Mengumpulkan log Audit Direktori Microsoft Entra ID (sebelumnya Azure Active Directory)
Versi Parser: 28.0
Didukung di:
Google SecOps
SIEM
Dokumen ini menjelaskan cara mengumpulkan log audit direktori Microsoft Entra ID (sebelumnya dikenal sebagai Azure Active Directory) dengan menyiapkan feed Google Security Operations. Anda dapat mengonfigurasi penyerapan menggunakan dua metode: Azure Event Hub (direkomendasikan) atau Third Party API.
Log audit direktori Entra ID mencatat perubahan yang dilakukan dalam tenant Anda, termasuk pengelolaan pengguna dan grup, pembaruan aplikasi, perubahan peran direktori, dan modifikasi kebijakan.
Sebelum memulai
Pastikan Anda memiliki prasyarat berikut:
- Instance Google SecOps.
- Akses istimewa ke portal Microsoft Azure.
- Peran Administrator Keamanan atau Administrator Global di Microsoft Entra ID (diperlukan untuk setelan diagnostik).
Metode 1: Azure Event Hub (direkomendasikan)
Metode ini melakukan streaming log audit Entra ID melalui Azure Event Hub dengan Capture diaktifkan, yang menulis data ke Azure Blob Storage. Kemudian, Google SecOps menyerap log dari Blob Storage menggunakan jenis feed Azure Blob Storage V2.
Mengonfigurasi Akun Azure Storage
Buat Akun Penyimpanan
- Di portal Azure, cari Storage accounts.
- Klik + Create.
Berikan detail konfigurasi berikut:
Setelan Nilai Langganan Pilih langganan Azure Anda Grup resource Pilih yang sudah ada atau buat yang baru Nama akun penyimpanan Masukkan nama unik (misalnya, secopsauditlogs)Region Pilih region yang paling dekat dengan namespace Event Hub Anda Performa Standar (direkomendasikan) Redundansi LRS (Locally redundant storage) atau GRS (Geo-redundant storage) Klik Review + create.
Tinjau ringkasan, lalu klik Buat.
Tunggu hingga deployment selesai.
Mendapatkan kredensial Akun Penyimpanan
- Buka Akun Penyimpanan yang Anda buat.
- Di navigasi kiri, pilih Kunci akses di bagian Keamanan + jaringan.
- Klik Tampilkan kunci.
- Salin dan simpan yang berikut:
- Nama akun penyimpanan
- Key 1 atau Key 2: Kunci akses bersama.
Buat namespace Event Hub dan Event Hub
Buat namespace Event Hub
- Di portal Azure, cari Event Hubs.
- Klik + Create.
Berikan detail konfigurasi berikut:
Setelan Nilai Langganan Pilih langganan Azure Anda Grup resource Pilih grup resource yang sama dengan akun penyimpanan Anda Nama namespace Masukkan nama unik (misalnya, secops-entraid-audit)Location Pilih region yang sama dengan akun penyimpanan Anda Tingkatan harga Standar (wajib untuk Event Hub Capture) Klik Tinjau + buat, lalu klik Buat.
Tunggu hingga deployment selesai.
Membuat Hub Acara
- Buka namespace Event Hub yang Anda buat.
- Klik + Event Hub di bagian atas.
- Berikan detail konfigurasi berikut:
- Nama: Masukkan nama (misalnya,
entraid-audit-logs). - Jumlah partisi: 2 (default, tingkatkan untuk throughput yang lebih tinggi).
- Kebijakan pembersihan: Hapus.
- Waktu retensi (jam): 24 (minimum, tingkatkan jika diperlukan untuk ketahanan).
- Nama: Masukkan nama (misalnya,
- Klik Tinjau + buat, lalu klik Buat.
Mengaktifkan Azure Event Hubs Capture
- Buka Event Hub yang Anda buat (di dalam namespace).
- Di navigasi sebelah kiri, pilih Capture.
- Setel Capture ke On.
Berikan detail konfigurasi berikut:
Setelan Nilai Periode waktu (menit) 5 (atau lebih rendah untuk hampir real-time) Jendela ukuran (MB) 300 Penyedia Pengambilan Gambar Azure Blob Storage Langganan Azure Pilih langganan Anda Akun Penyimpanan Pilih akun penyimpanan yang Anda buat Blob Container Buat atau pilih penampung (misalnya, entraid-audit-capture)Klik Simpan.
Mengonfigurasi setelan diagnostik Entra ID
- Login ke pusat admin Microsoft Entra sebagai Administrator Keamanan.
- Buka Entra ID > Monitoring & health > Diagnostic settings.
- Klik Tambahkan setelan diagnostik.
- Berikan detail konfigurasi berikut:
- Nama setelan diagnostik: Masukkan nama deskriptif (misalnya,
audit-logs-to-eventhub). - Di bagian Logs, pilih AuditLogs.
- Di bagian Detail tujuan, pilih Streaming ke hub peristiwa.
- Subscription: Pilih langganan yang berisi namespace Event Hub Anda.
- Event hub namespace: Pilih namespace yang Anda buat (misalnya,
secops-entraid-audit). - Nama hub peristiwa: Pilih Hub Peristiwa yang Anda buat (misalnya,
entraid-audit-logs). - Nama kebijakan hub peristiwa: Pilih RootManageSharedAccessKey.
- Nama setelan diagnostik: Masukkan nama deskriptif (misalnya,
Klik Simpan.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
- Setelan SIEM > Feed > Tambahkan Feed Baru
- Hub Konten > Paket Konten > Mulai
Mengonfigurasi feed di Google SecOps untuk menyerap log audit Entra ID
- Buka Setelan SIEM > Feed.
- Klik Tambahkan Feed Baru.
- Di halaman berikutnya, klik Konfigurasi satu feed.
- Di kolom Nama feed, masukkan nama untuk feed (misalnya,
Entra ID Audit Logs - Event Hub). - Pilih Microsoft Azure Blob Storage V2 sebagai Jenis sumber.
- Pilih Azure AD Directory Audit sebagai Log type.
- Klik Berikutnya.
Tentukan nilai untuk parameter input berikut:
- URI Azure: Masukkan URL endpoint Blob Service dengan jalur penampung pengambilan:
https://<storage-account>.blob.core.windows.net/entraid-audit-capture/Ganti
<storage-account>dengan nama akun penyimpanan Azure Anda.- Opsi penghapusan sumber: Pilih opsi penghapusan sesuai preferensi Anda:
- Jangan pernah: Tidak pernah menghapus file apa pun setelah transfer.
- Hapus file yang ditransfer: Menghapus file setelah transfer berhasil.
- Hapus file yang ditransfer dan direktori kosong: Menghapus file dan direktori kosong setelah transfer berhasil.
- Usia File Maksimum: Menyertakan file yang diubah dalam beberapa hari terakhir. Defaultnya adalah 180 hari.
