What is a token event in a cloud log?¶
A token event records the issue, refresh, use or revocation of a digital token used to access a cloud service.
Tokens allow sessions, applications and devices to continue access without repeatedly entering the password.
What this means in practice¶
A refresh token may obtain a new access token silently. An application may use a token in the background. A stolen token may be reused by an attacker.
Investigators should identify the token type, account, application, session, issue time, expiry, refresh activity, IP address and device information.
Where suspicious activity continues after a password reset, token events may explain how access survived.
A token issued legitimately can later be misused. The issue event and later use may therefore involve different networks or devices.
Revocation records should be read alongside expiry information. A token may stop working because it expired naturally, was explicitly revoked or depended on a session that was invalidated.
What this does not show on its own¶
The dangerous assumption is that token activity means the user has just logged in again.
Do not expect the full token value to be present in logs. Token identifiers, issue records and related session IDs may be available instead.
What to do next¶
Check whether the token was linked to a browser, mobile application, API client or delegated application.
Compare token records with login events, application consent, session activity and revocation actions.
Preserve correlation IDs and application IDs where available because token and audit logs may sit in separate systems.
Key takeaway
Token events explain how cloud access was issued, continued or revoked, so connect them to the relevant application, session and later activity rather than treating them as fresh logins.