Event Publishing Wizard - Edit Mode

Event Name

Native Name

Service

SK4 Unified Event

Event Type

Status

SK4 Version

Splunk Data Exists

Created Date

Sun Nov 18 2018 13:38:59 GMT+0000 (Coordinated Universal Time)

Last Update

Tue Jun 18 2019 11:16:07 GMT+0000 (Coordinated Universal Time)

Description

SPL Query

ELK Query

Development Notes

Raw Data

CEF:0|Skyformation|SkyFormation Cloud Apps Security|2.0.0|sk4-login-failure|login-failed|0|cat=access cn1=1 cn1Label=failure-number cs1=unknown cs1Label=login-type cs6Label=raw-event destinationServiceName=Office 365 deviceInboundInterface=d58ce8a8-986a-4c43-b575-00318cd39982 dproc=management-active-directory dtz=default-tenant end=1557146769000 flexString1=UserLoginFailed flexString1Label=application-action msg=[bob@sk4labs10.onmicrosoft.com] failed to login from IP [54.84.94.5] via [unknown] - [InvalidUserNameOrPassword] reason=InvalidUserNameOrPassword request=Failure requestClientApplication=Office365 latest 7.5 E5 requestCookies=N/A smac=STANDARD sntdom=Unknown sourceDnsDomain=Jersey/2.25.1 (HttpUrlConnection 1.8.0_181) sourceServiceName=AzureActiveDirectory src=54.84.94.5 suid=email suser=bob@sk4labs10.onmicrosoft.com ext_ResultStatus=Failed ext_InterSystemsId=a4813708-985f-4865-b050-9fb20b94265b ext_Actor_1__Type=5 ext_SupportTicketId= ext_ActorContextId=b426f2bd-b821-4d14-ab9e-a739b88d3a1d ext_ObjectId=Unknown ext_CreationTime=2019-05-06T12:46:09 ext_OrganizationId=b426f2bd-b821-4d14-ab9e-a739b88d3a1d ext_TargetContextId=b426f2bd-b821-4d14-ab9e-a739b88d3a1d ext_Workload=AzureActiveDirectory ext_ExtendedProperties_2__Name=ResultStatusDetail ext_Actor_0__Type=0 ext_Target_0__ID=Unknown ext_Id=d58ce8a8-986a-4c43-b575-00318cd39982 ext_ActorIpAddress=54.84.94.5 ext_ApplicationId=bfc44fc5-2fe3-4d02-98ec-1e5967475f68 ext_ExtendedProperties_1__Value=OrgIdWsTrust2:process ext_Actor_0__ID=8757087d-16f8-4c7c-83bd-940781882ff6 ext_RecordType=15 ext_LogonError=InvalidUserNameOrPassword ext_ClientIP=54.84.94.5 ext_UserType=0 ext_ExtendedProperties_0__Name=UserAgent ext_Target_0__Type=0 ext_Operation=UserLoginFailed ext_UserId=bob@sk4labs10.onmicrosoft.com ext_Actor_1__ID=bob@sk4labs10.onmicrosoft.com ext_AzureActiveDirectoryEventType=1 ext_Actor_2__ID=1003200041A83863 ext_IntraSystemId=2387d232-c18d-4ae1-bd63-dbad46dc3500 ext_ExtendedProperties_1__Name=RequestType ext_Actor_2__Type=3 ext_ModifiedProperties=[] ext_ExtendedProperties_0__Value=Jersey/2.25.1 (HttpUrlConnection 1.8.0_181) ext_UserKey=1003200041A83863@sk4labs10.onmicrosoft.com ext_ExtendedProperties_2__Value=UserError ext_Version=1 cs6={"CreationTime":"2019-05-06T12:46:09","Id":"d58ce8a8-986a-4c43-b575-00318cd39982","Operation":"UserLoginFailed","OrganizationId":"b426f2bd-b821-4d14-ab9e-a739b88d3a1d","RecordType":15,"ResultStatus":"Failed","UserKey":"1003200041A83863@sk4labs10.onmicrosoft.com","UserType":0,"Version":1,"Workload":"AzureActiveDirectory","ClientIP":"54.84.94.5","ObjectId":"Unknown","UserId":"bob@sk4labs10.onmicrosoft.com","AzureActiveDirectoryEventType":1,"ExtendedProperties":[{"Name":"UserAgent","Value":"Jersey/2.25.1 (HttpUrlConnection 1.8.0_181)"},{"Name":"RequestType","Value":"OrgIdWsTrust2:process"},{"Name":"ResultStatusDetail","Value":"UserError"}],"ModifiedProperties":[],"Actor":[{"ID":"8757087d-16f8-4c7c-83bd-940781882ff6","Type":0},{"ID":"bob@sk4labs10.onmicrosoft.com","Type":5},{"ID":"1003200041A83863","Type":3}],"ActorContextId":"b426f2bd-b821-4d14-ab9e-a739b88d3a1d","ActorIpAddress":"54.84.94.5","InterSystemsId":"a4813708-985f-4865-b050-9fb20b94265b","IntraSystemId":"2387d232-c18d-4ae1-bd63-dbad46dc3500","SupportTicketId":"","Target":[{"ID":"Unknown","Type":0}],"TargetContextId":"b426f2bd-b821-4d14-ab9e-a739b88d3a1d","ApplicationId":"bfc44fc5-2fe3-4d02-98ec-1e5967475f68","LogonError":"InvalidUserNameOrPassword"}

Supported also on