- Shared key: Masukkan nilai kunci akses bersama dari Akun Penyimpanan.
- Namespace aset: Namespace aset.
- Label penyerapan: Label yang akan diterapkan ke peristiwa dari feed ini.
Klik Buat feed.
Setelah membuat feed, mungkin perlu waktu 5-10 menit sebelum log mulai muncul di Google SecOps.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
Untuk mengetahui informasi selengkapnya tentang feed Google Security Operations, lihat dokumentasi feed Google Security Operations. Untuk mengetahui informasi tentang persyaratan untuk setiap jenis feed, lihat Konfigurasi feed menurut jenis. Jika Anda mengalami masalah saat membuat feed, hubungi dukungan Google Security Operations.
Konfigurasi firewall Azure Storage (jika diaktifkan)
Jika Akun Azure Storage Anda menggunakan firewall, Anda harus menambahkan rentang IP Google SecOps.
- Di portal Azure, buka Akun Penyimpanan Anda.
- Pilih Networking di bagian Security + networking.
- Di bagian Firewalls and virtual networks, pilih Enabled from selected virtual networks and IP addresses.
- Di bagian Firewall, di bagian Rentang alamat, klik + Tambahkan rentang IP.
- Tambahkan setiap rentang IP Google SecOps dalam notasi CIDR.
- Lihat dokumentasi Daftar IP yang Diizinkan.
- Atau ambil secara terprogram menggunakan Feed Management API.
- Klik Simpan.
Metode 2: API Pihak Ketiga
Metode ini menggunakan Microsoft Graph API untuk mengambil log audit direktori Entra ID langsung dari tenant Microsoft Anda.
Mengonfigurasi daftar IP yang diizinkan
Sebelum membuat feed, Anda harus memasukkan rentang IP Google SecOps ke dalam daftar yang diizinkan di setelan jaringan Microsoft Azure atau kebijakan Akses Bersyarat Anda.
Mendapatkan rentang IP Google SecOps
- Buka Setelan SIEM > Feed.
- Klik Tambahkan Feed Baru.
- Catat rentang IP yang ditampilkan di antarmuka pembuatan feed.
- Atau, ambil rentang IP secara terprogram menggunakan Feed Management API.
Mengonfigurasi Akses Bersyarat untuk identitas workload (jika diperlukan)
Jika organisasi Anda menggunakan kebijakan Akses Bersyarat yang membatasi akses berdasarkan lokasi:
- Di pusat admin Microsoft Entra, buka Protection > Conditional Access > Named locations.
- Klik + Lokasi baru.
- Berikan detail konfigurasi berikut:
- Nama: Masukkan
Google SecOps IP Ranges. - Tandai sebagai lokasi tepercaya: Opsional, berdasarkan kebijakan keamanan Anda.
- Rentang IP: Tambahkan setiap rentang IP Google SecOps dalam notasi CIDR.
- Nama: Masukkan
- Klik Create.
- Buka Conditional Access > Policies.
- Untuk kebijakan apa pun yang berlaku untuk identitas workload, konfigurasi pengecualian untuk lokasi bernama
Google SecOps IP Rangesatau principal layanan tertentu.
Mengonfigurasi pendaftaran aplikasi Microsoft Entra
Membuat pendaftaran aplikasi
- Login ke pusat admin Microsoft Entra atau portal Azure.
- Buka Identity > Applications > App registrations.
- Klik New registration.
- Berikan detail konfigurasi berikut:
- Name: Masukkan nama deskriptif (misalnya,
Google SecOps Audit Logs Integration). - Jenis akun yang didukung: Pilih Accounts in this organizational directory only (Single tenant).
- Redirect URI: Biarkan kosong (tidak diperlukan untuk autentikasi principal layanan).
- Name: Masukkan nama deskriptif (misalnya,
- Klik Daftar.
- Setelah pendaftaran, salin dan simpan nilai berikut:
- ID aplikasi (klien)
- Directory (tenant) ID
Mengonfigurasi izin API
- Di pendaftaran aplikasi, buka API permissions.
- Klik Add a permission.
- Pilih Microsoft Graph > Izin aplikasi.
- Telusuri dan pilih izin berikut:
- AuditLog.Read.All - Diperlukan untuk membaca log audit direktori.
- Directory.Read.All - Diperlukan oleh Microsoft Graph API untuk akses log audit.
- Klik Add permissions.
- Klik Grant admin consent for [Your Organization].
Pastikan kolom Status menampilkan Diberikan untuk [Organisasi Anda] untuk semua izin.
| Izin | Jenis | Deskripsi |
|---|---|---|
| AuditLog.Read.All | Aplikasi | Membaca semua data log audit |
| Directory.Read.All | Aplikasi | Membaca data direktori (diperlukan untuk akses API) |
Buat rahasia klien
- Di pendaftaran aplikasi, buka Certificates & secrets.
- Klik New client secret.
Berikan detail konfigurasi berikut:
- Description: Masukkan nama deskriptif (misalnya,
Google SecOps Feed). - Masa berlaku: Pilih periode masa berlaku.
- Description: Masukkan nama deskriptif (misalnya,
Klik Tambahkan.
Segera salin Nilai rahasia klien.
Penting: Nilai rahasia hanya ditampilkan satu kali dan tidak dapat diambil setelah keluar dari halaman ini. Jika Anda kehilangan nilai tersebut, Anda harus membuat rahasia klien baru.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
- Setelan SIEM > Feed > Tambahkan Feed Baru
- Hub Konten > Paket Konten > Mulai ### Mengonfigurasi feed di Google SecOps untuk menyerap log audit Entra ID
- Buka Setelan SIEM > Feed.
- Klik Tambahkan Feed Baru.
- Di halaman berikutnya, klik Konfigurasi satu feed.
- Di kolom Nama feed, masukkan nama untuk feed (misalnya,
Entra ID Directory Audit Logs). - Pilih Third Party API sebagai Source type.
- Pilih Azure AD Directory Audit sebagai Log type.
- Klik Berikutnya.
Tentukan nilai untuk parameter input berikut:
- Client ID OAuth: Masukkan ID Aplikasi (klien) dari pendaftaran aplikasi.
- OAuth Client Secret: Masukkan nilai rahasia klien yang Anda salin sebelumnya.
- Tenant ID: Masukkan Directory (tenant) ID dari pendaftaran aplikasi dalam format UUID (misalnya,
0fc279f9-fe30-41be-97d3-abe1d7681418). - Jalur Lengkap API: Masukkan URL endpoint Microsoft Graph REST API:
graph.microsoft.com/v1.0/auditLogs/directoryAudits- API Authentication Endpoint: Masukkan endpoint autentikasi Microsoft Active Directory:
login.microsoftonline.com- Namespace aset: Namespace aset.
- Label penyerapan: Label yang akan diterapkan ke peristiwa dari feed ini.
