Identity / Authentication and sign-in
AuditLogs
Entra ID directory audit events including user, group, role, and application changes
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC3 Identity, privilege, and configuration changes
Identity, privilege, and configuration changes: directory audit, cloud control plane, RBAC, Kubernetes API, security tool administration, virtualisation and MDM management
ACSC
- 2. Network device logsConfiguration changes
- 6. Virtualisation system logs
- 8. Cloud platform logging
- 9. Container logs
- 11. Mobile device management
CISA
- 1. Identity, credential, and access management (ICAM)1a Manage and track changes in attributes and credentials
- 4. Cloud environments (general logging)4a Any activity on breakglass accounts
- 5. Amazon Web Services (AWS)5a AWS CloudTrail
- 6. Cloud Azure6a-6b Azure Active Directory logs and Azure Activity
- 8. Google Cloud Platform (GCP)8a Admin audit
MITRE data sources
- User Account: User Account Modification
- Active Directory: Active Directory Object Modification
- Group: Group Modification
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
OperationName142TimeGenerated118Result91Category70InitiatedBy59CorrelationId53ActivityDisplayName31ResultType24LoggedByService20TargetResources20AADOperationType15Type12
Split hints
Rows to keep in Analytics with a split rule.
Keep role/group changes, credential changes, app modifications, and all actions by emergency access accounts in Analytics. Replace the placeholders with the object IDs of your emergency access accounts.
(OperationName has "Add member" or OperationName has "Remove member" or OperationName has "Add owner" or OperationName has "Remove owner" or OperationName has "role" or OperationName has "password" or OperationName has "credential" or OperationName has "application" or OperationName has "service principal" or OperationName has "policy" or OperationName has "conditional access" or tostring(InitiatedBy.user.id) in ("<emergency-account-object-id-1>", "<emergency-account-object-id-2>"))Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.