{"time": "2023-11-06T20:22:51.5389424Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.126.71", "correlationId": "19945f51-2b54-416e-9f15-61a0038a1785", "identity": "Joseph.Phillips", "Level": 4, "location": "US", "properties": {"id": "3b094f07-842e-49b6-a1f3-34e2fe8e1300", "createdDateTime": "2023-11-06T20:50:41.9660188+00:00", "userDisplayName": "Joseph.Phillips", "userPrincipalName": "Joseph.Phillips@splunkresearch.onmicrosoft.com", "userId": "0d0b5d67-601c-4720-b10e-39df0c384b38", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.126.71", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "19945f51-2b54-416e-9f15-61a0038a1785", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "3b094f07-842e-49b6-a1f3-34e2fe8e1300", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 94, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:41.9660188+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Joseph.Phillips@splunkresearch.onmicrosoft.com", "signInIdentifier": "Joseph.Phillips@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "B08JOy6Etkmh8zTi_o4TAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:45.4628359Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "34.223.70.198", "correlationId": "9a16e260-5562-4833-b679-725444079d19", "identity": "Isabella.Moore", "Level": 4, "location": "US", "properties": {"id": "93a15966-b068-447d-8314-f3fa73614001", "createdDateTime": "2023-11-06T20:50:30.2432054+00:00", "userDisplayName": "Isabella.Moore", "userPrincipalName": "Isabella.Moore@splunkresearch.onmicrosoft.com", "userId": "848da797-6aa9-4240-b49a-12f33b64c450", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "34.223.70.198", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "9a16e260-5562-4833-b679-725444079d19", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "93a15966-b068-447d-8314-f3fa73614001", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 58, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:30.2432054+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Isabella.Moore@splunkresearch.onmicrosoft.com", "signInIdentifier": "Isabella.Moore@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "Zlmhk2iwfUSDFPP6c2FAAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:30.5054829Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.127.47", "correlationId": "9223b5bc-45ba-4678-8a3f-074591e14caa", "identity": "Emily.Lewis", "Level": 4, "location": "US", "properties": {"id": "84cdb101-8fe8-4cca-a6c7-9380809f3001", "createdDateTime": "2023-11-06T20:50:50.8144517+00:00", "userDisplayName": "Emily.Lewis", "userPrincipalName": "Emily.Lewis@splunkresearch.onmicrosoft.com", "userId": "91eb47d0-80d5-4e47-acbb-72a724b40442", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.127.47", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "9223b5bc-45ba-4678-8a3f-074591e14caa", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "84cdb101-8fe8-4cca-a6c7-9380809f3001", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 66, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:38.8144517+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Emily.Lewis@splunkresearch.onmicrosoft.com", "signInIdentifier": "Emily.Lewis@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "AbHNhOiPykymx5OAgJ8wAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:11.1172994Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.2", "correlationId": "329cff4f-24bc-4cd1-822c-4457d5545d3e", "identity": "Mason.Garcia", "Level": 4, "location": "US", "properties": {"id": "a77c3704-258d-4cb9-90d3-cc231f824001", "createdDateTime": "2023-11-06T20:50:35.3869902+00:00", "userDisplayName": "Mason.Garcia", "userPrincipalName": "Mason.Garcia@splunkresearch.onmicrosoft.com", "userId": "f1a4a230-1a57-4d8b-9ef0-295b659cad6f", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.2", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "329cff4f-24bc-4cd1-822c-4457d5545d3e", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "a77c3704-258d-4cb9-90d3-cc231f824001", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 47, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:35.3869902+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Mason.Garcia@splunkresearch.onmicrosoft.com", "signInIdentifier": "Mason.Garcia@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "BDd8p40luUyQ08wjH4JAAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:58.7963719Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.80", "correlationId": "ced84fe5-4f6f-42e1-8f17-c3869bb577c6", "identity": "Alexander.Rodriguez", "Level": 4, "location": "US", "properties": {"id": "da32853a-961d-44be-b71a-a4410df25301", "createdDateTime": "2023-11-06T20:50:38.2809827+00:00", "userDisplayName": "Alexander.Rodriguez", "userPrincipalName": "Alexander.Rodriguez@splunkresearch.onmicrosoft.com", "userId": "4e7c90ab-fd78-4193-9d4c-16f48d8fd82c", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.80", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "ced84fe5-4f6f-42e1-8f17-c3869bb577c6", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "da32853a-961d-44be-b71a-a4410df25301", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 73, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:38.2809827+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Alexander.Rodriguez@splunkresearch.onmicrosoft.com", "signInIdentifier": "Alexander.Rodriguez@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "OoUy2h2WvkS3GqRBDfJTAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:39.1503831Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.105", "correlationId": "af93fbf6-6222-45b7-8d95-12fb6264ffd7", "identity": "William.Davis", "Level": 4, "location": "US", "properties": {"id": "981ef7af-f1f0-4889-ab94-3a14a6393201", "createdDateTime": "2023-11-06T20:50:28.4138975+00:00", "userDisplayName": "William.Davis", "userPrincipalName": "William.Davis@splunkresearch.onmicrosoft.com", "userId": "0c7072ad-a51f-4321-a281-9eb0575638d5", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.105", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "af93fbf6-6222-45b7-8d95-12fb6264ffd7", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "981ef7af-f1f0-4889-ab94-3a14a6393201", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 43, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:28.4138975+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "William.Davis@splunkresearch.onmicrosoft.com", "signInIdentifier": "William.Davis@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "r_cemPDxiUirlDoUpjkyAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:39.1503831Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "34.223.69.193", "correlationId": "71fe4675-3916-440e-8295-3de8b6dfa2bb", "identity": "Olivia.Williams", "Level": 4, "location": "US", "properties": {"id": "981ef7af-f1f0-4889-ab94-3a1422393201", "createdDateTime": "2023-11-06T20:50:26.338105+00:00", "userDisplayName": "Olivia.Williams", "userPrincipalName": "Olivia.Williams@splunkresearch.onmicrosoft.com", "userId": "f4b8f6d1-c347-4b9f-a7a4-5bc9fb5f61b8", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "34.223.69.193", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "71fe4675-3916-440e-8295-3de8b6dfa2bb", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "981ef7af-f1f0-4889-ab94-3a1422393201", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 58, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:26.338105+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Olivia.Williams@splunkresearch.onmicrosoft.com", "signInIdentifier": "Olivia.Williams@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "r_cemPDxiUirlDoUIjkyAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:37.5013103Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.48", "correlationId": "1124cd5b-adf5-49d1-8a70-f0e26de08f29", "identity": "Abigail.Clark", "Level": 4, "location": "US", "properties": {"id": "7b6cef56-270d-4c93-bec9-b387a64e4301", "createdDateTime": "2023-11-06T20:50:37.5590128+00:00", "userDisplayName": "Abigail.Clark", "userPrincipalName": "Abigail.Clark@splunkresearch.onmicrosoft.com", "userId": "7a8995be-8532-42a7-b6e9-a70dc1e88301", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.48", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "1124cd5b-adf5-49d1-8a70-f0e26de08f29", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "7b6cef56-270d-4c93-bec9-b387a64e4301", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 69, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:37.5590128+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Abigail.Clark@splunkresearch.onmicrosoft.com", "signInIdentifier": "Abigail.Clark@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "Vu9sew0nk0y-ybOHpk5DAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:32.7389605Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.124.198", "correlationId": "56f18b4e-a3dc-4b22-8a1d-b88332046e4f", "identity": "Oliver.Taylor", "Level": 4, "location": "US", "properties": {"id": "aeab4064-d0d9-4fc7-8a2b-720eb98e3501", "createdDateTime": "2023-11-06T20:50:30.7615088+00:00", "userDisplayName": "Oliver.Taylor", "userPrincipalName": "Oliver.Taylor@splunkresearch.onmicrosoft.com", "userId": "19836ec3-020b-4c3c-8951-4a44dce7d6a9", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.124.198", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "56f18b4e-a3dc-4b22-8a1d-b88332046e4f", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "aeab4064-d0d9-4fc7-8a2b-720eb98e3501", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 56, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:30.7615088+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Oliver.Taylor@splunkresearch.onmicrosoft.com", "signInIdentifier": "Oliver.Taylor@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "ZECrrtnQx0-KK3IOuY41AQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:12.3554818Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.90.133.25", "correlationId": "3b368197-4117-493f-94f5-17713e9e1ed2", "identity": "Charlotte.Jackson", "Level": 