Forum Discussion
Should I ingest AADNonInteractiveUserSignInLogs from Entra ID to a LAW
As the title says, I am interested in expert opinions on whether I should include the AADNonInteractiveUserSignInLogs from Entra ID in a LAW, as this table dwarfs the SignInLogs in terms of the amoun...
You should ingest this table if :
- You are actively using Microsoft Sentinel or another SIEM for threat hunting.
- You want visibility into non-interactive sign-ins , especially for service principals and managed identities ( common in lateral movement attacks or credential misuse).
- You need a complete audit trail of all authentication activity, including background and token-based auth.
- You're analyzing service-to-service communications, automation activity, or script-based operations in your tenant