Enable inactive human identity logs on Azure in Cortex Cloud Identity Security

Configuration information for enabling inactive human identity logs on Azure.

To enable inactive human identity logs on the Microsoft Azure platform in Cortex Cloud Identity Security, you must first configure diagnostic settings for the SignInLog log types. These log types provide information regarding how long human identities have been signed in.

To configure the SignInLog log types, do the following:

1. Open the Azure console.
2. Navigate to the Diagnostic settings screen.
3. In the Logs area, under Categories, select the following categories that are related to sign-in logs:

   • SigninLogs
   • NonInteractiveUserSigninLogs
   • ServicePrincipalSigninLogs
   • ManagedIdentitySigninLogs
   • ADFSSigninLogs
4. Click Save.

Note

For more information, see Ingest logs from Microsoft Azure Event Hub.