Microsoft: Azure Active Directory audit data – Splunk Lantern

Azure Active Directory audit data provides information on the operations of your Active Directory resources. These audit logs capture CRUD (Create-Read-Update-Delete) type actions against Azure AD resources such as user accounts, security groups, and devices. These logs are separate to Azure Audit Logs, which focus specifically on auditing Azure from a management control plane perspective.

Data visibility

This data source provides insight into Active Directory changes, including new and old values. It is crucial for monitoring changes to Azure Active Directory. Critical security use cases can be delivered with this data. The following table describes high-value fields.

Field Name	Field Type	Description	Example
activityDate	string	Timestamp of activity	2020-07-16T07:22:48.4694093Z
activityDateTime	string	Timestamp of activity	2020-07-16T07:22:48.4694093Z
activityDisplayName	string	What action the user is performing	Update application – Certificates and secrets management
additionalDetails{}.key	string	Key value for the following field	User-Agent
additionalDetails{}.value	string	User agent for the users device	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
category	string	Azure category	ApplicationManagement
correlationId	string	Unique Azure correlation ID	6ef39773-eb79-4258-8ad0-c07fe5816715
initiatedBy.user.displayName	string	Display Name (if configured) of the user that initiated the activity	null
initiatedBy.user.id	string	User ID of the user that initiated the activity	545cdc90-e36f-41c9-a3df-0558cb8fe2cd
initiatedBy.user.ipAddress	string	IP Address (if known) of the device that initiated the activity	null
initiatedBy.user.userPrincipalName	string	Which user initiated the activity	jacobsmythe@jacobsmythe111.onmicrosoft.com
loggedByService	string	Which Azure service logged the activity	Core Directory
operationType	string	What type of operation was performed	Update
result	string	Status of the activity	success
targetResources{}.displayName	string	What resource was modified	Ry_P5_Splunk_AAFS_AAD
targetResources{}.id	string	ID of the resource	68fb76ac-2e44-4b65-a133-f7d40aa5c8f1

Data application

When your Splunk deployment is ingesting Azure Active Directory audit data, you can use the data to achieve the following objectives:

Configuration

The following sections provide information on configuring Splunk software to ingest this data source. To configure the device or software, we recommend that you leverage official Microsoft Azure resources.

Data ingestion

If your deployment is not already ingesting Azure Active Directory data, follow the Getting Data In guidance for Splunk Enterprise or the Onboarding and Forwarding Your Data guidance for Splunk Cloud.

The source type is azure:aad:audit.

In addition, you will need the Microsoft Azure Add-on for Splunk. The add-on can be downloaded here and the add-on documentation can be accessed here. Read and follow the documentation carefully to understand all the essential information you need to work with this data source, including how to install the add-on, configure Active Directory, and configure Splunk.

Data visibility

Data application

Configuration

Data ingestion

Related articles