4, "location": "US", "properties": {"id": "001bfc28-dbaa-40c1-8835-bc110df1f400", "createdDateTime": "2023-11-06T20:50:32.3413654+00:00", "userDisplayName": "Charlotte.Jackson", "userPrincipalName": "Charlotte.Jackson@splunkresearch.onmicrosoft.com", "userId": "90aa3998-7603-4a90-91bd-2185ed456afb", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.90.133.25", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "3b368197-4117-493f-94f5-17713e9e1ed2", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "001bfc28-dbaa-40c1-8835-bc110df1f400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 52, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:32.3413654+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Charlotte.Jackson@splunkresearch.onmicrosoft.com", "signInIdentifier": "Charlotte.Jackson@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "KPwbAKrbwUCINbwRDfH0AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:12.3554818Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.127.129", "correlationId": "af64c7f8-b50c-4a88-87c7-59607184d4ef", "identity": "Benjamin.Thomas", "Level": 4, "location": "US", "properties": {"id": "001bfc28-dbaa-40c1-8835-bc11e5f0f400", "createdDateTime": "2023-11-06T20:50:31.8423573+00:00", "userDisplayName": "Benjamin.Thomas", "userPrincipalName": "Benjamin.Thomas@splunkresearch.onmicrosoft.com", "userId": "e3afc101-d532-42eb-b689-d7914ded085a", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.127.129", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "af64c7f8-b50c-4a88-87c7-59607184d4ef", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "001bfc28-dbaa-40c1-8835-bc11e5f0f400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 46, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:31.8423573+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Benjamin.Thomas@splunkresearch.onmicrosoft.com", "signInIdentifier": "Benjamin.Thomas@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "KPwbAKrbwUCINbwR5fD0AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:12.3554818Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "44.233.54.169", "correlationId": "e124fea6-5fe0-4a41-9583-cfa8d57629b5", "identity": "Mia.Anderson", "Level": 4, "location": "US", "properties": {"id": "001bfc28-dbaa-40c1-8835-bc11b5f0f400", "createdDateTime": "2023-11-06T20:50:31.3553573+00:00", "userDisplayName": "Mia.Anderson", "userPrincipalName": "Mia.Anderson@splunkresearch.onmicrosoft.com", "userId": "bf54ec60-f302-4cc3-b1cb-ffc1850d9951", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "44.233.54.169", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "e124fea6-5fe0-4a41-9583-cfa8d57629b5", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "001bfc28-dbaa-40c1-8835-bc11b5f0f400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 165, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:31.3553573+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Mia.Anderson@splunkresearch.onmicrosoft.com", "signInIdentifier": "Mia.Anderson@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "KPwbAKrbwUCINbwRtfD0AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:50:58.5918444Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "44.233.54.28", "correlationId": "848adcb7-0d0e-48aa-85b0-b49d20f4a1ed", "identity": "Donald.Reed", "Level": 4, "location": "US", "properties": {"id": "b9f8aeeb-8e7f-49cf-a6c0-7a26da502101", "createdDateTime": "2023-11-06T20:50:43.972295+00:00", "userDisplayName": "Donald.Reed", "userPrincipalName": "Donald.Reed@splunkresearch.onmicrosoft.com", "userId": "efd025c2-fce0-49d3-9f2d-d5d3a99990c7", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "44.233.54.28", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "848adcb7-0d0e-48aa-85b0-b49d20f4a1ed", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "b9f8aeeb-8e7f-49cf-a6c0-7a26da502101", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 65, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:43.972295+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Donald.Reed@splunkresearch.onmicrosoft.com", "signInIdentifier": "Donald.Reed@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "6674uX-Oz0mmwHom2lAhAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:26.6395265Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "34.223.70.18", "correlationId": "bf3d6536-06b4-4850-9239-08da89a9f2ed", "identity": "Noah.Jones", "Level": 4, "location": "US", "properties": {"id": "e03a254c-12f7-4ee0-9a6e-0f2ff1b66e01", "createdDateTime": "2023-11-06T20:50:27.1375786+00:00", "userDisplayName": "Noah.Jones", "userPrincipalName": "Noah.Jones@splunkresearch.onmicrosoft.com", "userId": "d8d8f231-cf8c-4fa8-b30c-3d1ebe87d468", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "34.223.70.18", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "bf3d6536-06b4-4850-9239-08da89a9f2ed", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "e03a254c-12f7-4ee0-9a6e-0f2ff1b66e01", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 64, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:27.1375786+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Noah.Jones@splunkresearch.onmicrosoft.com", "signInIdentifier": "Noah.Jones@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "TCU64PcS4E6abg8v8bZuAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:51.2924101Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "44.233.54.40", "correlationId": "d78044cd-c432-48f7-bc31-f12fdaa27bf4", "identity": "Sebastian.Lee", "Level": 4, "location": "US", "properties": {"id": "516a3af1-5fc2-4a90-add7-84dd8e941300", "createdDateTime": "2023-11-06T20:50:39.5239484+00:00", "userDisplayName": "Sebastian.Lee", "userPrincipalName": "Sebastian.Lee@splunkresearch.onmicrosoft.com", "userId": "9b7aefaa-e2a0-4d2b-af12-a72def046809", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "44.233.54.40", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "d78044cd-c432-48f7-bc31-f12fdaa27bf4", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "516a3af1-5fc2-4a90-add7-84dd8e941300", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 94, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:39.5239484+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Sebastian.Lee@splunkresearch.onmicrosoft.com", "signInIdentifier": "Sebastian.Lee@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "8TpqUcJfkEqt14TdjpQTAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:33.9433766Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.90.133.240", "correlationId": "83bfc5db-6e8c-4b63-a79c-583e846373fc", "identity": "Lucas.Martin", "Level": 4, "location": "US", "properties": {"id": "0ae7b4c0-10c9-42f9-acc8-237402d27401", "createdDateTime": "2023-11-06T20:50:34.1367503+00:00", "userDisplayName": "Lucas.Martin", "userPrincipalName": "Lucas.Martin@splunkresearch.onmicrosoft.com", "userId": "5c48d91c-0446-4c14-8417-61340252a403", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.90.133.240", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "83bfc5db-6e8c-4b63-a79c-583e846373fc", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "0ae7b4c0-10c9-42f9-acc8-237402d27401", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 66, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:34.1367503+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Lucas.Martin@splunkresearch.onmicrosoft.com", "signInIdentifier": "Lucas.Martin@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "wLTnCskQ-UKsyCN0AtJ0AQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:51:29.2149685Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "44.233.55.40", "correlationId": "919c2957-e10b-4f6c-ba01-243d4c3a8591", "identity": "Paul.Morgan", "Level": 4, "location": "US", "properties": {"id": "173da627-a39d-40fb-a417-6329b6162100", "createdDateTime": "2023-11-06T20:50:43.2709358+00:00", "userDisplayName": "Paul.Morgan", "userPrincipalName": "Paul.Morgan@splunkresearch.onmicrosoft.com", "userId": "2c7ec731-86c9-44b6-9fb5-30d1a4b76972", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "44.233.55.40", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "919c2957-e10b-4f6c-ba01-243d4c3a8591", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "173da627-a39d-40fb-a417-6329b6162100", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 106, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:43.2709358+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Paul.Morgan@splunkresearch.onmicrosoft.com", "signInIdentifier": "Paul.Morgan@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "J6Y9F52j-0CkF2MpthYhAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:50:31.1522353Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.2", "correlationId": "5b9f240f-3aef-4bb9-9ce2-343ee7ffe635", "identity": "James.Wilson", "Level": 4, "location": "US", "properties": {"id": "813c14dd-ba41-4dc8-8ad8-633aabe77a01", "createdDateTime": "2023-11-06T20:50:29.5331112+00:00", "userDisplayName": "James.Wilson", "userPrincipalName": "James.Wilson@splunkresearch.onmicrosoft.com", "userId": "79e8e658-867f-41d6-966e-39fa9ed94609", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.2", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "5b9f240f-3aef-4bb9-9ce2-343ee7ffe635", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "813c14dd-ba41-4dc8-8ad8-633aabe77a01", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 76, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:29.5331112+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "James.Wilson@splunkresearch.onmicrosoft.com", "signInIdentifier": "James.Wilson@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "3RQ8gUG6yE2K2GM6q-d6AQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:53:22.5530125Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.217", "correlationId": "fb5565f9-1f85-444a-80f2-69a6cbbcd81e", "identity": "Sophia.Miller", "Level": 