Post

Enhancements in #MicrosoftEntra (diagnostic) logs: Several interesting sign-in properties (including Session ID, status for Token Protection, or GSA traffic) have been added to the sign-in logs and available in #MicrosoftSentinel. (1/3)

Thomas Naunheim

@naunheim.cloud

11 Feb 2025

Previously, these details were only available in XDR Hunting table "AADSignInEventsBeta", Portal and/or Graph API. These added properties offer the opportunity to write new analytics rules and hunting queries, for example in the area of #TokenTheft. (2/3) learn.microsoft.com/en-us/azure/...

learn.microsoft.comAzure Monitor Logs reference - SigninLogs - Azure MonitorReference for SigninLogs table in Azure Monitor Logs.

Thomas Naunheim

@naunheim.cloud

Interested to learn more? I'll be talking about token hunting at #Yellowhat and covering how to leverage these new sign-in details. More details about this free community event can be found here: yellowhat.live (3/3)

yellowhat.liveYellowhatYellowhat is a cutting-edge cybersecurity event dedicated to Microsoft Security Technology, offering advanced deep-dive sessions (level 400+) for seasoned professionals. It brings together experts and...

11/2/25, 5:31 pm0 reposts1 like

No replies yet.