Share via

Clarification on Azure Active Directory login event from Office 365

Venkatesh 36 Reputation points
2020-08-18T08:26:29.11+00:00

Hi,

Following is one of the audit events pertaining to 'logon successful' in Office 365 environment which is authenticated by Azure AD. Just trying to understand what does "Login:reprocess" in the RequestType mean here ? What kind of login has the user performed in this case ? It will be helpful if somebody can throw some light. I am a Cyber security engineer and it is important for me to understand the events so i can do the threat hunting.

{"CreationTime":"2020-08-12T06:14:31","Id":"#REMOVED","Operation":"UserLoggedIn","OrganizationId":"#REMOVED","RecordType":15,"ResultStatus":"Succeeded","UserKey":"#REMOVED","UserType":0,"Version":1,"Workload":"AzureActiveDirectory","ClientIP":"#REMOVED","ObjectId":"Unknown","UserId":"#REMOVED","AzureActiveDirectoryEventType":1,"ExtendedProperties":[{"Name":"UserAgent","Value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"},{"Name":"UserAuthenticationMethod","Value":"5"},{"Name":"RequestType","Value":"Login:reprocess"},{"Name":"ResultStatusDetail","Value":"Redirect"},{"Name":"KeepMeSignedIn","Value":"False"}],"ModifiedProperties":[],"Actor":[{"ID":"#REMOVED","Type":0},{"ID":"#REMOVED","Type":5},{"ID":"#REMOVED","Type":3}],"ActorContextId":"#REMOVED","ActorIpAddress":"#REMOVED","InterSystemsId":"#REMOVED","IntraSystemId":"#REMOVED","SupportTicketId":"","Target":[{"ID":"Unknown","Type":0}],"TargetContextId":"#REMOVED","ApplicationId":"#REMOVED"}

Note: I have replaced some of the sensitive content in the event with "#REMOVED"

Microsoft Security | Microsoft Entra | Microsoft Entra ID

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Venkatesh 36 Reputation points
    2020-09-02T12:23:26.537+00:00

    Hi @JamesTran-MSFT I am seeing this on SIEM platform that integrates with Office 365 using graph API and polls for Office 365 audit events.

  2. MANDEEP KUMAR 0 Reputation points
    2024-04-23T17:06:03.4366667+00:00

    Hi @Everyone,

    I have analyzed a similar log from SIEM's o365 log source and looked into the parameter in question. Based on my research, the parameter "Login:reprocess" signifies that the user's session has expired. When the user attempts to access the application or service again, they are prompted to reauthenticate.

    I would recommend checking for any associated logs and correlating them with the incident to gain further insights.

    Security Analyst,
    https://www.linkedin.com/in/mandeepkumarbanihall/

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.