What should I record about a cloud login event?¶
For a cloud login event, record the raw details needed to understand the account, authentication route, connection and resulting session.
The dangerous assumption is that a screenshot of the login page or alert will preserve everything important.
What this means in practice¶
Where possible, export the raw record rather than relying only on a screenshot. Screenshots may omit hidden fields, filters and surrounding events.
Link the login to later session and account activity, and record any preservation or containment action taken.
What this may show¶
Also preserve failure codes, correlation IDs, token or request identifiers and the provider’s definition of the event where available.
Use precise language. The record may show accepted authentication for an account, but personal attribution requires corroboration.
What this does not show on its own¶
Do not record the displayed location as though it were precise physical location. Preserve the underlying IP address and explain that geolocation is estimated.
What to do next¶
Record the provider, service, tenant, account ID, display name, event ID, time, time zone, outcome and event type.
Capture the IP address, location estimate, device or browser information, application, authentication method, multi-factor result, session ID and any risk indicators.
Identify how the record was obtained. A user-facing security page, administrator export and provider disclosure may contain different fields.
Check whether the event was a fresh login, single sign-on, token refresh, application access or continuation of an existing session.
Record any filters applied to the provider view or export. A filtered search may exclude unsuccessful events, application logins or older sessions and create a misleadingly complete-looking record.
Key takeaway
Record the complete login event, source and event definition so that the account, connection, authentication route and later session can be reconstructed accurately.