{"time": "2023-06-16T18:13:08.9527529Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "fef14761-5b90-4e43-8933-344ac1f0162a", "identity": "Sebastian.Lee", "Level": 4, "location": "US", "properties": {"id": "4d39ae52-b280-478a-8600-85c499126200", "createdDateTime": "2023-06-16T18:10:11.0181645+00:00", "userDisplayName": "Sebastian.Lee", "userPrincipalName": "sebastian.lee@splunkresearch.com", "userId": "49339148-f830-462d-8935-bec03eff1edf", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "fef14761-5b90-4e43-8933-344ac1f0162a", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "4d39ae52-b280-478a-8600-85c499126200", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 68, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:11.0181645+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Sebastian.Lee@splunkresearch.com", "signInIdentifier": "Sebastian.Lee@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "Uq45TYCyikeGAIXEmRJiAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:13:08.9527529Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "93d9af8b-636a-47a3-818a-7ec741cc71e4", "identity": "Amelia.Harris", "Level": 4, "location": "US", "properties": {"id": "4d39ae52-b280-478a-8600-85c4c1106200", "createdDateTime": "2023-06-16T18:10:01.6347206+00:00", "userDisplayName": "Amelia.Harris", "userPrincipalName": "amelia.harris@splunkresearch.com", "userId": "5ff1a5b5-81fc-4550-bf3f-00bfd1289df4", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "93d9af8b-636a-47a3-818a-7ec741cc71e4", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "4d39ae52-b280-478a-8600-85c4c1106200", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 63, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:01.6347206+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Amelia.Harris@splunkresearch.com", "signInIdentifier": "Amelia.Harris@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "Uq45TYCyikeGAIXEwRBiAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:13:08.0474863Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "c3c61250-9e39-4ed2-ba88-c1210b95c71b", "identity": "Emily.Lewis", "Level": 4, "location": "US", "properties": {"id": "0e8c1a81-669d-4c8d-92ce-79bf09c82500", "createdDateTime": "2023-06-16T18:10:04.5252868+00:00", "userDisplayName": "Emily.Lewis", "userPrincipalName": "emily.lewis@splunkresearch.com", "userId": "58aadc52-8c30-41ca-90fd-61ab44356728", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "c3c61250-9e39-4ed2-ba88-c1210b95c71b", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "0e8c1a81-669d-4c8d-92ce-79bf09c82500", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 37, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:04.5252868+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Emily.Lewis@splunkresearch.com", "signInIdentifier": "Emily.Lewis@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "gRqMDp1mjUySznm_CcglAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:13:08.0474863Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "a21546ff-3bf4-4ffd-88d0-39c2ca01076c", "identity": "Elizabeth.Walker", "Level": 4, "location": "US", "properties": {"id": "0e8c1a81-669d-4c8d-92ce-79bf03c82500", "createdDateTime": "2023-06-16T18:10:04.2658269+00:00", "userDisplayName": "Elizabeth.Walker", "userPrincipalName": "elizabeth.walker@splunkresearch.com", "userId": "aab026e5-7bfc-4fa5-82a2-fce9e9d0ca23", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "a21546ff-3bf4-4ffd-88d0-39c2ca01076c", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "0e8c1a81-669d-4c8d-92ce-79bf03c82500", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 56, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:04.2658269+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Elizabeth.Walker@splunkresearch.com", "signInIdentifier": "Elizabeth.Walker@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "gRqMDp1mjUySznm_A8glAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:59.4866648Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "bf91bac8-3857-47ad-bc91-f7a0e8099ae3", "identity": "Evelyn.Martinez", "Level": 4, "location": "US", "properties": {"id": "6c2f66eb-4602-4cdf-9aa6-47f0644f7f00", "createdDateTime": "2023-06-16T18:10:05.233401+00:00", "userDisplayName": "Evelyn.Martinez", "userPrincipalName": "evelyn.martinez@splunkresearch.com", "userId": "13981ca6-1fd3-4701-9ba7-dc96ad5f273e", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "bf91bac8-3857-47ad-bc91-f7a0e8099ae3", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "6c2f66eb-4602-4cdf-9aa6-47f0644f7f00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 64, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:05.233401+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Evelyn.Martinez@splunkresearch.com", "signInIdentifier": "Evelyn.Martinez@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "62YvbAJG30yapkfwZE9_AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:58.0044761Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "3d620c1e-6791-45bb-8b59-713b1b1f1e6b", "identity": "Christopher.Collins", "Level": 4, "location": "US", "properties": {"id": "071eec23-ccef-42be-aae4-93a550156200", "createdDateTime": "2023-06-16T18:10:03.1766598+00:00", "userDisplayName": "Christopher.Collins", "userPrincipalName": "christopher.collins@splunkresearch.com", "userId": "79a7f219-29bf-460b-9368-6f6e1d89b002", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "3d620c1e-6791-45bb-8b59-713b1b1f1e6b", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "071eec23-ccef-42be-aae4-93a550156200", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 92, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:03.1766598+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Christopher.Collins@splunkresearch.com", "signInIdentifier": "Christopher.Collins@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "I-weB-_MvkKq5JOlUBViAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:53.3846330Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "0bbb3438-0d4d-4b03-8fc3-64c99db9dc0b", "identity": "Ava.Brown", "Level": 4, "location": "US", "properties": {"id": "49eabca3-01b9-4754-a1b0-4fadceef7800", "createdDateTime": "2023-06-16T18:10:02.0571298+00:00", "userDisplayName": "Ava.Brown", "userPrincipalName": "ava.brown@splunkresearch.com", "userId": "e64306e1-7b28-4931-b0d2-11e1d5bea6c6", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "0bbb3438-0d4d-4b03-8fc3-64c99db9dc0b", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "49eabca3-01b9-4754-a1b0-4fadceef7800", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 73, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:02.0571298+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Ava.Brown@splunkresearch.com", "signInIdentifier": "Ava.Brown@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "o7zqSbkBVEehsE-tzu94AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:53.2421443Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "4ca4230e-737c-4df7-b59a-f1c4104292df", "identity": "Sophia.Miller", "Level": 4, "location": "US", "properties": {"id": "485fd299-4f1d-45e1-8837-7a8b62918d00", "createdDateTime": "2023-06-16T18:10:11.3320889+00:00", "userDisplayName": "Sophia.Miller", "userPrincipalName": "sophia.miller@splunkresearch.com", "userId": "aa1f96c2-df36-4330-9e46-6d73aa1ff4d3", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "4ca4230e-737c-4df7-b59a-f1c4104292df", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "485fd299-4f1d-45e1-8837-7a8b62918d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 37, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:11.3320889+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Sophia.Miller@splunkresearch.com", "signInIdentifier": "Sophia.Miller@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "mdJfSB1P4UWIN3qLYpGNAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:53.2421443Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "6bccdf4b-a0b8-4a12-9a25-c1a6a801dc87", "identity": "Noah.Jones", "Level": 4, "location": "US", "properties": {"id": "485fd299-4f1d-45e1-8837-7a8be9908d00", "createdDateTime": "2023-06-16T18:10:09.372994+00:00", "userDisplayName": "Noah.Jones", "userPrincipalName": "noah.jones@splunkresearch.com", "userId": "fcad70d7-e561-4c18-846c-96296c0fcf08", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "6bccdf4b-a0b8-4a12-9a25-c1a6a801dc87", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "485fd299-4f1d-45e1-8837-7a8be9908d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 50, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:09.372994+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Noah.Jones@splunkresearch.com", "signInIdentifier": "Noah.Jones@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "mdJfSB1P4UWIN3qL6ZCNAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:53.2421443Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "948df06c-f794-46dc-a712-84a17e52340b", "identity": "Isabella.Moore", "Level": 