Identity / Authentication and sign-in
SigninLogs
Interactive user sign-in events from Microsoft Entra ID including MFA, conditional access, and location
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC2 Authentication and credential use
Authentication and credential use, including non-interactive, service principal, managed identity, federated, VPN, NAC, and password vault access
ACSC
- 2. Network device logsVPN and NAC
- 3. Microsoft Domain Controller
- 4. Active Directory (AD) and Domain Service security logs
- 8. Cloud platform loggingEntra sign-in logs
CISA
- 1. Identity, credential, and access management (ICAM)1b Track usage of credentials
MITRE data sources
- User Account: Authentication
- Logon Session: Logon Session Creation
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
ResultType81TimeGenerated81UserPrincipalName70IPAddress53AppDisplayName45UserId29OperationName27Location22ResultDescription16UserType16CorrelationId14AppId12
Split hints
Rows to keep in Analytics with a split rule.
Keep failed sign-ins, risky sign-ins, MFA events, and all emergency access account sign-ins in Analytics. Replace the placeholders with the object IDs of your emergency access accounts.
(ResultType != "0" or RiskLevelDuringSignIn != "none" or ConditionalAccessStatus == "failure" or AuthenticationRequirement == "multiFactorAuthentication" or UserId in ("<emergency-account-object-id-1>", "<emergency-account-object-id-2>"))Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.