Klik Buat feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
Untuk mengetahui informasi selengkapnya tentang feed Google Security Operations, lihat dokumentasi feed Google Security Operations. Untuk mengetahui informasi tentang persyaratan untuk setiap jenis feed, lihat Konfigurasi feed menurut jenis. Jika Anda mengalami masalah saat membuat feed, hubungi dukungan Google Security Operations.
Endpoint regional
Untuk deployment Microsoft Entra ID di cloud kedaulatan, gunakan endpoint regional yang sesuai:
| Lingkungan Cloud | Jalur Lengkap API | Endpoint Autentikasi API |
|---|---|---|
| Global | graph.microsoft.com/v1.0/auditLogs/directoryAudits |
login.microsoftonline.com |
| L4 Pemerintah AS | graph.microsoft.us/v1.0/auditLogs/directoryAudits |
login.microsoftonline.us |
| Pemerintah AS L5 (DOD) | dod-graph.microsoft.us/v1.0/auditLogs/directoryAudits |
login.microsoftonline.us |
| China (21Vianet) | microsoftgraph.chinacloudapi.cn/v1.0/auditLogs/directoryAudits |
login.chinacloudapi.cn |
Tabel pemetaan UDM
| Kolom Log | Pemetaan UDM | Logika |
|---|---|---|
grouptypelabel |
about.group.attribute.labels |
Digabung |
targetResourceType |
about.group.attribute.labels |
Dipetakan: Group → grouptypelabel |
target.displayName |
about.group.group_display_name |
Dipetakan secara langsung |
target.id |
about.group.product_object_id |
Dipetakan secara langsung |
resultField |
about.labels |
Digabung |
target.displayName |
about.resource.name |
Dipetakan secara langsung |
target.id |
about.resource.product_object_id |
Dipetakan secara langsung |
targetResourceType |
about.resource.resource_subtype |
Dipetakan secara langsung |
target.id |
about.user.product_object_id |
Dipetakan secara langsung |
initiatedBy.user.displayName |
about.user.user_display_name |
Dipetakan secara langsung |
policies.displayName |
about.user.user_display_name |
Dipetakan secara langsung |
target.displayName |
about.user.user_display_name |
Dipetakan secara langsung |
policies.id |
about.user.userid |
Dipetakan secara langsung |
userPrincipalName |
about.user.userid |
Dipetakan secara langsung |
AdditionalDetail_label |
additional.fields |
Digabung |
ReleaseVersion_label |
additional.fields |
Digabung |
Stamp_label |
additional.fields |
Digabung |
_field |
additional.fields |
Digabung |
add_about_field |
additional.fields |
Digabung |
add_about_label |
additional.fields |
Digabung |
additional_applicationFilter |
additional.fields |
Digabung |
additional_applicationFilter_new |
additional.fields |
Digabung |
additional_builtInControls |
additional.fields |
Digabung |
additional_builtInControls_new |
additional.fields |
Digabung |
additional_category |
additional.fields |
Digabung |
additional_clientAppTypes |
additional.fields |
Digabung |
additional_clientAppTypes_new |
additional.fields |
Digabung |
additional_createdDateTime_new |
additional.fields |
Digabung |
additional_createdDateTime_old |
additional.fields |
Digabung |
additional_customAuthenticationFactors |
additional.fields |
Digabung |
additional_customAuthenticationFactors_new |
additional.fields |
Digabung |
additional_displayName |
additional.fields |
Digabung |
additional_displayName_new |
additional.fields |
Digabung |
additional_displayname |
additional.fields |
Digabung |
additional_excludeApplications |
additional.fields |
Digabung |
additional_excludeApplications_new |
additional.fields |
Digabung |
additional_excludeGroups |
additional.fields |
Digabung |
additional_excludeGroups_new |
additional.fields |
Digabung |
additional_excludeLocations |
additional.fields |
Digabung |
additional_excludeLocations_new |
additional.fields |
Digabung |
additional_excludePlatform |
additional.fields |
Digabung |
additional_excludePlatforms_new |
additional.fields |
Digabung |
additional_excludeUsers |
additional.fields |
Digabung |
additional_excludeUsers_new |
additional.fields |
Digabung |
additional_fields |
additional.fields |
Digabung |
additional_id |
additional.fields |
Digabung |
additional_id_new |
additional.fields |
Digabung |
additional_includeApplications |
additional.fields |
Digabung |
additional_includeApplications_new |
additional.fields |
Digabung |
additional_includeAuthenticationContextClassReferences |
additional.fields |
Digabung |
additional_includeAuthenticationContextClassReferences_new |
additional.fields |
Digabung |
additional_includeGroups |
additional.fields |
Digabung |
additional_includeGroups_new |
additional.fields |
Digabung |
additional_includeLocations |
additional.fields |
Digabung |
additional_includeLocations_new |
additional.fields |
Digabung |
additional_includePlatform |
additional.fields |
Digabung |
additional_includePlatforms_new |
additional.fields |
Digabung |
additional_includeRoles |
additional.fields |
Digabung |
additional_includeRoles_new |
additional.fields |
Digabung |
additional_includeUserActions |
additional.fields |
Digabung |
additional_includeUserActions_new |
additional.fields |
Digabung |
additional_includeUsers |
additional.fields |
Digabung |
additional_includeUsers_new |
additional.fields |
Digabung |
additional_includeuserRiskLevel |
additional.fields |
Digabung |
additional_label |
additional.fields |
Digabung |
additional_loggedByService |
additional.fields |
Digabung |
additional_modifiedDateTime_new |
additional.fields |
Digabung |
additional_modifiedDateTime_old |
additional.fields |
Digabung |
additional_newValue |
additional.fields |
Digabung |
additional_oldValue |
additional.fields |
Digabung |
additional_old_operator |
additional.fields |
Digabung |
additional_operator |
additional.fields |
Digabung |
additional_resourceId |
additional.fields |
Digabung |
additional_servicePrincipalRiskLevels |
additional.fields |
Digabung |
additional_servicePrincipalRiskLevels_new |
additional.fields |
Digabung |
additional_signInRiskLevels |
additional.fields |
Digabung |
additional_signInRiskLevels_new |
additional.fields |
Digabung |
additional_state |
additional.fields |
Digabung |
additional_state_new |
additional.fields |
Digabung |
additional_termsOfUses |
additional.fields |
Digabung |
additional_termsOfUses_new |
additional.fields |
Digabung |
additional_userRiskLevels_new |
additional.fields |
Digabung |
agentSubjectType_label |
additional.fields |
Digabung |
agentType_label |
additional.fields |
Digabung |
agent_type_label |
additional.fields |
Digabung |
aio_label |
additional.fields |
Digabung |
appDisplayName_label |
additional.fields |
Digabung |
appId_label |
additional.fields |
Digabung |
app_owner_tenant_id_label |
additional.fields |