4, "location": "US", "properties": {"id": "485fd299-4f1d-45e1-8837-7a8b09908d00", "createdDateTime": "2023-06-16T18:10:05.9006904+00:00", "userDisplayName": "Isabella.Moore", "userPrincipalName": "isabella.moore@splunkresearch.com", "userId": "b7e2717d-3b71-43a5-9656-7e70b0b735d0", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "948df06c-f794-46dc-a712-84a17e52340b", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "485fd299-4f1d-45e1-8837-7a8b09908d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 37, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:05.9006904+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Isabella.Moore@splunkresearch.com", "signInIdentifier": "Isabella.Moore@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "mdJfSB1P4UWIN3qLCZCNAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:53.2421443Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "7958a0d5-378b-4951-aef4-b0fcf596cfe4", "identity": "Charlotte.Jackson", "Level": 4, "location": "US", "properties": {"id": "485fd299-4f1d-45e1-8837-7a8b398f8d00", "createdDateTime": "2023-06-16T18:10:02.7819912+00:00", "userDisplayName": "Charlotte.Jackson", "userPrincipalName": "charlotte.jackson@splunkresearch.com", "userId": "bfa047bc-572f-4f00-b73c-877db0a77983", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "7958a0d5-378b-4951-aef4-b0fcf596cfe4", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "485fd299-4f1d-45e1-8837-7a8b398f8d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 59, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:02.7819912+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Charlotte.Jackson@splunkresearch.com", "signInIdentifier": "Charlotte.Jackson@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "mdJfSB1P4UWIN3qLOY-NAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:33.3719874Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "d4cf7693-6304-44db-ae30-16a2c4591bd9", "identity": "Oliver.Taylor", "Level": 4, "location": "US", "properties": {"id": "cc6787b7-c2ac-44d8-a352-03ae4cf97500", "createdDateTime": "2023-06-16T18:10:09.6651504+00:00", "userDisplayName": "Oliver.Taylor", "userPrincipalName": "oliver.taylor@splunkresearch.com", "userId": "e29dc10d-8e08-4eb8-b7a3-a4ad7f18a4d3", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "d4cf7693-6304-44db-ae30-16a2c4591bd9", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "cc6787b7-c2ac-44d8-a352-03ae4cf97500", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 47, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:09.6651504+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Oliver.Taylor@splunkresearch.com", "signInIdentifier": "Oliver.Taylor@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "t4dnzKzC2ESjUgOuTPl1AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:33.3719874Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "8fdb6e10-bf84-45f5-871f-9db593d3ecb0", "identity": "Abigail.Clark", "Level": 4, "location": "US", "properties": {"id": "cc6787b7-c2ac-44d8-a352-03ae73f77500", "createdDateTime": "2023-06-16T18:10:00.7071072+00:00", "userDisplayName": "Abigail.Clark", "userPrincipalName": "abigail.clark@splunkresearch.com", "userId": "4484a75c-d062-455b-8b60-cdc5c3d3d698", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "8fdb6e10-bf84-45f5-871f-9db593d3ecb0", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "cc6787b7-c2ac-44d8-a352-03ae73f77500", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 82, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:00.7071072+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Abigail.Clark@splunkresearch.com", "signInIdentifier": "Abigail.Clark@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "t4dnzKzC2ESjUgOuc_d1AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:26.4017454Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "bee792ed-83bb-43c9-aba7-72cddad1787f", "identity": "Robert.Turner", "Level": 4, "location": "US", "properties": {"id": "df02ef6b-75c4-41c2-9454-8ec562926700", "createdDateTime": "2023-06-16T18:10:10.6371273+00:00", "userDisplayName": "Robert.Turner", "userPrincipalName": "robert.turner@splunkresearch.com", "userId": "447c96ef-43fb-4cb3-b536-359daba968a0", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "bee792ed-83bb-43c9-aba7-72cddad1787f", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "df02ef6b-75c4-41c2-9454-8ec562926700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 62, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:10.6371273+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Robert.Turner@splunkresearch.com", "signInIdentifier": "Robert.Turner@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "a-8C38R1wkGUVI7FYpJnAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:26.4017454Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "14561759-0d5b-4b27-92f8-b663b728f8e3", "identity": "Mason.Garcia", "Level": 4, "location": "US", "properties": {"id": "df02ef6b-75c4-41c2-9454-8ec513926700", "createdDateTime": "2023-06-16T18:10:08.6801195+00:00", "userDisplayName": "Mason.Garcia", "userPrincipalName": "mason.garcia@splunkresearch.com", "userId": "a8e4dea3-a033-424c-aec0-c9993f236779", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "14561759-0d5b-4b27-92f8-b663b728f8e3", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "df02ef6b-75c4-41c2-9454-8ec513926700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 57, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:08.6801195+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Mason.Garcia@splunkresearch.com", "signInIdentifier": "Mason.Garcia@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "a-8C38R1wkGUVI7FE5JnAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:26.3861137Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "f0c2bfe7-45d5-404c-8e2c-119754206a85", "identity": "Alexander.Rodriguez", "Level": 4, "location": "US", "properties": {"id": "df02ef6b-75c4-41c2-9454-8ec5c7906700", "createdDateTime": "2023-06-16T18:10:01.264713+00:00", "userDisplayName": "Alexander.Rodriguez", "userPrincipalName": "alexander.rodriguez@splunkresearch.com", "userId": "77ef52d8-c2e9-41a5-b49d-221ca8b232a9", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "f0c2bfe7-45d5-404c-8e2c-119754206a85", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "df02ef6b-75c4-41c2-9454-8ec5c7906700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 103, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:01.264713+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Alexander.Rodriguez@splunkresearch.com", "signInIdentifier": "Alexander.Rodriguez@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "a-8C38R1wkGUVI7Fx5BnAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:18.5561349Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "a73d2191-7660-436e-8e05-5ca72651018e", "identity": "William.Davis", "Level": 4, "location": "US", "properties": {"id": "295f788f-cd0c-41d4-ab7a-e7c006808400", "createdDateTime": "2023-06-16T18:10:11.6802684+00:00", "userDisplayName": "William.Davis", "userPrincipalName": "william.davis@splunkresearch.com", "userId": "54fe6cdc-1404-4a8d-9369-341942e9b43f", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "a73d2191-7660-436e-8e05-5ca72651018e", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "295f788f-cd0c-41d4-ab7a-e7c006808400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 57, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:11.6802684+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "William.Davis@splunkresearch.com", "signInIdentifier": "William.Davis@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "j3hfKQzN1EGreufABoCEAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:18.5561349Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "ba731bf2-288d-4c24-949a-87d789e26e6a", "identity": "Mia.Anderson", "Level": 4, "location": "US", "properties": {"id": "295f788f-cd0c-41d4-ab7a-e7c0437f8400", "createdDateTime": "2023-06-16T18:10:09.0382898+00:00", "userDisplayName": "Mia.Anderson", "userPrincipalName": "mia.anderson@splunkresearch.com", "userId": "9591d7c5-3d1c-499b-baaa-8b38932d75e3", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "ba731bf2-288d-4c24-949a-87d789e26e6a", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "295f788f-cd0c-41d4-ab7a-e7c0437f8400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 55, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:09.0382898+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Mia.Anderson@splunkresearch.com", "signInIdentifier": "Mia.Anderson@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "j3hfKQzN1EGreufAQ3-EAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:12:18.5561349Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "a2f8c179-a55e-42df-824b-9af601665f39", "identity": "James.Wilson", "Level": 