security_content/data_sources/azure_active_directory_set_domain_authentication.yml at develop · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
name: Azure Active Directory Set domain authentication
id: e7bcdab9-908c-40ab-ba38-5db54fa87750
version: 3
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs an event when the authentication method for a domain in Azure Active Directory is set or modified.
mitre_components:
    - Active Directory Object Modification
    - User Account Authentication
    - Cloud Service Modification
source: Azure AD
sourcetype: azure:monitor:aad
separator: operationName
separator_value: Set domain authentication
supported_TA:
    - name: Splunk Add-on for Microsoft Cloud Services
      url: https://splunkbase.splunk.com/app/3110
      version: 6.3.2
fields:
    - _time
    - Level
    - callerIpAddress
    - category
    - correlationId
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - durationMs
    - host
    - index
    - linecount
    - operationName
    - operationVersion
    - properties.activityDateTime
    - properties.activityDisplayName
    - properties.additionalDetails{}.key
    - properties.additionalDetails{}.value
    - properties.category
    - properties.correlationId
    - properties.id
    - properties.initiatedBy.user.displayName
    - properties.initiatedBy.user.id
    - properties.initiatedBy.user.ipAddress
    - properties.initiatedBy.user.userPrincipalName
    - properties.loggedByService
    - properties.operationType
    - properties.result
    - properties.resultReason
    - properties.targetResources{}.displayName
    - properties.targetResources{}.id
    - properties.targetResources{}.modifiedProperties{}.displayName
    - properties.targetResources{}.modifiedProperties{}.newValue
    - properties.targetResources{}.modifiedProperties{}.oldValue
    - properties.userAgent
    - punct
    - resourceId
    - resultSignature
    - source
    - sourcetype
    - splunk_server
    - tenantId
    - time
    - timeendpos
    - timestartpos
output_fields:
    - dest
    - user
    - src
    - vendor_account
    - vendor_product
example_log: '{"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Set domain authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "Level": 4, "properties": {"id": "Directory_57e60ecc-17b8-4ab5-815e-d538e1ca32a4_XDHHZ_434456733", "category": "DirectoryManagement", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:44:59.0372448+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}'