Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For effective identity threat detection and response (ITDR), collect more than successful sign-ins. A defensible plan brings together authentication and session activity, risk and MFA signals, identity-provider and directory changes, privileged actions, application and workload-identity events, hybrid-directory infrastructure, and relevant SaaS and cloud-control-plane logs. Send those records to a central monitoring destination with enough context to connect events, and retain them before the identity provider’s reporting window expires.
Which identity logs should I collect for ITDR?
Collect identity telemetry in layers. A sign-in feed can show that an account authenticated, but it may not explain whether the activity was expected, what changed in the identity environment, or what the account did afterward. Correlating authentication, administrative changes, workload activity, and cloud actions gives investigators a more complete sequence.
Use this checklist as the baseline. The exact event names depend on your identity provider and environment; the categories below describe the coverage to seek, not a universal log schema.
Recommended Free Tools
| Log category | Collect | Why it matters |
|---|---|---|
| Authentication and session | Interactive and noninteractive sign-ins, successes and failures, plus available actor, target, application, device, IP, location, user-agent, authentication-method, policy, and session details | Helps establish who authenticated, from what context, and with what result |
| Risk and MFA | Risky users and sign-ins, user-risk events, risky service principals, MFA activity, and identity-protection detections | Surfaces suspicious authentication and changes in identity risk |
| Identity administration | Changes to accounts, credentials, authentication methods, applications, roles, policies, domains, federation, and devices | Can reveal takeover, persistence, or privilege changes |
| Workload identities | Service-principal sign-ins and risk, managed-identity sign-ins where applicable, and provisioning activity | Covers identities that operate without a person signing in |
| Hybrid identity infrastructure | Domain Controller security logs, AD FS activity, Entra Connect events and health alerts, and relevant PowerShell and service activity | Provides evidence that may not appear in cloud sign-in records |
| Cloud and SaaS activity | Microsoft 365 Audit logs, Azure Key Vault logs, and other relevant cloud-application and control-plane events | Shows activity after authentication and supports investigation across systems |
What Entra logs should go to the SIEM?
Forward both sign-in and audit data, then add the risk and identity-protection records that help explain suspicious behavior. Microsoft’s security-operations guidance identifies Entra audit and sign-in logs, Microsoft 365 Audit logs, and Azure Key Vault logs as useful investigation sources, and recommends integrating relevant sources with monitoring and SIEM tooling.
Popular on Amazon
- 【90 Degree Full Function USB C Adapter】Supports the latest USB4 standard for up to 40Gbps of bandwidth, 8K video support, and up to 240W Fast charging; Support USB PD 3.1 Extended Power Range (EPR) including 140W, 180W and 240W. Your productivity is easily doubled. *Warm Tip: For the best fit, please make sure the USB-C port is fully exposed; thick or bulky cases may affect compatibility.
- 【Reliable Quality】Made from high-quality, scratch-resistant aluminum alloy, delicate metal frame. get excellent wear resistance and heat dissipation. Non-Slip Design for easier insertion and removal.
- 【Small and portable】Ultra thin size, ultra compact design, a petite physique that matches the minimalist design of your modern laptops. Coming with a slim figure that won't block the port next to the one it's plugged into.
- 【Compatibility】Widely work with most usb c, thunderbolt 4/3 devices. Compatibilit for ROG Ally, Steam Deck, Switch, MacBook Pro, Quest 3 VR headset, Surface Book 2, iPhone 18/17/16/15, Samsung Galaxy S23/S22/S21, Note 20/10, Google Pixel, ChromeBook, etc.
- 【Excellence Customer Support】If you experience any issues or cable failure, simply reach out to our dedicated customer service team. We provide a prompt response within 18 hours, providing you with the necessary technical support to resolve any concerns.
Sign-ins: keep failures as well as successes
Include interactive and noninteractive sign-ins, not just successful interactive logins. Preserve available timestamps, the actor and target resource, application, device, IP address, geography, user agent, authentication method, policy result, and session context. Microsoft’s investigation guidance calls out application, device, location, IP address, user-agent string, and event outcome as useful context when assessing whether the legitimate identity owner performed an authentication.
Failures matter because they can add context to a suspicious sequence, while noninteractive activity can otherwise leave important authentication behavior outside the collection plan. The evidence available varies by event and source, so retain fields when present rather than assuming every record contains every attribute.
Audit and protection events
Collect changes to users, passwords, authentication methods and security information, MFA registration, applications, service principals, certificates and secrets, application consent and ownership, domains, federation settings, devices, role membership, eligible roles, and conditional-access policies. Include destructive actions such as deleting security information, applications, conditional-access policies, or users in bulk.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Also ingest risky-user, risky-sign-in, user-risk, risky-service-principal, MFA-related, and identity-protection signals. These are detection inputs in their own right, not just descriptive fields attached to a login. They can help identify leaked credentials, suspicious authentication, impossible-travel patterns, or a workload identity whose risk state has changed.
