Idea ID: 2877666

o365 connector categorization for failed authentication

Status: Declined

This should have been a support ticket.

See status update history

The o365 connector categorization for Azure AD failed authentication is currentlycategorized with an outcome of Success whereas it should be Failure.  Failed logins/Brute Force Logins are appearing as successful logins.

My idea would be to categorize event deviceEventClassId/name of UserLoginFailed to have a categoryOutcome of /Failure.