elastic / elastic/integrations
[Azure] Add support for ServicePrincipalRiskEvents and RiskyServicePrincipals on the AD Identity Protection Ingest Pipeline.
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
Hello,
The Azure Active Directory integration documentation [mentions](https://docs.elastic.co/integrations/azure/adlogs) that the following Log categories are supported:
|data stream|log category|
|-----|-----|
|Sign-in| SignInLogs |
|Sign-in| NonInteractiveUserSignInLogs |
|Sign-in| ServicePrincipalSignInLogs |
|Sign-in| ManagedIdentitySignInLogs |
|Audit| AuditLogs |
|Identity Protection| RiskyUsers |
|Identity Protection| UserRiskEvents |
|Provisioning| ProvisioningLogs |
For the Identity Protection data stream, it supports just the `RiskyUsers` and `UserRiskEvents` log category, but Azure AD also provides `RiskyServicePrincipals` and `ServicePrincipalRiskEvents`, which are similar, but for Service Principal accounts and those two tables are not mentioned in the documentation.
We have a requirement to collect the logs from those two tables, and currently they do not seem to be supported as they have extra/different fields.
Contributor guide
Assessment
This issue has not been assessed yet.