4, "location": "US", "properties": {"id": "6f83d2cd-1be5-4c73-b496-fb111e896600", "createdDateTime": "2023-11-06T20:50:28.9668415+00:00", "userDisplayName": "Sophia.Miller", "userPrincipalName": "Sophia.Miller@splunkresearch.onmicrosoft.com", "userId": "6a0b0b13-d395-4960-b73c-08f3ab76ea66", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.217", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "fb5565f9-1f85-444a-80f2-69a6cbbcd81e", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "6f83d2cd-1be5-4c73-b496-fb111e896600", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 72, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:28.9668415+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Sophia.Miller@splunkresearch.onmicrosoft.com", "signInIdentifier": "Sophia.Miller@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "zdKDb-Ubc0y0lvsRHolmAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:53:17.2788812Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.33", "correlationId": "06adfcd5-e56d-46bc-9a6b-3fc3e55e6d8b", "identity": "Logan.Robinson", "Level": 4, "location": "US", "properties": {"id": "9cb7ea18-2897-4dc3-b1e2-13c092769d00", "createdDateTime": "2023-11-06T20:50:36.8659335+00:00", "userDisplayName": "Logan.Robinson", "userPrincipalName": "Logan.Robinson@splunkresearch.onmicrosoft.com", "userId": "c424913b-b0b8-42fc-b687-5f3a374f0ef2", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.33", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "06adfcd5-e56d-46bc-9a6b-3fc3e55e6d8b", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "9cb7ea18-2897-4dc3-b1e2-13c092769d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 67, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:36.8659335+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Logan.Robinson@splunkresearch.onmicrosoft.com", "signInIdentifier": "Logan.Robinson@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "GOq3nJcow02x4hPAknadAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:53:11.7695310Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "44.233.54.196", "correlationId": "f28df8a2-0acc-42b2-91f3-e59b44844041", "identity": "Amelia.Harris", "Level": 4, "location": "US", "properties": {"id": "da9770e7-6a2d-4651-8633-012ede872801", "createdDateTime": "2023-11-06T20:50:33.5251895+00:00", "userDisplayName": "Amelia.Harris", "userPrincipalName": "Amelia.Harris@splunkresearch.onmicrosoft.com", "userId": "e7105e4f-dcca-4542-afb9-d7a619e9a363", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "44.233.54.196", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "f28df8a2-0acc-42b2-91f3-e59b44844041", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "da9770e7-6a2d-4651-8633-012ede872801", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 67, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:33.5251895+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Amelia.Harris@splunkresearch.onmicrosoft.com", "signInIdentifier": "Amelia.Harris@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "53CX2i1qUUaGMwEu3ocoAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:53:07.6329910Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.90.133.30", "correlationId": "3cfc2357-1747-40ee-b00c-d4738485a3a2", "identity": "Elijah.White", "Level": 4, "location": "US", "properties": {"id": "43885b4f-efcf-4e13-a7b8-1498c9cc7a00", "createdDateTime": "2023-11-06T20:50:32.910536+00:00", "userDisplayName": "Elijah.White", "userPrincipalName": "Elijah.White@splunkresearch.onmicrosoft.com", "userId": "b54d1d22-ce20-4f96-9be7-100733f5542c", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.90.133.30", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.73722839355469, "longitude": -94.81143188476562}}, "mfaDetail": {}, "correlationId": "3cfc2357-1747-40ee-b00c-d4738485a3a2", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "43885b4f-efcf-4e13-a7b8-1498c9cc7a00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 135, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:32.910536+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Elijah.White@splunkresearch.onmicrosoft.com", "signInIdentifier": "Elijah.White@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "T1uIQ8_vE06nuBSYycx6AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:53:02.6604282Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.92.26.38", "correlationId": "7c1467f7-0fad-4415-b921-05849a4be6bd", "identity": "Robert.Turner", "Level": 4, "location": "US", "properties": {"id": "586c75d7-e59b-4ac0-989d-6a2d2d33a500", "createdDateTime": "2023-11-06T20:50:41.4268207+00:00", "userDisplayName": "Robert.Turner", "userPrincipalName": "Robert.Turner@splunkresearch.onmicrosoft.com", "userId": "27e92fed-cd5a-423c-bc75-ae1760f3e5ca", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.92.26.38", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "7c1467f7-0fad-4415-b921-05849a4be6bd", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "586c75d7-e59b-4ac0-989d-6a2d2d33a500", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 63, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:41.4268207+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Robert.Turner@splunkresearch.onmicrosoft.com", "signInIdentifier": "Robert.Turner@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "13VsWJvlwEqYnWotLTOlAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:57.2638581Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "34.223.69.241", "correlationId": "4b7a0189-05d6-4498-bf1b-5ea5b6967eb4", "identity": "Mary.Evans", "Level": 4, "location": "US", "properties": {"id": "0a292c71-afd9-480f-8a69-a02b855d0101", "createdDateTime": "2023-11-06T20:50:40.8892242+00:00", "userDisplayName": "Mary.Evans", "userPrincipalName": "Mary.Evans@splunkresearch.onmicrosoft.com", "userId": "4aa8d932-5741-423d-b113-8ce1b4ec239e", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "34.223.69.241", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "4b7a0189-05d6-4498-bf1b-5ea5b6967eb4", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "0a292c71-afd9-480f-8a69-a02b855d0101", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 96, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:40.8892242+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Mary.Evans@splunkresearch.onmicrosoft.com", "signInIdentifier": "Mary.Evans@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "cSwpCtmvD0iKaaArhV0BAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:46.0156192Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.126.64", "correlationId": "eda76ba9-5cba-446d-8916-edc3b12a56a4", "identity": "Christopher.Collins", "Level": 4, "location": "US", "properties": {"id": "5588e23a-8852-430f-8182-e7e0bc726f00", "createdDateTime": "2023-11-06T20:50:42.5443747+00:00", "userDisplayName": "Christopher.Collins", "userPrincipalName": "Christopher.Collins@splunkresearch.onmicrosoft.com", "userId": "839ea01b-0d6e-4865-977a-fa0f8c6a059c", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.126.64", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.73722839355469, "longitude": -94.81143188476562}}, "mfaDetail": {}, "correlationId": "eda76ba9-5cba-446d-8916-edc3b12a56a4", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "5588e23a-8852-430f-8182-e7e0bc726f00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 129, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:42.5443747+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Christopher.Collins@splunkresearch.onmicrosoft.com", "signInIdentifier": "Christopher.Collins@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "OuKIVVKID0OBgufgvHJvAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:42.7756026Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.127.69", "correlationId": "76614770-9d56-4d66-b1c9-036b7b28c56c", "identity": "Elizabeth.Walker", "Level": 4, "location": "US", "properties": {"id": "a4fbf42f-96f9-47aa-90c2-1bd52ca02d01", "createdDateTime": "2023-11-06T20:50:40.2002409+00:00", "userDisplayName": "Elizabeth.Walker", "userPrincipalName": "Elizabeth.Walker@splunkresearch.onmicrosoft.com", "userId": "c1437ae2-bf45-4bdb-ac55-d8ecf522ee77", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.127.69", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "76614770-9d56-4d66-b1c9-036b7b28c56c", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "a4fbf42f-96f9-47aa-90c2-1bd52ca02d01", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 90, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:40.2002409+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Elizabeth.Walker@splunkresearch.onmicrosoft.com", "signInIdentifier": "Elizabeth.Walker@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "L_T7pPmWqkeQwhvVLKAtAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:33.0010026Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.90.132.190", "correlationId": "5e70d729-9ead-4bed-848f-445999162ffc", "identity": "Ava.Brown", "Level": 4, "location": "US", "properties": {"id": "c0ef5eb8-13c6-44c5-972f-e3d161d97e00", "createdDateTime": "2023-11-06T20:50:27.9154101+00:00", "userDisplayName": "Ava.Brown", "userPrincipalName": "Ava.Brown@splunkresearch.onmicrosoft.com", "userId": "6dac50a1-f179-4b5a-8a7b-bbe57c66d65d", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.90.132.190", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.73722839355469, "longitude": -94.81143188476562}}, "mfaDetail": {}, "correlationId": "5e70d729-9ead-4bed-848f-445999162ffc", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "c0ef5eb8-13c6-44c5-972f-e3d161d97e00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 115, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:27.9154101+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Ava.Brown@splunkresearch.onmicrosoft.com", "signInIdentifier": "Ava.Brown@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "uF7vwMYTxUSXL-PRYdl-AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:24.8728670Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.124.137", "correlationId": "f98b1cc8-ba27-44fd-b58e-a20f3453efe8", "identity": "Emma.Smith", "Level": 4, "location": "US", "properties": {"id": "3e9dd5bd-dbc9-401d-8d6a-67e910407900", "createdDateTime": "2023-11-06T20:50:24.6600772+00:00", "userDisplayName": "Emma.Smith", "userPrincipalName": "Emma.Smith@splunkresearch.onmicrosoft.com", "userId": "6ea4f2c7-f168-468a-a618-043b1d11f777", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.124.137", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.73722839355469, "longitude": -94.81143188476562}}, "mfaDetail": {}, "correlationId": "f98b1cc8-ba27-44fd-b58e-a20f3453efe8", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "3e9dd5bd-dbc9-401d-8d6a-67e910407900", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 126, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:24.6600772+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Emma.Smith@splunkresearch.onmicrosoft.com", "signInIdentifier": "Emma.Smith@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "vdWdPsnbHUCNamfpEEB5AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:23.7077024Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "18.246.176.85", "correlationId": "d6bcc233-3cfc-4f1a-a363-4ddfc87fa73a", "identity": "Harper.Thompson", "Level": 4, "location": "US", "properties": {"id": "3930f5ae-34f4-4272-8c24-d0d8a5b28000", "createdDateTime": "2023-11-06T20:50:34.9802792+00:00", "userDisplayName": "Harper.Thompson", "userPrincipalName": "Harper.Thompson@splunkresearch.onmicrosoft.com", "userId": "b04ac803-1f19-4f6c-a7f9-e29bd896a9cd", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "18.246.176.85", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.73722839355469, "longitude": -94.81143188476562}}, "mfaDetail": {}, "correlationId": "d6bcc233-3cfc-4f1a-a363-4ddfc87fa73a", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "3930f5ae-34f4-4272-8c24-d0d8a5b28000", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 158, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:34.9802792+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Harper.Thompson@splunkresearch.onmicrosoft.com", "signInIdentifier": "Harper.Thompson@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "rvUwOfQ0ckKMJNDYpbKAAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:11.1567605Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "35.93.127.13", "correlationId": "cf86aa91-58a9-4ce7-9edd-c328a5c528b2", "identity": "Liam.Johnson", "Level": 4, "location": "US", "properties": {"id": "7301052b-b465-4729-b3d4-82501f1d5801", "createdDateTime": "2023-11-06T20:50:25.6668007+00:00", "userDisplayName": "Liam.Johnson", "userPrincipalName": "Liam.Johnson@splunkresearch.onmicrosoft.com", "userId": "8e8fde78-8682-49fd-a85d-66ed4d4e4140", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "35.93.127.13", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.83599853515625, "longitude": -94.6989974975586}}, "mfaDetail": {}, "correlationId": "cf86aa91-58a9-4ce7-9edd-c328a5c528b2", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "7301052b-b465-4729-b3d4-82501f1d5801", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 68, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:25.6668007+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Liam.Johnson@splunkresearch.onmicrosoft.com", "signInIdentifier": "Liam.Johnson@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "KwUBc2W0KUez1IJQHx1YAQ", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}
{"time": "2023-11-06T20:52:06.6283588Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "44.233.55.57", "correlationId": "ff39e415-097d-4f91-b6c5-9a1c90a67f5c", "identity": "Evelyn.Martinez", "Level": 4, "location": "US", "properties": {"id": "19bc59eb-22f2-4b36-b61c-fb53e2737e00", "createdDateTime": "2023-11-06T20:50:36.2929468+00:00", "userDisplayName": "Evelyn.Martinez", "userPrincipalName": "Evelyn.Martinez@splunkresearch.onmicrosoft.com", "userId": "fac51da5-4f4e-4f7d-a7ab-e3ba97143bca", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "44.233.55.57", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 70.73722839355469, "longitude": -94.81143188476562}}, "mfaDetail": {}, "correlationId": "ff39e415-097d-4f91-b6c5-9a1c90a67f5c", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "19bc59eb-22f2-4b36-b61c-fb53e2737e00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 257, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-11-06T20:50:36.2929468+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Evelyn.Martinez@splunkresearch.onmicrosoft.com", "signInIdentifier": "Evelyn.Martinez@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "61m8GfIiNku2HPtT4nN-AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}