Digabung |
app_service_principal_id_label |
additional.fields |
Digabung |
appidacr_label |
additional.fields |
Digabung |
aud_label |
additional.fields |
Digabung |
authentication_processing_details_label |
additional.fields |
Digabung |
authentication_protocol_label |
additional.fields |
Digabung |
authentication_strengths_label |
additional.fields |
Digabung |
changed_applicationFilter_label |
additional.fields |
Digabung |
changed_builtInControls_new |
additional.fields |
Digabung |
changed_clientAppTypes_label |
additional.fields |
Digabung |
changed_createdDateTime_label |
additional.fields |
Digabung |
changed_customAuthenticationFactors_new |
additional.fields |
Digabung |
changed_displayName_label |
additional.fields |
Digabung |
changed_excludeApplications_new |
additional.fields |
Digabung |
changed_excludeGroups_new |
additional.fields |
Digabung |
changed_excludeLocations_new |
additional.fields |
Digabung |
changed_excludePlatforms_new |
additional.fields |
Digabung |
changed_excludeUsers_new |
additional.fields |
Digabung |
changed_id_label |
additional.fields |
Digabung |
changed_includeApplications_label |
additional.fields |
Digabung |
changed_includeAuthenticationContextClassReferences_new |
additional.fields |
Digabung |
changed_includeGroups_new |
additional.fields |
Digabung |
changed_includeLocations_label |
additional.fields |
Digabung |
changed_includePlatforms_new |
additional.fields |
Digabung |
changed_includeRoles_new |
additional.fields |
Digabung |
changed_includeUserActions_new |
additional.fields |
Digabung |
changed_includeUsers_new |
additional.fields |
Digabung |
changed_modifiedDateTime_label |
additional.fields |
Digabung |
changed_operator_label |
additional.fields |
Digabung |
changed_servicePrincipalRiskLevels_new |
additional.fields |
Digabung |
changed_signInRiskLevels_new |
additional.fields |
Digabung |
changed_state_label |
additional.fields |
Digabung |
changed_termsOfUses_new |
additional.fields |
Digabung |
changed_userRiskLevels_new |
additional.fields |
Digabung |
claims_tenantid_label |
additional.fields |
Digabung |
client_credential_type_label |
additional.fields |
Digabung |
durationMs_label |
additional.fields |
Digabung |
duration_ms_label |
additional.fields |
Digabung |
eventCategory_label |
additional.fields |
Digabung |
event_name_label |
additional.fields |
Digabung |
exp_label |
additional.fields |
Digabung |
hierarchy_label |
additional.fields |
Digabung |
home_tenant_id_label |
additional.fields |
Digabung |
iat_label |
additional.fields |
Digabung |
identity_label |
additional.fields |
Digabung |
idtyp_label |
additional.fields |
Digabung |
incoming_token_type_label |
additional.fields |
Digabung |
initiatedBy_label |
additional.fields |
Digabung |
initiatedBy_type_label |
additional.fields |
Digabung |
isTenantRestricted_label |
additional.fields |
Digabung |
isThroughGlobalSecureAccess_label |
additional.fields |
Digabung |
iss_label |
additional.fields |
Digabung |
map_field |
additional.fields |
Digabung |
mfaAuthDetail_label |
additional.fields |
Digabung |
mfa_auth_method_label |
additional.fields |
Digabung |
modified_property_displayname |
additional.fields |
Dipetakan: userPrincipalName → old_value_label, userPrincipalName → new_value_label |
nameidentifier_label |
additional.fields |
Digabung |
nbf_label |
additional.fields |
Digabung |
new_value_label |
additional.fields |
Digabung |
old_clientAppTypes |
additional.fields |
Dipetakan: new_clientAppTypes → changed_clientAppTypes_label |
old_createdDateTime |
additional.fields |
Dipetakan: new_createdDateTime → changed_createdDateTime_label |
old_displayName_value |
additional.fields |
Dipetakan: new_displayName_value → changed_displayName_label |
old_grantControls |
additional.fields |
Dipetakan: new_grantControls → changed_operator_label |
old_id_value |
additional.fields |
Dipetakan: new_id_value → changed_id_label |
old_includeLocations |
additional.fields |
Dipetakan: new_includeLocations → changed_includeLocations_label |
old_include_applications |
additional.fields |
Dipetakan: new_include_applications → changed_includeApplications_label, `new_include_appli... |
old_modifiedDateTime |
additional.fields |
Dipetakan: new_modifiedDateTime → changed_modifiedDateTime_label |
old_state_value |
additional.fields |
Dipetakan: new_state_value → changed_state_label |
old_value_label |
additional.fields |
Digabung |
operationType_label |
additional.fields |
Digabung |
originalRequestId_label |
additional.fields |
Digabung |
prop_isInteractive_label |
additional.fields |
Digabung |
prop_log_version_label |
additional.fields |
Digabung |
prop_processingTimeInMilliseconds_label |
additional.fields |
Digabung |
prop_signInIdentifierType_label |
additional.fields |
Digabung |
properties_category_label |
additional.fields |
Digabung |
properties_correlationId_label |
additional.fields |
Digabung |
provisioningAction_label |
additional.fields |
Digabung |
removed_builtInControls_label |
additional.fields |
Digabung |
removed_customAuthenticationFactors_label |
additional.fields |
Digabung |
removed_excludeApplications_label |
additional.fields |
Digabung |
removed_excludeGroups_label |
additional.fields |
Digabung |
removed_excludeLocations_label |
additional.fields |
Digabung |
removed_excludeUsers_label |
additional.fields |
Digabung |
removed_includeAuthenticationContextClassReferences_label |
additional.fields |
Digabung |
removed_includeGroups_label |
additional.fields |
Digabung |
removed_includePlatform_label |
additional.fields |
Digabung |
removed_includeRoles_label |
additional.fields |
Digabung |
removed_includeUserActions_label |
additional.fields |
Digabung |
removed_includeUsers_label |
additional.fields |
Digabung |
removed_includeuserRiskLevel_label |
additional.fields |
Digabung |
removed_servicePrincipalRiskLevels_label |
additional.fields |
Digabung |
removed_signInRiskLevels_label |
additional.fields |
Digabung |
removed_termsOfUses_label |
additional.fields |
Digabung |
resourceId_label |
additional.fields |
Digabung |
resource_owner_tenant_id_label |
additional.fields |
Digabung |
resource_service_principal_id_label |
additional.fields |
Digabung |
resource_tenant_id_label |
additional.fields |
Digabung |
result_signature_label |
additional.fields |
Digabung |
rh_label |
additional.fields |
Digabung |
riskEventType_label |
additional.fields |
Digabung |
roleAssignmentId_label |
additional.fields |
Digabung |
roleAssignmentScope_label |
additional.fields |
Digabung |
roleDefinitionId_label |