4, "location": "US", "properties": {"id": "295f788f-cd0c-41d4-ab7a-e7c0747e8400", "createdDateTime": "2023-06-16T18:10:06.2553179+00:00", "userDisplayName": "James.Wilson", "userPrincipalName": "james.wilson@splunkresearch.com", "userId": "caebb7d0-f81f-4769-b0d6-2eff819f7457", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "a2f8c179-a55e-42df-824b-9af601665f39", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "295f788f-cd0c-41d4-ab7a-e7c0747e8400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 58, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:06.2553179+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "James.Wilson@splunkresearch.com", "signInIdentifier": "James.Wilson@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "j3hfKQzN1EGreufAdH6EAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:57.9510983Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "abae6387-8dd3-4a4a-bee6-4ef26ad78d5a", "identity": "Liam.Johnson", "Level": 4, "location": "US", "properties": {"id": "5a5e2c76-48d9-448c-a6b3-6fe38bf26d00", "createdDateTime": "2023-06-16T18:10:06.9875041+00:00", "userDisplayName": "Liam.Johnson", "userPrincipalName": "liam.johnson@splunkresearch.com", "userId": "01b781a1-9fb0-4a15-b638-9f8329324608", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "abae6387-8dd3-4a4a-bee6-4ef26ad78d5a", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "5a5e2c76-48d9-448c-a6b3-6fe38bf26d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 60, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:06.9875041+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Liam.Johnson@splunkresearch.com", "signInIdentifier": "Liam.Johnson@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "dixeWtlIjESms2_ji_JtAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:57.9510983Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "2d030767-3b2c-49e3-b9f1-6f15f53bb514", "identity": "Emma.Smith", "Level": 4, "location": "US", "properties": {"id": "5a5e2c76-48d9-448c-a6b3-6fe359f26d00", "createdDateTime": "2023-06-16T18:10:04.9154795+00:00", "userDisplayName": "Emma.Smith", "userPrincipalName": "emma.smith@splunkresearch.com", "userId": "c7a8989d-69f4-4de7-9089-64b9399151c5", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "2d030767-3b2c-49e3-b9f1-6f15f53bb514", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "5a5e2c76-48d9-448c-a6b3-6fe359f26d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 92, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:04.9154795+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Emma.Smith@splunkresearch.com", "signInIdentifier": "Emma.Smith@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "dixeWtlIjESms2_jWfJtAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:54.2689959Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "21fcfee5-434f-4c7d-8f08-b23f766f8e3e", "identity": "Donald.Reed", "Level": 4, "location": "US", "properties": {"id": "3a1bcb21-56fe-4d2d-b758-ccb789707b00", "createdDateTime": "2023-06-16T18:10:03.5588285+00:00", "userDisplayName": "Donald.Reed", "userPrincipalName": "donald.reed@splunkresearch.com", "userId": "b4948b39-54a4-4de9-9fe8-8092ec4d18b3", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "21fcfee5-434f-4c7d-8f08-b23f766f8e3e", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "3a1bcb21-56fe-4d2d-b758-ccb789707b00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 76, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:03.5588285+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Donald.Reed@splunkresearch.com", "signInIdentifier": "Donald.Reed@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "IcsbOv5WLU23WMy3iXB7AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:49.9585790Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "4ae937b4-ebaa-4e6e-9731-1267369d8d99", "identity": "Lucas.Martin", "Level": 4, "location": "US", "properties": {"id": "03fc15fb-4871-4c01-a352-10c6a1fa7700", "createdDateTime": "2023-06-16T18:10:07.9373642+00:00", "userDisplayName": "Lucas.Martin", "userPrincipalName": "lucas.martin@splunkresearch.com", "userId": "7c1491f7-1d79-4e1e-a554-5bdd1f7573fc", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "4ae937b4-ebaa-4e6e-9731-1267369d8d99", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "03fc15fb-4871-4c01-a352-10c6a1fa7700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 153, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:07.9373642+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Lucas.Martin@splunkresearch.com", "signInIdentifier": "Lucas.Martin@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-xX8A3FIAUyjUhDGofp3AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:49.9585790Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "973fae2d-f12e-4c61-848f-203ce057bdcb", "identity": "Harper.Thompson", "Level": 4, "location": "US", "properties": {"id": "03fc15fb-4871-4c01-a352-10c67cfa7700", "createdDateTime": "2023-06-16T18:10:05.6053947+00:00", "userDisplayName": "Harper.Thompson", "userPrincipalName": "harper.thompson@splunkresearch.com", "userId": "f0f1a10f-5928-430e-85ca-db3779304bfa", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "973fae2d-f12e-4c61-848f-203ce057bdcb", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "03fc15fb-4871-4c01-a352-10c67cfa7700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 76, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:05.6053947+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Harper.Thompson@splunkresearch.com", "signInIdentifier": "Harper.Thompson@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-xX8A3FIAUyjUhDGfPp3AA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:46.6054095Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "f1397d86-1d03-4582-adab-b24ba3dd14a1", "identity": "Logan.Robinson", "Level": 4, "location": "US", "properties": {"id": "1ff01c48-ed6d-44ab-9451-1fcd08c98500", "createdDateTime": "2023-06-16T18:10:07.4837441+00:00", "userDisplayName": "Logan.Robinson", "userPrincipalName": "logan.robinson@splunkresearch.com", "userId": "311e44e7-2fe0-490b-b45c-6cda478d1278", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "f1397d86-1d03-4582-adab-b24ba3dd14a1", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "1ff01c48-ed6d-44ab-9451-1fcd08c98500", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 93, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:07.4837441+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Logan.Robinson@splunkresearch.com", "signInIdentifier": "Logan.Robinson@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "SBzwH23tq0SUUR_NCMmFAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:37.6416659Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "5e188c1c-0e51-4cb1-8add-503790773c3e", "identity": "Elijah.White", "Level": 4, "location": "US", "properties": {"id": "ca13150b-a00f-4710-83ca-d92a359d2100", "createdDateTime": "2023-06-16T18:10:03.9285109+00:00", "userDisplayName": "Elijah.White", "userPrincipalName": "elijah.white@splunkresearch.com", "userId": "e134e13c-2f6e-4100-880a-398d9b9364ba", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "5e188c1c-0e51-4cb1-8add-503790773c3e", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "ca13150b-a00f-4710-83ca-d92a359d2100", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 62, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:03.9285109+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Elijah.White@splunkresearch.com", "signInIdentifier": "Elijah.White@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "CxUTyg-gEEeDytkqNZ0hAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:37.6416659Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "8a98eb20-2f36-4731-912e-a79efc3bc628", "identity": "Benjamin.Thomas", "Level": 4, "location": "US", "properties": {"id": "ca13150b-a00f-4710-83ca-d92ae39c2100", "createdDateTime": "2023-06-16T18:10:02.4454947+00:00", "userDisplayName": "Benjamin.Thomas", "userPrincipalName": "benjamin.thomas@splunkresearch.com", "userId": "5dcd1aa6-40b1-4d24-99de-606887c7359c", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "8a98eb20-2f36-4731-912e-a79efc3bc628", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "ca13150b-a00f-4710-83ca-d92ae39c2100", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 90, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:02.4454947+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Benjamin.Thomas@splunkresearch.com", "signInIdentifier": "Benjamin.Thomas@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "CxUTyg-gEEeDytkq45whAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:35.3484819Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "09bb4b53-06dd-446d-af00-49f1214c9e57", "identity": "Paul.Morgan", "Level": 4, "location": "US", "properties": {"id": "236d89c8-5954-43c1-ba97-df1d01f70400", "createdDateTime": "2023-06-16T18:10:10.2853383+00:00", "userDisplayName": "Paul.Morgan", "userPrincipalName": "paul.morgan@splunkresearch.com", "userId": "1e6bbfbf-fbfa-4b38-89e4-0221a3c18a77", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "09bb4b53-06dd-446d-af00-49f1214c9e57", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "236d89c8-5954-43c1-ba97-df1d01f70400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 40, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:10.2853383+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Paul.Morgan@splunkresearch.com", "signInIdentifier": "Paul.Morgan@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "yIltI1RZwUO6l98dAfcEAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:35.3484819Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "b74e1713-286a-4fdf-bcf5-4c7976a538b9", "identity": "Olivia.Williams", "Level": 4, "location": "US", "properties": {"id": "236d89c8-5954-43c1-ba97-df1df8f60400", "createdDateTime": "2023-06-16T18:10:09.9722423+00:00", "userDisplayName": "Olivia.Williams", "userPrincipalName": "olivia.williams@splunkresearch.com", "userId": "a9c6aa27-1105-4cbc-971e-c133cf4210d5", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "b74e1713-286a-4fdf-bcf5-4c7976a538b9", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "236d89c8-5954-43c1-ba97-df1df8f60400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 43, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:09.9722423+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Olivia.Williams@splunkresearch.com", "signInIdentifier": "Olivia.Williams@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "yIltI1RZwUO6l98d-PYEAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:35.3684819Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "b74e1713-286a-4fdf-bcf5-4c7976a538b9", "identity": "Olivia.Toro", "Level": 4, "location": "US", "properties": {"id": "236d89c8-5954-43c1-ba97-df1df8f60400", "createdDateTime": "2023-06-16T18:10:09.9722423+00:00", "userDisplayName": "Olivia.Toro", "userPrincipalName": "olivia.toro@splunkresearch.com", "userId": "a9c6aa27-1105-4cbc-971e-c133cf4210d5", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "b74e1713-286a-4fdf-bcf5-4c7976a538b9", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "236d89c8-5954-43c1-ba97-df1df8f60400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 43, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:09.9722423+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Olivia.Toro@splunkresearch.com", "signInIdentifier": "Olivia.Toro@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "yIltI1RZwUO6l98d-PYEAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}
{"time": "2023-06-16T18:11:35.3884819Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultType": "50126", "resultSignature": "None", "resultDescription": "Invalid username or password or Invalid on-premise username or password.", "durationMs": 0, "callerIpAddress": "82.1.1.35", "correlationId": "b74e1713-286a-4fdf-bcf5-4c7976a538b9", "identity": "Olivia.Jenkins", "Level": 4, "location": "US", "properties": {"id": "236d89c8-5954-43c1-ba97-df1df8f60400", "createdDateTime": "2023-06-16T18:10:09.9722423+00:00", "userDisplayName": "Olivia.Jenkins", "userPrincipalName": "olivia.jenkins@splunkresearch.com", "userId": "a9c6aa27-1105-4cbc-971e-c133cf4210d5", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "82.1.1.35", "status": {"errorCode": 50126, "failureReason": "Invalid username or password or Invalid on-premise username or password."}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.963", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows 10"}, "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 30.76034164428711, "longitude": -73.99822235107422}}, "correlationId": "b74e1713-286a-4fdf-bcf5-4c7976a538b9", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "236d89c8-5954-43c1-ba97-df1df8f60400", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 43, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "authenticationDetails": [{"authenticationStepDateTime": "2023-06-16T18:10:09.9722423+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": false, "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}], "authenticationRequirementPolicies": [], "sessionLifetimePolicies": [], "authenticationRequirement": "singleFactorAuthentication", "alternateSignInName": "Olivia.Jenkins@splunkresearch.com", "signInIdentifier": "Olivia.Jenkins@splunkresearch.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "yIltI1RZwUO6l98d-PYEAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "4d6bd7de-c9bc-45cc-b8ec-ae315f66bf77", "rngcStatus": 0, "managedIdentityType": "none"}}