Cloud

Azure Entra ID (Azure AD)

Microsoft Entra ID sign-in and audit logs — interactive and non-interactive authentication, service principal sign-ins, and directory changes. Covers MFA, Conditional Access, AADSTS errors, and role/group management.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/cloud-azure-entra-id/generator.yml \
  --id entra-id \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
signin-interactive-success	Interactive sign-ins (browser, desktop apps)	~30%	authentication
signin-interactive-failure	Failed interactive sign-ins (AADSTS errors)	~10%	authentication
signin-noninteractive-success	Token refresh, SSO, background auth	~25%	authentication
signin-noninteractive-failure	Expired tokens, revoked sessions	~5%	authentication
signin-service-principal	App/service principal authentication	~15%	authentication
audit-directory-change	Directory changes (user/group/role/app mgmt)	~15%	iam

Realism Features

14 AADSTS error codes — bad password, locked, CA block, MFA required, KMSI interrupt
7 Conditional Access policies with enforced/reportOnly modes and grant controls
5 authentication methods — Password, FIDO2, Windows Hello, Authenticator push + passwordless
Service principal sign-ins with client secrets, certificates, and federated credentials
21 audit operations across 6 categories (User, Group, App, Role, Policy, Device)
18 users across 9 departments including 2 admins and 2 service accounts

Sample Output

{
  "@timestamp": "2026-03-04T10:15:22+00:00",
  "cloud": {
    "provider": "azure",
    "account": {
      "id": "aaaabbbb-0000-cccc-1111-dddd2222eeee"
    }
  },
  "event": {
    "action": "UserLoggedIn",
    "category": [
      "authentication"
    ],
    "dataset": "azure.signinlogs",
    "outcome": "success",
    "type": [
      "start",
      "allowed"
    ]
  },
  "user": {
    "domain": "contoso.com",
    "email": "sarah.jones@contoso.com",
    "full_name": "Sarah Jones",
    "name": "sarah.jones"
  },
  "azure": {
    "signinlogs": {
      "category": "SignInLogs",
      "result_type": "0",
      "properties": {
        "app_display_name": "Microsoft Graph",
        "client_app_used": "Browser",
        "conditional_access_status": "success",
        "is_interactive": true,
        "risk_level_aggregated": "none",
        "device_detail": {
          "browser": "Chrome 122.0.0",
          "operating_system": "Windows 10",
          "trust_type": "Hybrid Azure AD joined"
        },
        "authentication_details": [
          {
            "authentication_method": "Microsoft Authenticator (push notification)",
            "succeeded": true
          }
        ]
      }
    }
  }
}

Parameters

Parameter	Default	Description
agent_id	e3f4a5b6-...	Filebeat agent UUID
agent_version	8.17.0	Elastic Agent version
tenant_id	aaaabbbb-0000-cccc-...	Azure AD / Entra ID tenant ID

Related Generators

Cloud

AWS CloudTrail Management Events

AWS CloudTrail audit trail — API calls across EC2, IAM, STS, and S3 from a multi-account organization. Includes console logins, role assumptions, error injection, and 4 identity types.

Cloud

AWS GuardDuty Findings

AWS GuardDuty threat detection findings across EC2, IAM, and S3 resources. Covers 8 categories — Recon, UnauthorizedAccess, Policy, Trojan, Impact, CryptoCurrency, Stealth, and Backdoor — with 27 finding types, 10 threat actor IPs, and geo/ASN enrichment.

Cloud

AWS VPC Flow Logs

AWS VPC Flow Logs (v5) — network traffic records across multiple accounts, VPCs, and subnets. TCP/UDP/ICMP flows with ACCEPT/REJECT actions, NAT gateway traffic, and realistic byte/packet distributions.