additional.fields |
Digabung |
serviceRequestId_label |
additional.fields |
Digabung |
session_id_label |
additional.fields |
Digabung |
signInEventTypes_label |
additional.fields |
Digabung |
sign_in_token_protection_status_label |
additional.fields |
Digabung |
signin_session_status_label |
additional.fields |
Digabung |
statusCode_label |
additional.fields |
Digabung |
targetResourceType |
additional.fields |
Dipetakan: "Device", "User", "Directory", "Application", "Group", "ServicePrincipal", "Role" ... |
targetResources_agentType_label |
additional.fields |
Digabung |
tenantId_Label |
additional.fields |
Digabung |
tenantId_label |
additional.fields |
Digabung |
tenant_id_label |
additional.fields |
Digabung |
tokenIssuerType_label |
additional.fields |
Digabung |
token_protection_type_label |
additional.fields |
Digabung |
trustType_label |
additional.fields |
Digabung |
unique_token_identifier_label |
additional.fields |
Digabung |
uti_label |
additional.fields |
Digabung |
ver_label |
additional.fields |
Digabung |
xms_ftd_label |
additional.fields |
Digabung |
xms_idrel_label |
additional.fields |
Digabung |
xms_rd_label |
additional.fields |
Digabung |
xms_tcdt_label |
additional.fields |
Digabung |
operationName |
extensions.auth.type |
Dipetakan: Sign-in activity → SSO |
target_userid_present |
extensions.auth.type |
Dipetakan: true → MACHINE |
logged_by_service |
intermediary.application |
Dipetakan secara langsung |
ActivityDisplayName |
metadata.description |
Dipetakan secara langsung |
record_properties_message |
metadata.description |
Dipetakan jika record_properties_message != `` |
resultDescription |
metadata.description |
Dipetakan secara langsung |
ActivityDateTime |
metadata.event_timestamp |
Diurai sebagai yyyy-MM-ddTHH:mm:ss.SSSSSSSZ |
TimeGenerated |
metadata.event_timestamp |
Diurai sebagai yyyy-MM-ddTHH:mm:ss.SSSSSSSZ |
_TimeReceived |
metadata.event_timestamp |
Diurai sebagai yyyy-MM-ddTHH:mm:ss.SSSSSSSZ |
logcollector_timestamp |
metadata.event_timestamp |
Diurai sebagai ISO8601 |
properties.activityDateTime |
metadata.event_timestamp |
Diurai sebagai ISO8601 |
record.time |
metadata.event_timestamp |
Diurai sebagai ISO8601 |
time |
metadata.event_timestamp |
Diurai sebagai ISO8601 |
time_1 |
metadata.event_timestamp |
Diurai sebagai UNIX |
when |
metadata.event_timestamp |
Diurai sebagai ISO8601 |
activityDisplayName |
metadata.event_type |
Nilai yang dipetakan (total 96, misalnya Admin deleted security info → USER_DELETION, `Add applicat... |
category |
metadata.event_type |
Nilai yang dipetakan (total 98, misalnya AdministrativeUnit → USER_RESOURCE_CREATION, `Administrasi... |
eventType |
metadata.event_type |
Dipetakan: USER_UNCATEGORIZED → USER_RESOURCE_ACCESS |
has_principal |
metadata.event_type |
Dipetakan: true → STATUS_UPDATE |
has_target_hostname |
metadata.event_type |
Dipetakan: true → NETWORK_CONNECTION |
has_target_resource |
metadata.event_type |
Dipetakan: true → USER_RESOURCE_ACCESS |
has_user |
metadata.event_type |
Dipetakan: true → USER_UNCATEGORIZED |
loggedByService |
metadata.event_type |
Nilai yang dipetakan (total 31, misalnya Application proxy → SERVICE_CREATION, Application proxy ... |
operationName |
metadata.event_type |
Dipetakan: Sign-in activity → USER_LOGIN |
principal_ip_present |
metadata.event_type |
Nilai yang dipetakan (total 7, misalnya true → USER_UNCATEGORIZED, true → NETWORK_CONNECTION, `... |
principal_userid_present |
metadata.event_type |
Nilai yang dipetakan (total 6, misalnya false → USER_RESOURCE_ACCESS, true → USER_UNCATEGORIZED... |
target_userid_present |
metadata.event_type |
Dipetakan: true → USER_CHANGE_PERMISSIONS, true → USER_CREATION, true → USER_LOGIN |
AADTenantId |
metadata.product_deployment_id |
Dipetakan secara langsung |
OperationName |
metadata.product_event_type |
Dipetakan secara langsung |
activityDisplayName |
metadata.product_event_type |
Dipetakan secara langsung |
operationName |
metadata.product_event_type |
Dipetakan secara langsung |
record_operationName |
metadata.product_event_type |
Dipetakan jika record_operationName != `` |
Id |
metadata.product_log_id |
Dipetakan secara langsung |
id |
metadata.product_log_id |
Dipetakan secara langsung |
properties.AuditEventId |
metadata.product_log_id |
Dipetakan secara langsung |
properties_id |
metadata.product_log_id |
Dipetakan secara langsung |
OperationVersion |
metadata.product_version |
Dipetakan secara langsung |
operationVersion |
metadata.product_version |
Dipetakan secara langsung |
kv.value |
network.http.parsed_user_agent |
Dipetakan secara langsung |
properties.userAgent |
network.http.parsed_user_agent |
Dipetakan secara langsung |
kv.value |
network.http.user_agent |
Dipetakan secara langsung |
properties.userAgent |
network.http.user_agent |
Dipetakan secara langsung |
correlationId |
network.session_id |
Dipetakan secara langsung |
record_correlationId |
network.session_id |
Dipetakan jika record_correlationId != `` |
domain |
principal.administrative_domain |
Dipetakan secara langsung |
InitiatedBy.app.displayName |
principal.application |
Dipetakan secara langsung |
clientAppUsed |
principal.application |
Dipetakan secara langsung |
initiatedBy.app.displayName |
principal.application |
Dipetakan secara langsung |
properties.Actor.ApplicationName |
principal.application |
Dipetakan secara langsung |
properties.servicePrincipal.Name |
principal.application |
Dipetakan secara langsung |
properties.servicePrincipalName |
principal.application |
Dipetakan secara langsung |
properties_initiatedBy_app_displayName |
principal.application |
Dipetakan secara langsung |
properties.deviceDetail.deviceId |
principal.asset.asset_id |
Dipetakan secara langsung |
isCompliant_label |
principal.asset.attribute.labels |
Digabung |
isManaged_label |
principal.asset.attribute.labels |
Digabung |
service_principal_id_label |
principal.asset.attribute.labels |
Digabung |
sourceSystem_label |
principal.asset.attribute.labels |
Digabung |
hardware |
principal.asset.hardware |
Digabung |
ip |
principal.asset.ip |
Digabung |
ip_addr |
principal.asset.ip |
Digabung |
ip_address |
principal.asset.ip |
Digabung |
ip_value |
principal.asset.ip |
Digabung |
principal_ip |
principal.asset.ip |
Digabung |
properties.sourceSystem.Id |
principal.asset.product_object_id |
Dipetakan secara langsung |
properties.deviceDetail.deviceId |
principal.asset_id |
Dipetakan secara langsung |
principal_hostname |
principal.hostname |
Dipetakan secara langsung |
ip |
principal.ip |
Digabung |
ip_addr |
principal.ip |
