title: Azure AD Signin Audit Logs Elasticsearch ecs mapping
order: 20
backends:
  - es-qs
  - es-rule
fieldmappings: 
  category: azure.signinlogs.category
  identity: azure.signinlogs.identity
  resultSignature: azure.signinlogs.result_signature
  riskDetail: azure.signinlogs.properties.risk_detail
  riskLevelAggregated: azure.signinlogs.properties.risk_level_aggregated
  riskLevelDuringSignIn: azure.signinlogs.properties.risk_level_during_signin
  riskstate: azure.signinlogs.properties.risk_state
  conditionalAccessStatus: azure.signinlogs.properties.conditional_access_status
  resultType: azure.signinlogs.properties.status.error_code
  ipAddress: azure.signinlogs.properties.ip_address
  callerIpAddress: azure.signinlogs.properties.ip_address
  properties.deviceDetail.deviceId: azure.signinlogs.properties.device_detail.device_id
  properties.deviceDetail.operatingSystem: azure.signinlogs.properties.device_detail.operating_system
  properties.deviceDetail.browser: azure.signinlogs.properties.device_detail.browser
  properties.clientAppUsed: azure.signinlogs.properties.client_app_used
