{"id": "52d72a62-132b-487b-bb7f-c4c119f90700", "createdDateTime": "2023-12-04T20:42:05Z", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "appId": "00000002-0000-0ff1-ce00-000000000000", "appDisplayName": "Office 365 Exchange Online", "ipAddress": "54.68.231.63", "clientAppUsed": "Browser", "correlationId": "6463a6ad-27ec-b311-dc52-ecdde38d9492", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "status": {"errorCode": 0, "failureReason": "Other.", "additionalDetails": null}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "Windows10", "browser": "Firefox 120.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 70.836, "longitude": -94.699}}, "appliedConditionalAccessPolicies": []}
{"id": "e9945c6b-dbec-4a57-9a72-0f0bdaf50200", "createdDateTime": "2023-12-04T20:41:59Z", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "54.68.231.63", "clientAppUsed": "Browser", "correlationId": "3c35a98a-977e-4f2a-9ff0-444a5af89948", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "status": {"errorCode": 0, "failureReason": "Other.", "additionalDetails": null}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "Windows10", "browser": "Firefox 120.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 70.836, "longitude": -94.699}}, "appliedConditionalAccessPolicies": []}
{"CreationTime": "2023-12-04T20:42:32", "Id": "467b93e0-ce87-441f-8d18-18d2c2cbf604", "Operation": "MailItemsAccessed", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 50, "ResultStatus": "Succeeded", "UserKey": "100320030DF47B14", "UserType": 0, "Version": 1, "Workload": "Exchange", "UserId": "user15@splunkresearch.onmicrosoft.com", "AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientIPAddress": "54.68.231.63", "ClientInfoString": "Client=OWA;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0;", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxOwnerUPN": "user15@splunkresearch.onmicrosoft.com", "OperationProperties": [{"Name": "MailAccessType", "Value": "Bind"}, {"Name": "IsThrottled", "Value": "False"}], "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "DM4PR18MB5525 (15.20.4200.000)\r\n", "SessionId": "15e27956-79a0-45b2-9d02-60f48349f692", "Folders": [{"FolderItems": [{"InternetMessageId": "<CH0PR18MB5530046ABCDDC79A7415E3EBF1AFA@CH0PR18MB5530.namprd18.prod.outlook.com>", "SizeInBytes": 11080}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEJAAAB", "Path": "\\Sent Items"}], "OperationCount": 1}
{"id": "501ce148-c954-4914-b4cc-c5a691e21300", "createdDateTime": "2023-12-04T20:37:31Z", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "52.88.103.113", "clientAppUsed": "Browser", "correlationId": "fe0d9e97-bd6c-416e-b39f-2a61859ff779", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "status": {"errorCode": 0, "failureReason": "Other.", "additionalDetails": null}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "MacOs", "browser": "Firefox 118.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 70.836, "longitude": -94.699}}, "appliedConditionalAccessPolicies": []}
{"id": "1d336abe-9554-4570-a4f0-93758ef42c00", "createdDateTime": "2023-12-04T20:37:28Z", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "52.88.103.113", "clientAppUsed": "Browser", "correlationId": "fe0d9e97-bd6c-416e-b39f-2a61859ff779", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "status": {"errorCode": 50140, "failureReason": "This occurred due to 'Keep me signed in' interrupt when the user was signing in.", "additionalDetails": "This is an expected part of the login flow, where a user is asked if they want to remain signed into this browser to make further logins easier. For more details, see https://techcommunity.microsoft.com/t5/Azure-Active-Directory/The-new-Azure-AD-sign-in-and-Keep-me-signed-in-experiences/td-p/128267"}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "MacOs", "browser": "Firefox 118.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 70.836, "longitude": -94.699}}, "appliedConditionalAccessPolicies": []}
{"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b-bb7f-c4c119f90700", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "54.68.231.63", "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, {"Name": "RequestType", "Value": "OAuth2:Authorize"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "54.68.231.63", "InterSystemsId": "6463a6ad-27ec-b311-dc52-ecdde38d9492", "IntraSystemId": "52d72a62-132b-487b-bb7f-c4c119f90700", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}
{"CreationTime": "2023-12-04T20:41:59", "Id": "e9945c6b-dbec-4a57-9a72-0f0bdaf50200", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "54.68.231.63", "ObjectId": "4765445b-32c6-49b0-83e6-1d93765276ca", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, {"Name": "RequestType", "Value": "Login:reprocess"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "54.68.231.63", "InterSystemsId": "3c35a98a-977e-4f2a-9ff0-444a5af89948", "IntraSystemId": "e9945c6b-dbec-4a57-9a72-0f0bdaf50200", "SupportTicketId": "", "Target": [{"ID": "4765445b-32c6-49b0-83e6-1d93765276ca", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "4765445b-32c6-49b0-83e6-1d93765276ca", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}
{"CreationTime": "2023-12-04T20:37:31", "Id": "501ce148-c954-4914-b4cc-c5a691e21300", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "52.88.103.113", "ObjectId": "4765445b-32c6-49b0-83e6-1d93765276ca", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/118.0"}, {"Name": "RequestType", "Value": "Kmsi:kmsi"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "52.88.103.113", "InterSystemsId": "fe0d9e97-bd6c-416e-b39f-2a61859ff779", "IntraSystemId": "501ce148-c954-4914-b4cc-c5a691e21300", "SupportTicketId": "", "Target": [{"ID": "4765445b-32c6-49b0-83e6-1d93765276ca", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "4765445b-32c6-49b0-83e6-1d93765276ca", "DeviceProperties": [{"Name": "OS", "Value": "MacOs"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}
{"CreationTime": "2023-12-04T20:37:28", "Id": "1d336abe-9554-4570-a4f0-93758ef42c00", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "52.88.103.113", "ObjectId": "4765445b-32c6-49b0-83e6-1d93765276ca", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "KeepMeSignedIn", "Value": "true"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/118.0"}, {"Name": "UserAuthenticationMethod", "Value": "1"}, {"Name": "RequestType", "Value": "Login:login"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "52.88.103.113", "InterSystemsId": "fe0d9e97-bd6c-416e-b39f-2a61859ff779", "IntraSystemId": "1d336abe-9554-4570-a4f0-93758ef42c00", "SupportTicketId": "", "Target": [{"ID": "4765445b-32c6-49b0-83e6-1d93765276ca", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "4765445b-32c6-49b0-83e6-1d93765276ca", "DeviceProperties": [{"Name": "OS", "Value": "MacOs"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "50140"}