Digabung |
ip_address |
principal.ip |
Digabung |
ip_value |
principal.ip |
Digabung |
principal_ip |
principal.ip |
Digabung |
location.city |
principal.location.city |
Diganti nama/dipetakan |
prop_loc_city |
principal.location.city |
Dipetakan secara langsung |
location.countryOrRegion |
principal.location.country_or_region |
Diganti nama/dipetakan |
prop_loc_countryOrRegion |
principal.location.country_or_region |
Dipetakan secara langsung |
record_RoleLocation |
principal.location.name |
Dipetakan jika record_RoleLocation != `` |
location.geoCoordinates.latitude |
principal.location.region_latitude |
Diganti nama/dipetakan |
prop_loc_latitude |
principal.location.region_latitude |
Dipetakan secara langsung |
location.geoCoordinates.longitude |
principal.location.region_longitude |
Diganti nama/dipetakan |
prop_loc_longitude |
principal.location.region_longitude |
Dipetakan secara langsung |
location.state |
principal.location.state |
Diganti nama/dipetakan |
prop_loc_state |
principal.location.state |
Dipetakan secara langsung |
properties.deviceDetail.operatingSystem |
principal.platform_version |
Dipetakan secara langsung |
Identity_label |
principal.resource.attribute.labels |
Digabung |
_field |
principal.resource.attribute.labels |
Digabung |
activityDisplayName |
principal.resource.attribute.labels |
Dipetakan: `"Add user", "Update StsRefreshTokenValidFrom Timestamp", "Disable account", "Enable... |
app_id |
principal.resource.attribute.labels |
Digabung |
browser_label |
principal.resource.attribute.labels |
Digabung |
key |
principal.resource.attribute.labels |
Dipetakan: "IsDelegatedAdmin", "Actor_Name", "PartnerTenantId" → map_field, `"resource_grou... |
map_field |
principal.resource.attribute.labels |
Digabung |
prop_clientAppType_label |
principal.resource.attribute.labels |
Digabung |
properties_initiatedBy_app_appId_label |
principal.resource.attribute.labels |
Digabung |
user_principal_name_label |
principal.resource.attribute.labels |
Digabung |
Resource |
principal.resource.name |
Dipetakan secara langsung |
ResourceId |
principal.resource.product_object_id |
Dipetakan secara langsung |
properties.Actor.Application |
principal.resource.product_object_id |
Dipetakan secara langsung |
record_identity_evidence_authorization_principalType |
principal.resource.resource_subtype |
Dipetakan jika record_identity_evidence_authorization_principalType != `` |
Type |
principal.resource.type |
Dipetakan: (?i)AuditLogs → AUDIT_LOG |
role |
principal.user.attribute.roles |
Digabung |
role_label |
principal.user.attribute.roles |
Digabung |
user_role |
principal.user.attribute.roles |
Digabung |
InitiatedBy.user.userPrincipalName |
principal.user.email_addresses |
Digabung |
activityDisplayName |
principal.user.email_addresses |
Dipetakan: `"Add user", "Update StsRefreshTokenValidFrom Timestamp", "Disable account", "Enable... |
email |
principal.user.email_addresses |
Digabung |
initiatedBy.user.userPrincipalName |
principal.user.email_addresses |
Digabung |
properties.sourceIdentity.details.UserPrincipalName |
principal.user.email_addresses |
Digabung |
properties_Actor_UPN |
principal.user.email_addresses |
Digabung |
CorrelationId |
principal.user.product_object_id |
Dipetakan secara langsung |
initiatedBy.app.servicePrincipalId |
principal.user.product_object_id |
Dipetakan secara langsung |
initiatedBy.user.id |
principal.user.product_object_id |
Dipetakan secara langsung |
properties.Actor.ObjectId |
principal.user.product_object_id |
Dipetakan secara langsung |
properties.servicePrincipalId |
principal.user.product_object_id |
Dipetakan secara langsung |
properties.sourceIdentity.Id |
principal.user.product_object_id |
Dipetakan secara langsung |
properties.sourceIdentity.details.id |
principal.user.product_object_id |
Dipetakan secara langsung |
properties_initiatedBy_app_servicePrincipalId |
principal.user.product_object_id |
Dipetakan secara langsung |
InitiatedBy.user.displayName |
principal.user.user_display_name |
Dipetakan secara langsung |
initiatedBy.user.displayName |
principal.user.user_display_name |
Dipetakan secara langsung |
initiatedBy.user.userPrincipalName |
principal.user.user_display_name |
Dipetakan secara langsung |
properties.sourceIdentity.Name |
principal.user.user_display_name |
Dipetakan secara langsung |
properties.sourceIdentity.details.DisplayName |
principal.user.user_display_name |
Dipetakan secara langsung |
user_name |
principal.user.user_display_name |
Dipetakan secara langsung |
InitiatedBy.app.servicePrincipalId |
principal.user.userid |
Dipetakan secara langsung |
InitiatedBy.user.id |
principal.user.userid |
Dipetakan secara langsung |
initiatedBy.app.servicePrincipalName |
principal.user.userid |
Dipetakan secara langsung |
initiatedBy.user.userPrincipalName |
principal.user.userid |
Dipetakan secara langsung |
properties.initiatedBy.Id |
principal.user.userid |
Dipetakan secara langsung |
record_identity_evidence_authorization_principalId |
principal.user.userid |
Dipetakan jika record_identity_evidence_authorization_principalId != `` |
sec_result |
security_result |
Digabung |
Result |
security_result.action |
Dipetakan: (?i)success → security_result_action_allow, (?i)failure → `security_result_act... |
action |
security_result.action |
Digabung |
operationName |
security_result.action |
Dipetakan: Sign-in activity → action |
result |
security_result.action |
Dipetakan: (?i)success → security_result_action_allow, (?i)failure → `security_result_act... |
resultType |
security_result.action |
Dipetakan: 0 → action |
security_result_action |
security_result.action |
Digabung |
security_result_action_allow |
security_result.action |
Digabung |
security_result_action_block |
security_result.action |
Digabung |
operationType |
security_result.action_details |
Dipetakan secara langsung |
resultType |
security_result.action_details |
Dipetakan secara langsung |
Category |
security_result.category |
Digabung |
operationName |
security_result.category |
Dipetakan: Sign-in activity → Category |
Category |
security_result.category_details |
Dipetakan: (?i)Device → Category |
properties_category |
security_result.category_details |
Digabung |
sec_result_category_details |
security_result.category_details |
Digabung |
Result |
security_result.description |
Dipetakan secara langsung |
properties.provisioningStatusInfo.errorInformation |
security_result.description |
Dipetakan secara langsung |
properties_status_additionalDetails |
security_result.description |
Dipetakan secara langsung |
