Forum Discussion

aaronjewitt's avatar
aaronjewitt
Copper Contributor
Apr 25, 2024

Graph Activity Logs should include the display names

The Graph Activity logs are great and we are already exporting them to our Elastic SIEM for alerting and threat hunting, but the lack of display names in the logs is frustrating. The Graph activity logs only contain the values by ID such as userID, appID, groupID, etc. When doing an investigation we have to constantly look up the display names. The other Azure logs such as the signin logs contain fields such as the appDisplayName or userDisplayName which make it much easier for humans to understand what is happening.

Resources