Dense security events can slow an investigation before it starts. When a log contains unfamiliar error codes, identity attributes, device posture, and application context, ask Sam, the AI SOC Analyst, to explain it in plain language.
Try this
Paste the complete event into Sam and ask:
Can you analyze this event and summarize what it means?
Here is the anonymized event used in this example. It remains in its original single-line format so you can see the type of raw telemetry an analyst can give Sam directly.
<ANONYMIZED_SYSLOG_TIMESTAMP> <ANONYMIZED_LOG_SOURCE_IP> {"CreationTime":"<ANONYMIZED_EVENT_TIMESTAMP>","Id":"<ANONYMIZED_EVENT_ID>","Operation":"UserLoginFailed","OrganizationId":"<ANONYMIZED_TENANT_ID>","RecordType":15,"ResultStatus":"Failed","UserKey":"<ANONYMIZED_USER_KEY>","UserType":4,"Version":1,"Workload":"AzureActiveDirectory","ClientIP":"198.51.100.42","ObjectId":"<ANONYMIZED_OBJECT_ID>","UserId":"Not Available","AzureActiveDirectoryEventType":1,"ExtendedProperties":[{"Name":"ResultStatusDetail","Value":"UserError"},{"Name":"UserAgent","Value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<ANONYMIZED_VERSION> Safari/537.36"},{"Name":"RequestType","Value":"SAS:EndAuth"}],"ModifiedProperties":[],"Actor":[{"ID":"<ANONYMIZED_ACTOR_ID>","Type":0}],"ActorContextId":"<ANONYMIZED_TENANT_ID>","ActorIpAddress":"198.51.100.42","InterSystemsId":"<ANONYMIZED_INTERSYSTEMS_ID>","IntraSystemId":"<ANONYMIZED_EVENT_ID>","SupportTicketId":"","Target":[{"ID":"<ANONYMIZED_TARGET_ID>","Type":0}],"TargetContextId":"<ANONYMIZED_TENANT_ID>","ApplicationId":"https://idcs-4ab5bac5436d47fba0ca2c4306e81f0e.identity.oraclecloud.com/fed)","DeviceProperties":[{"Name":"OS","Value":"Windows"},{"Name":"BrowserType","Value":"Chrome"},{"Name":"IsCompliant","Value":"False"},{"Name":"IsCompliantAndManaged","Value":"False"}],"ErrorNumber":"500121","LogonError":"AuthenticationFailedSasError"}What Sam gives the analyst
For this event, Sam organized the raw data into four useful layers:
-
Event summary: A failed cloud identity authentication attempt.
-
Technical context: The relevant workload, federated application, authentication error, request type, operating system, and browser.
-
Risk indicators: An unresolved user identity and an authentication attempt from an unmanaged, non-compliant device.
-
Recommended actions: Validate whether the activity came from a legitimate user, search for related failures from the same source, review device compliance policy, and check for a subsequent successful login.
Sam also outlined plausible explanations, including incorrect credentials, an expired token, an authorization problem, or a configuration issue. It presented these as possibilities rather than treating a single failed login as proof of malicious activity.
Analyst tip
Use Sam’s explanation as the starting point, then validate its interpretation against related identity, network, and device activity. This keeps human judgment at the center of the investigation while reducing the effort required to decode individual fields.
As the execution layer for defined triage and investigation work, Sam helps security teams turn raw telemetry into focused next steps. Within the Securonix Agentic Mesh, that means clearer context, consistent analysis, and more analyst time for decisions that require expertise.
Azure AD Failed Login Event Analysis
Event Summary: This is a failed Azure Active Directory authentication attempt that occurred on September 10, 2026 at 13:15:46 UTC (approximately 1 hour and 20 minutes ago).
Key Details:
• Operation: UserLoginFailed
• Result Status: Failed (Error: AuthenticationFailedSasError, Error Number: 500121)
• Source IP: ***
• User ID: Not Available (User Key: ***)
• Workload: Azure Active Directory
• Application: Oracle Identity Cloud Service Federation (https://idcs-4ab5bac5436d47fba0ca2c4306e81f0e.identity.oraclecloud.com/fed)
Technical Context:
Authentication Failure Type: SAS (Shared Access Signature) EndAuth request failed with a UserError status detail. This indicates the authentication process completed but failed due to user-related issues (incorrect credentials, expired token, or authorization problems).
Device Information:
• Operating System: Windows 10
• Browser: Chrome ****
• Device Compliance: Not Compliant and Not Managed
Security Implications:
Medium Risk Indicators:
• Failed authentication attempt from an unmanaged and non-compliant device
• User identity not fully resolved ("Not Available" in UserId field)
• Federated authentication failure to Oracle IDCS could indicate credential stuffing, misconfiguration, or legitimate user error
Recommended Actions:
• Verify if this is a legitimate user experiencing authentication issues
• Check for additional failed login attempts from IP ***
• Review device compliance policies if this is a known user
• Monitor for successful logins following this failure
Credit to Zubair Chowgale for this tip!