resultDescription |
security_result.description |
Dipetakan secara langsung |
resultReason |
security_result.description |
Dipetakan secara langsung |
_field |
security_result.detection_fields |
Digabung |
auth_app_device_app_version_label |
security_result.detection_fields |
Digabung |
auth_app_device_client_app_label |
security_result.detection_fields |
Digabung |
auth_app_device_id_label |
security_result.detection_fields |
Digabung |
auth_app_device_os_label |
security_result.detection_fields |
Digabung |
auth_app_policy_adminConfiguration_label |
security_result.detection_fields |
Digabung |
auth_app_policy_authenticationEvaluation_label |
security_result.detection_fields |
Digabung |
auth_app_policy_policyName_label |
security_result.detection_fields |
Digabung |
auth_app_policy_status_label |
security_result.detection_fields |
Digabung |
auth_detail_label |
security_result.detection_fields |
Digabung |
auth_id_label |
security_result.detection_fields |
Digabung |
auth_proc_det_label |
security_result.detection_fields |
Digabung |
auth_req_label |
security_result.detection_fields |
Digabung |
caa_label |
security_result.detection_fields |
Digabung |
detection_authenticationMethod |
security_result.detection_fields |
Digabung |
detection_authenticationMethodDetail |
security_result.detection_fields |
Digabung |
detection_authenticationStepDateTime |
security_result.detection_fields |
Digabung |
detection_authenticationStepRequirement |
security_result.detection_fields |
Digabung |
detection_authenticationStepResultDetail |
security_result.detection_fields |
Digabung |
detection_detail |
security_result.detection_fields |
Digabung |
detection_networkName |
security_result.detection_fields |
Digabung |
detection_networkType |
security_result.detection_fields |
Digabung |
detection_requestSequence |
security_result.detection_fields |
Digabung |
detection_requirementProvider |
security_result.detection_fields |
Digabung |
detection_statusSequence |
security_result.detection_fields |
Digabung |
detection_succeeded |
security_result.detection_fields |
Digabung |
enforcedGrantControls_label |
security_result.detection_fields |
Digabung |
enforcedSessionControls_label |
security_result.detection_fields |
Digabung |
key |
security_result.detection_fields |
Dipetakan: "cribl_source", "topic_name", "source_system", "internal_workspace_resource_id" → ... |
policy_conditionsNotSatisfied_label |
security_result.detection_fields |
Digabung |
policy_conditionsSatisfied_label |
security_result.detection_fields |
Digabung |
policy_displayName_label |
security_result.detection_fields |
Digabung |
policy_id_label |
security_result.detection_fields |
Digabung |
policy_result_label |
security_result.detection_fields |
Digabung |
resultType_label |
security_result.detection_fields |
Digabung |
riskLevelAggregated_label |
security_result.detection_fields |
Digabung |
session_lifetime_policy_detail_label |
security_result.detection_fields |
Digabung |
session_lifetime_policy_expirationRequirement_label |
security_result.detection_fields |
Digabung |
statusInfo_label |
security_result.detection_fields |
Digabung |
value_label |
security_result.detection_fields |
Digabung |
operationName |
security_result.priority |
Dipetakan: Sign-in activity → MEDIUM_PRIORITY |
riskLevelDuringSignIn |
security_result.priority |
Dipetakan: medium → MEDIUM_PRIORITY |
resultType |
security_result.rule_id |
Dipetakan secara langsung |
kv.value |
security_result.rule_name |
Dipetakan secara langsung |
Level |
security_result.severity |
Nilai yang dipetakan (total 5, misalnya "0", "1", "2" → CRITICAL, 3 → ERROR, 4 → HIGH) |
level |
security_result.severity |
Dipetakan: (?i)informational/info → INFORMATIONAL |
operationName |
security_result.severity |
Dipetakan: Sign-in activity → ERROR |
Level |
security_result.severity_details |
Dipetakan secara langsung |
level |
security_result.severity_details |
Dipetakan secara langsung |
AADOperationType |
security_result.summary |
Dipetakan secara langsung |
operationName |
security_result.summary |
Dipetakan: Sign-in activity → Successful login occurred, Sign-in activity → `Gagal login... |
properties.provisioningStatusInfo.Status |
security_result.summary |
Dipetakan secara langsung |
result |
security_result.summary |
Dipetakan secara langsung |
result1 |
security_result.summary |
Dipetakan secara langsung |
resultType |
security_result.summary |
Dipetakan: 0 → Successful login occurred |
prop_riskDetail |
security_result.threat_name |
Dipetakan secara langsung |
modified_properties_old_value_label |
src.resource.attribute.labels |
Digabung |
targetResourceType |
src.resource.attribute.labels |
Dipetakan: "Device", "User", "Directory", "Application", "Group", "ServicePrincipal", "Role" ... |
target_domain |
target.administrative_domain |
Dipetakan secara langsung |
appDisplayName |
target.application |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.asset.asset_id |
Dipetakan secara langsung |
targetSystem_ApplicationId_label |
target.asset.attribute.labels |
Digabung |
targetSystem_ServicePrincipalDisplayName_label |
target.asset.attribute.labels |
Digabung |
targetSystem_label |
target.asset.attribute.labels |
Digabung |
target_service_principal_label |
target.asset.attribute.labels |
Digabung |
kv.value |
target.asset.hostname |
Dipetakan secara langsung |
temp_display_name |
target.asset.hostname |
Dipetakan secara langsung |
properties.targetSystem.Id |
target.asset.product_object_id |
Dipetakan secara langsung |
grouptypelabel |
target.group.attribute.labels |
Digabung |
index |
target.group.attribute.labels |
Dipetakan: 0 → grouptypelabel |
targetResourceType |
target.group.attribute.labels |
Dipetakan: Group → grouptypelabel |
modifiedProperties.newValue |
target.group.group_display_name |
Dipetakan secara langsung |
target.displayName |
target.group.group_display_name |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.group.product_object_id |
Dipetakan secara langsung |
target.id |
target.group.product_object_id |
Dipetakan secara langsung |
kv.value |
target.hostname |
Dipetakan secara langsung |
temp_display_name |
target.hostname |
Dipetakan secara langsung |
target_ip |
target.ip |
Digabung |
kv.value |
target.process.pid |
Dipetakan secara langsung |
modified_properties_new_value_label_value |
target.process.pid |
Dipetakan secara langsung |
appId_label |
target.resource.attribute.labels |
Digabung |
app_id_label |
target.resource.attribute.labels |
Digabung |
authorization_scope_label |
target.resource.attribute.labels |
