GitHub Repo

Data Source: Azure Active Directory Set domain authentication

Date: 2025-01-23

ID: e7bcdab9-908c-40ab-ba38-5db54fa87750

Author: Patrick Bareiss, Splunk

Logs an event when the authentication method for a domain in Azure Active Directory is set or modified.

Property Value
Source Azure AD
Sourcetype azure:monitor:aad
Separator operationName
+ Fields 

            1
            _time
          
            3
            Level
          
            5
            callerIpAddress
          
            7
            category
          
            9
            correlationId
          
            11
            date_hour
          
            13
            date_mday
          
            15
            date_minute
          
            17
            date_month
          
            19
            date_second
          
            21
            date_wday
          
            23
            date_year
          
            25
            date_zone
          
            27
            durationMs
          
            29
            host
          
            31
            index
          
            33
            linecount
          
            35
            operationName
          
            37
            operationVersion
          
            39
            properties.activityDateTime
          
            41
            properties.activityDisplayName
          
            43
            properties.additionalDetails{}.key
          
            45
            properties.additionalDetails{}.value
          
            47
            properties.category
          
            49
            properties.correlationId
          
            51
            properties.id
          
            53
            properties.initiatedBy.user.displayName
          
            55
            properties.initiatedBy.user.id
          
            57
            properties.initiatedBy.user.ipAddress
          
            59
            properties.initiatedBy.user.userPrincipalName
          
            61
            properties.loggedByService
          
            63
            properties.operationType
          
            65
            properties.result
          
            67
            properties.resultReason
          
            69
            properties.targetResources{}.displayName
          
            71
            properties.targetResources{}.id
          
            73
            properties.targetResources{}.modifiedProperties{}.displayName
          
            75
            properties.targetResources{}.modifiedProperties{}.newValue
          
            77
            properties.targetResources{}.modifiedProperties{}.oldValue
          
            79
            properties.userAgent
          
            81
            punct
          
            83
            resourceId
          
            85
            resultSignature
          
            87
            source
          
            89
            sourcetype
          
            91
            splunk_server
          
            93
            tenantId
          
            95
            time
          
            97
            timeendpos
          
            99
            timestartpos
          
            101
...
not set
1{"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Set domain authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "Level": 4, "properties": {"id": "Directory_57e60ecc-17b8-4ab5-815e-d538e1ca32a4_XDHHZ_434456733", "category": "DirectoryManagement", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:44:59.0372448+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}

Source: GitHub | Version: 2