Identity / Authentication and sign-in
AADServicePrincipalSignInLogs
Service principal and application sign-in events from Entra ID for OAuth and API authentication
Recommendation
High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.
How the matrix worksC2 Authentication and credential use
Authentication and credential use, including non-interactive, service principal, managed identity, federated, VPN, NAC, and password vault access
ACSC
- 2. Network device logsVPN and NAC
- 3. Microsoft Domain Controller
- 4. Active Directory (AD) and Domain Service security logs
- 8. Cloud platform loggingEntra sign-in logs
CISA
- 1. Identity, credential, and access management (ICAM)1b Track usage of credentials
MITRE data sources
- User Account: Authentication
T3 High-volume aggregation
Primary, high or very-high volume, and the generic detection use is aggregation, threat-intelligence matching, baselining, or investigation.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
TimeGenerated13ResultType10ServicePrincipalId8AppId6ServicePrincipalName6IPAddress5CorrelationId4OperationName4Location3ResourceDisplayName3ConditionalAccessStatus2Identity2
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
- CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.