title: Azure AD Audit Logs Elasticsearch ecs mapping
order: 20
backends:
  - es-qs
  - es-rule
fieldmappings:
  category: azure.auditlogs.properties.category
  activityDisplayName: event.action
  loggedByService: azure.auditlogs.properties.logged_by_service
  result: event.outcome
  initiatedBy.user.userPrincipalName: azure.auditlogs.properties.initiated_by.user.userPrincipalName
