When do we expect the azure_ad_signin plugin to support the following meta which is a part of the UDM outlined in RSA NetWitness® Suite Unified Data Model Available Concepts
event.cat |
event.cat.name |
ec.activity |
ec.outcome |
ec.subject |
ec.theme |
client (or the appropriate key to grab the app=<value> from the log, where ,value. is SharePoint, Teams or whatever.)