Digabung |
modifiedPropertie_label |
target.resource.attribute.labels |
Digabung |
modifiedProperty_name_label |
target.resource.attribute.labels |
Digabung |
modifiedProperty_new_value_label |
target.resource.attribute.labels |
Digabung |
modifiedProperty_old_value_label |
target.resource.attribute.labels |
Digabung |
modified_properties_new_value_label |
target.resource.attribute.labels |
Digabung |
newValue_label |
target.resource.attribute.labels |
Digabung |
targetResourceType |
target.resource.attribute.labels |
Dipetakan: "Device", "User", "Directory", "Application", "Group", "ServicePrincipal", "Role" ... |
target_Name_label |
target.resource.attribute.labels |
Digabung |
target_resource_display_name_label |
target.resource.attribute.labels |
Digabung |
target_resource_id_label |
target.resource.attribute.labels |
Digabung |
type_label |
target.resource.attribute.labels |
Digabung |
role |
target.resource.attribute.roles |
Digabung |
targetResourceType |
target.resource.attribute.roles |
Dipetakan: "Device", "User", "Directory", "Application", "Group", "ServicePrincipal", "Role" ... |
properties.resourceDisplayName |
target.resource.name |
Dipetakan secara langsung |
resourceDisplayName |
target.resource.name |
Dipetakan secara langsung |
temp_display_name |
target.resource.name |
Dipetakan secara langsung |
id |
target.resource.product_object_id |
Dipetakan secara langsung |
prop_resourceId |
target.resource.product_object_id |
Dipetakan secara langsung |
properties.TargetObjectIds.0 |
target.resource.product_object_id |
Dipetakan secara langsung |
targetResourceType |
target.resource.resource_subtype |
Dipetakan secara langsung |
activityDisplayName |
target.resource.type |
Nilai yang dipetakan (total 38, misalnya Add agreement → SETTING, `"Hapus perjanjian", "Hapus permanen... |
category |
target.resource.type |
Nilai yang dipetakan (total 18, misalnya Agreement → SETTING, ApplicationManagement → SETTING, ... |
loggedByService |
target.resource.type |
Dipetakan: Core Directory → SETTING |
principal_ip_present |
target.resource.type |
Dipetakan: true → SETTING |
type |
target.resource.type |
Dipetakan: Device → DEVICE |
kv.value |
target.url |
Dipetakan secara langsung |
user_attribute_labels |
target.user.attribute.labels |
Digabung |
role |
target.user.attribute.roles |
Digabung |
modifiedProperties.newValue |
target.user.department |
Digabung |
targetResourceType |
target.user.department |
Dipetakan: "Device", "User", "Directory", "Application", "Group", "ServicePrincipal", "Role" ... |
activityDisplayName |
target.user.email_addresses |
Dipetakan: Add member to role outside of PIM (permanent) → target.userPrincipalName |
kv.value |
target.user.email_addresses |
Digabung |
modifiedProperties.newValue |
target.user.email_addresses |
Digabung |
targer_user_principal_name |
target.user.email_addresses |
Dipetakan: (^.*@.*$) → target.userPrincipalName |
target.userPrincipalName |
target.user.email_addresses |
Digabung |
targetResourceType |
target.user.email_addresses |
Dipetakan: User → target.userPrincipalName, `"Device", "User", "Directory", "Application", ... |
target_email |
target.user.email_addresses |
Digabung |
temp_display_name |
target.user.email_addresses |
Dipetakan: (^.*@.*$) → temp_display_name |
modifiedProperties.newValue |
target.user.employee_id |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.user.first_name |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.user.last_name |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.user.office_address.name |
Dipetakan secara langsung |
kv.value |
target.user.phone_numbers |
Digabung |
modifiedProperties.newValue |
target.user.phone_numbers |
Digabung |
mp.newValue |
target.user.phone_numbers |
Digabung |
targetResourceType |
target.user.phone_numbers |
Dipetakan: "Device", "User", "Directory", "Application", "Group", "ServicePrincipal", "Role" ... |
modifiedProperties.newValue |
target.user.product_object_id |
Dipetakan secara langsung |
properties.targetIdentity.Id |
target.user.product_object_id |
Dipetakan secara langsung |
target.id |
target.user.product_object_id |
Dipetakan secara langsung |
userId |
target.user.product_object_id |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.user.title |
Dipetakan secara langsung |
TargetResource_displayName |
target.user.user_display_name |
Dipetakan secara langsung |
identity |
target.user.user_display_name |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.user.user_display_name |
Dipetakan secara langsung |
mp.newValue |
target.user.user_display_name |
Dipetakan secara langsung |
properties.TargetDisplayNames.0 |
target.user.user_display_name |
Dipetakan secara langsung |
properties.targetIdentity.Name |
target.user.user_display_name |
Dipetakan secara langsung |
properties.userDisplayName |
target.user.user_display_name |
Dipetakan secara langsung |
target.displayName |
target.user.user_display_name |
Dipetakan secara langsung |
target_user_name |
target.user.user_display_name |
Dipetakan secara langsung |
userPrincipalName |
target.user.user_display_name |
Dipetakan secara langsung |
TargetResource_id |
target.user.userid |
Dipetakan secara langsung |
identity |
target.user.userid |
Dipetakan secara langsung |
kv.value |
target.user.userid |
Dipetakan secara langsung |
modifiedProperties.newValue |
target.user.userid |
Dipetakan secara langsung |
prop_alternateSignInName |
target.user.userid |
Dipetakan secara langsung |
prop_signInIdentifier |
target.user.userid |
Dipetakan secara langsung |
prop_userPrincipalName |
target.user.userid |
Dipetakan secara langsung |
userPrincipalName |
target.user.userid |
Dipetakan secara langsung |
DATA:target_domain |
target.userPrincipalName |
Dipetakan secara langsung |
DATA:tgt_user_principal_name |
target.userPrincipalName |
Dipetakan secara langsung |
| T/A | extensions.auth.type |
Konstanta: SSO |
| T/A | metadata.event_type |
Konstanta: USER_LOGIN |
| T/A | metadata.product_name |
Konstanta: Azure AD Directory Audit |
| T/A | metadata.vendor_name |
Konstanta: Microsoft |
| T/A | network.http.parsed_user_agent |
Konstanta: parseduseragent |
| T/A | principal.resource.type |
Konstanta: AUDIT_LOG |
| T/A | security_result.priority |
Konstanta: MEDIUM_PRIORITY |
| T/A | security_result.severity |
Konstanta: INFORMATIONAL |
| T/A | security_result.summary |
Konstanta: Successful login occurred |
| T/A | target.resource.type |
Konstanta: DEVICE |
Log Perubahan
Melihat Log Perubahan untuk parser ini
Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.