<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">callerIpAddress</span>
<span class="pill kill-chain">category</span>
<span class="pill kill-chain">command</span>
<span class="pill kill-chain">correlationId</span>
<span class="pill kill-chain">date_hour</span>
<span class="pill kill-chain">date_mday</span>
<span class="pill kill-chain">date_minute</span>
<span class="pill kill-chain">date_month</span>
<span class="pill kill-chain">date_second</span>
<span class="pill kill-chain">date_wday</span>
<span class="pill kill-chain">date_year</span>
<span class="pill kill-chain">date_zone</span>
<span class="pill kill-chain">dest</span>
<span class="pill kill-chain">dest_type</span>
<span class="pill kill-chain">durationMs</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">level</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">location</span>
<span class="pill kill-chain">object_id</span>
<span class="pill kill-chain">operationName</span>
<span class="pill kill-chain">operationVersion</span>
<span class="pill kill-chain">path_from_resourceId</span>
<span class="pill kill-chain">properties.__UDI_RequiredFields_EventTime</span>
<span class="pill kill-chain">properties.__UDI_RequiredFields_RegionScope</span>
<span class="pill kill-chain">properties.__UDI_RequiredFields_TenantId</span>
<span class="pill kill-chain">properties.__UDI_RequiredFields_UniqueId</span>
<span class="pill kill-chain">properties.apiVersion</span>
<span class="pill kill-chain">properties.appId</span>
<span class="pill kill-chain">properties.C_Iat</span>
<span class="pill kill-chain">properties.C_Idtyp</span>
<span class="pill kill-chain">properties.clientAuthMethod</span>
<span class="pill kill-chain">properties.clientRequestId</span>
<span class="pill kill-chain">properties.durationMs</span>
<span class="pill kill-chain">properties.identityProvider</span>
<span class="pill kill-chain">properties.ipAddress</span>
<span class="pill kill-chain">properties.location</span>
<span class="pill kill-chain">properties.operationId</span>
<span class="pill kill-chain">properties.requestId</span>
<span class="pill kill-chain">properties.requestMethod</span>
<span class="pill kill-chain">properties.requestUri</span>
<span class="pill kill-chain">properties.responseSizeBytes</span>
<span class="pill kill-chain">properties.responseStatusCode</span>
<span class="pill kill-chain">properties.roles</span>
<span class="pill kill-chain">properties.scopes</span>
<span class="pill kill-chain">properties.signInActivityId</span>
<span class="pill kill-chain">properties.tenantId</span>
<span class="pill kill-chain">properties.timeGenerated</span>
<span class="pill kill-chain">properties.tokenIssuedAt</span>
<span class="pill kill-chain">properties.userAgent</span>
<span class="pill kill-chain">properties.userId</span>
<span class="pill kill-chain">properties.UserPrincipalObjectID</span>
<span class="pill kill-chain">properties.wids</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">resourceId</span>
<span class="pill kill-chain">result</span>
<span class="pill kill-chain">result_id</span>
<span class="pill kill-chain">resultSignature</span>
<span class="pill kill-chain">signature</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">src</span>
<span class="pill kill-chain">src_ip</span>
<span class="pill kill-chain">status</span>
<span class="pill kill-chain">tenantId</span>
<span class="pill kill-chain">time</span>
<span class="pill kill-chain">timeendpos</span>
<span class="pill kill-chain">timestartpos</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">vendor_account</span>
<span class="pill kill-chain">vendor_product</span>
</div>
Data Source: Azure Active Directory NonInteractiveUserSignInLogs
Description
Data source object for Azure Active Directory NonInteractiveUserSignInLogs
Details
| Property | Value |
|---|---|
| Source | Azure AD |
| Sourcetype | azure:monitor:aad |
| Separator | operationName |
Related Detections
| Name | Technique | Type |
|---|---|---|
| Azure AD AzureHound UserAgent Detected | Cloud Account, Cloud Service Discovery | TTP |
Supported Apps
- Splunk Add-on for Microsoft Cloud Services (version 6.3.3)
Event Fields
Fields
Example Log
1{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}
Source: GitHub | Version: 3