Support for non-interactive sign-ins

splunk / splunk-add-on-microsoft-azure

Splunk Add-on for Microsoft Azure

Apache License 2.0

11 stars 7 forks source link

Closed cweckel2000 closed 1 year ago

cweckel2000 commented 1 year ago

Please add support to ingest non-interactive sign-ins from AAD.

JasonConger commented 1 year ago

This can be done by selecting the "Beta" endpoint in the input and using the following filter in the input:

$filter=signInEventTypes/any(t: t eq 'nonInteractiveUser')