Ingest authentication logs from external authentication
services—such as Okta and Azure AD—into authentication stories with
Ingesting Authentication Logs and Data requires
a Cortex XDR Pro per TB license.
When you ingest authentication logs and data from
an external source, Cortex XDR can weave that information into authentication
stories. An authentication story unites logs and data regardless
of the information source (for example, from an on-premise KDC or
from a cloud-based authentication service) into a uniform schema.
To search authentication stories, you can use the Query Builder or XQL Search.
Cortex XDR can ingest authentication logs and
data from the following authentication services: