ADFS - UPN and External IP address
We are looking to watch who utilizes ADFS externally. this means gathering the UPN and External IP address.
So far I have gathered that I may need Event 501 and possibly 299. has anyone already tackled this beast?
If you have can you give me a leg up?
Re: ADFS - UPN and External IP address
Curious if you ever sorted this out. We're looking at doing the same (with a slightly larger list of of ADFS Auditing events).
Key value mapping in the security.csv file would work sorta... But i'm looking for a more full flushed out parsing tho.