Log baseline v0.5.1
GitHub
All tables
Identity / Authentication and sign-in

AADNonInteractiveUserSignInLogs

Non-interactive (token refresh, broker) sign-in events; extremely high volume but useful for token abuse detection

Recommendation

AnalyticsData lakePrimarySecondaryPrimary ยท Data lake365 days retention

High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.

How the matrix works

C2 Authentication and credential use

Authentication and credential use, including non-interactive, service principal, managed identity, federated, VPN, NAC, and password vault access

ACSC

  • 2. Network device logsVPN and NAC
  • 3. Microsoft Domain Controller
  • 4. Active Directory (AD) and Domain Service security logs
  • 8. Cloud platform loggingEntra sign-in logs

CISA

  • 1. Identity, credential, and access management (ICAM)1b Track usage of credentials

MITRE data sources

  • User Account: Authentication

T3 High-volume aggregation

Primary, high or very-high volume, and the generic detection use is aggregation, threat-intelligence matching, baselining, or investigation.

Lake supported in the Azure Monitor table feature matrix

Fields detections use

High-value fields

AppDisplayNameClientAppUsedConditionalAccessStatusCorrelationIdIPAddressLocationLocationDetailsResourceDisplayNameResultDescriptionResultTypeRiskLevelDuringSignInTimeGeneratedUserAgentUserIdUserPrincipalName

Most used in public rules

  1. TimeGenerated12
  2. ResultType9
  3. IPAddress8
  4. UserPrincipalName8
  5. AppDisplayName4
  6. AppId4
  7. CorrelationId4
  8. UserAgent4
  9. Category2
  10. ConditionalAccessStatus2
  11. Id2
  12. Identity2

Split hints

Rows to keep in Analytics with a split rule.

Keep failures, risky sign-ins, and all emergency access account sign-ins in Analytics; routine token refreshes to Data Lake. Replace the placeholders with the object IDs of your emergency access accounts.

(ResultType != "0" or RiskLevelDuringSignIn != "none" or UserId in ("<emergency-account-object-id-1>", "<emergency-account-object-id-2>"))

Sources for this recommendation

  • Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
  • ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
  • CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.
  • Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
  • Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.