.homeTenantId</span>
  
  <span class="pill kill-chain">properties.id</span>
  
  <span class="pill kill-chain">properties.incomingTokenType</span>
  
  <span class="pill kill-chain">properties.ipAddress</span>
  
  <span class="pill kill-chain">properties.isInteractive</span>
  
  <span class="pill kill-chain">properties.isTenantRestricted</span>
  
  <span class="pill kill-chain">properties.location.city</span>
  
  <span class="pill kill-chain">properties.location.countryOrRegion</span>
  
  <span class="pill kill-chain">properties.location.geoCoordinates.latitude</span>
  
  <span class="pill kill-chain">properties.location.geoCoordinates.longitude</span>
  
  <span class="pill kill-chain">properties.location.state</span>
  
  <span class="pill kill-chain">properties.mfaDetail.authMethod</span>
  
  <span class="pill kill-chain">properties.originalRequestId</span>
  
  <span class="pill kill-chain">properties.originalTransferMethod</span>
  
  <span class="pill kill-chain">properties.processingTimeInMilliseconds</span>
  
  <span class="pill kill-chain">properties.resourceDisplayName</span>
  
  <span class="pill kill-chain">properties.resourceId</span>
  
  <span class="pill kill-chain">properties.resourceServicePrincipalId</span>
  
  <span class="pill kill-chain">properties.resourceTenantId</span>
  
  <span class="pill kill-chain">properties.riskDetail</span>
  
  <span class="pill kill-chain">properties.riskLevelAggregated</span>
  
  <span class="pill kill-chain">properties.riskLevelDuringSignIn</span>
  
  <span class="pill kill-chain">properties.riskState</span>
  
  <span class="pill kill-chain">properties.rngcStatus</span>
  
  <span class="pill kill-chain">properties.servicePrincipalId</span>
  
  <span class="pill kill-chain">properties.signInIdentifier</span>
  
  <span class="pill kill-chain">properties.signInTokenProtectionStatus</span>
  
  <span class="pill kill-chain">properties.ssoExtensionVersion</span>
  
  <span class="pill kill-chain">properties.status.additionalDetails</span>
  
  <span class="pill kill-chain">properties.status.errorCode</span>
  
  <span class="pill kill-chain">properties.status.failureReason</span>
  
  <span class="pill kill-chain">properties.tenantId</span>
  
  <span class="pill kill-chain">properties.tokenIssuerName</span>
  
  <span class="pill kill-chain">properties.tokenIssuerType</span>
  
  <span class="pill kill-chain">properties.uniqueTokenIdentifier</span>
  
  <span class="pill kill-chain">properties.userAgent</span>
  
  <span class="pill kill-chain">properties.userDisplayName</span>
  
  <span class="pill kill-chain">properties.userId</span>
  
  <span class="pill kill-chain">properties.userPrincipalName</span>
  
  <span class="pill kill-chain">properties.userType</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">reason</span>
  
  <span class="pill kill-chain">resourceId</span>
  
  <span class="pill kill-chain">response_time</span>
  
  <span class="pill kill-chain">result</span>
  
  <span class="pill kill-chain">result_id</span>
  
  <span class="pill kill-chain">resultDescription</span>
  
  <span class="pill kill-chain">resultSignature</span>
  
  <span class="pill kill-chain">resultType</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signinDateTime</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">tenantId</span>
  
  <span class="pill kill-chain">time</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_agent</span>
  
  <span class="pill kill-chain">user_id</span>
  
  <span class="pill kill-chain">user_type</span>
  
  <span class="pill kill-chain">vendor_account</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
</div>

Example Log

1{"time": "2023-10-30T15:45:23.4912263Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50140", "resultSignature": "None", "resultDescription": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.", "durationMs": 0, "callerIpAddress": "120.1.121.35", "correlationId": "3fa4b922-8482-fadf-ef18-4296af064abb", "identity": "user15", "Level": 4, "location": "US", "properties": {"id": "a2bee7fa-c0ef-4108-914b-1bc731a05700", "createdDateTime": "2023-10-30T15:41:14.534616+00:00", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "appId": "00000002-0000-0ff1-ce00-000000000000", "appDisplayName": "Office 365 Exchange Online", "ipAddress": "120.1.121.35", "status": {"errorCode": 50140, "failureReason": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.", "additionalDetails": "MFA completed in Azure AD"}, "clientAppUsed": "Browser", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", "deviceDetail": {"deviceId": "", "operatingSystem": "MacOs", "browser": "Chrome 118.0.0"}, "location": {"city": "Ohio", "state": "Ohio", "countryOrRegion": "US", "geoCoordinates": {"latitude": 85.75616073608398, "longitude": -48.996978759765625}}, "mfaDetail": {"authMethod": "Mobile app notification"}, "correlationId": "3fa4b922-8482-fadf-ef18-4296af064abb", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "a2bee7fa-c0ef-4108-914b-1bc731a05700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Login Hint Present", "value": "True"}, {"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 106, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-10-30T15:41:14.534616+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": true, "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}, {"authenticationStepDateTime": "2023-10-30T15:41:14+00:00", "authenticationMethod": "Mobile app notification", "succeeded": true, "authenticationStepResultDetail": "MFA successfully completed", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 1698680474164, "RequestSequence": 1698680465025}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "sessionLifetimePolicies": [], "authenticationRequirement": "multiFactorAuthentication", "alternateSignInName": "user15@splunkresearch.onmicrosoft.com", "signInIdentifier": "user15@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-ue-ou_ACEGRSxvHMaBXAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "8429eb5c-faeb-4ade-8eac-acc003790769", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}

Required Output Fields

dest
user
src
vendor_account
vendor_product

Source: GitHub | Version: 4