Okta session signals
For Okta environments, retain System Log events for entity-risk changes, session-context changes, authentication-policy reevaluation, session-protection failures and actions, Shared Signals Framework events, and Universal Logout. Okta says Identity Threat Protection records System Log events when it detects a change in a user’s session context or an entity’s risk level. These records can contribute context that a sign-in outcome alone does not provide.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Do I need service-principal and managed-identity logs?
Yes. Treat service principals, managed identities, application identities, provisioning identities, and other workload identities as first-class collection targets. A plan that covers only human sign-ins leaves automated identities and their activity underrepresented.
CISA’s baseline calls for collecting ServicePrincipalSignInLogs, RiskyServicePrincipals, and ServicePrincipalRiskEvents. Where they apply in the environment, add ManagedIdentitySignInLogs and ProvisioningLogs. Microsoft’s security-operations guidance also points to workload-identity protection for sign-in behavior and offline indicators of compromise.
Include the corresponding identity changes in your audit coverage: service-principal creation and ownership, application credentials such as certificates and secrets, application consent, and related configuration. An authentication record can show that a workload identity acted; audit and risk events help explain how that identity was configured or why it became suspicious.
Which Active Directory and Entra Connect events matter for identity attacks?
If you use on-premises Active Directory, AD FS, or Microsoft Entra Connect, collect their supporting infrastructure logs alongside cloud identity records. A cloud sign-in feed alone may miss evidence of compromise or explain discrepancies between on-premises and cloud authentication.
Collect the hybrid sources
- Active Directory: Domain Controller security logs, including authentication activity and security-audit events.
- AD FS: Sign-in records and server logs.
- Entra Connect: Server events, Entra Connect Health alerts, and password-synchronization activity.
- Supporting host activity: Service start and stop events, audit-log clearing, and PowerShell execution telemetry.
A joint government advisory highlights unusual authentication, malicious PowerShell, password synchronization, service changes, and authentication discrepancies between Active Directory and Microsoft Entra as possible compromise indicators.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Microsoft hybrid-stack event examples
For the relevant Microsoft hybrid stack, the advisory gives Entra Connect events 611, 650, 651, 656, and 657 as examples related to password synchronization. It also identifies event 1102 for clearing the Security audit log, and PowerShell events 4103 and 4104 for pipeline and script-execution details. These are examples for that stack, not universal event IDs across products or platforms; map your own systems’ equivalent records rather than applying these numbers indiscriminately.
What should I monitor for privilege escalation, suspicious sign-ins, and federation compromise?
Look for related activity across log categories rather than treating any one record as conclusive. For example, sign-in context can help evaluate an authentication, while audit events can show changes to roles, applications, credentials, policies, or federation settings. The goal is to preserve the events and context needed to connect such activity during detection and investigation.
Privilege and policy changes
Collect role membership and eligible-role changes, conditional-access policy changes, and administration events. Include deletions as well as additions or edits: removing a policy or deleting security information can be meaningful identity-plane activity. Retaining the actor, target, timestamp, and related context when available helps distinguish an administrative change from a suspicious sequence.
Application and federation persistence
Monitor application and service-principal creation or changes, ownership, consent, certificates and secrets, domains, and federation settings. These are identity-plane changes that can expose persistence or unauthorized control of authentication and applications. Correlate them with sign-in and cloud activity to see whether a change was followed by use of the affected identity or resource.
Authentication and session anomalies
Use successful and failed sign-ins, risk detections, MFA activity, session context, and policy results together. Preserve the application, device, location, IP, user agent, and event outcome where the source provides them. The available sources identify these as useful investigation details, but do not prescribe universal thresholds; detections should be aligned to the organization’s environment and established behavior.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Also popular on Amazon
- Portable and powerful USB-C HUB: BENFEI USB Type-C HUB, with super-soft and knot-free silicone woven design cable, meets most mobile office needs. Compact, lightweight, stylish, and powerful portable USB C Hub equipped with 1 x HDMI port, 1 x 100W charging, and 3 x USB ports. 18-month warranty, 24-hour response, to ensure you feel at ease when using our product.
- Design centered on comfort and reliability: Thanks to BENFEI's end-to-end in-house cable production capability, in-house PCBA and assembly capability, using the industry's most advanced silicone woven design and process, 20cm cable in length, no knots, super-soft, the HUB is easy to use in all scenarios: laptop, tablet, stand etc. Super-soft, 25000+ life cycles, to meet your daily carrying and office needs.
- 100W Charging: Support up to 90W USB C pass-through charging via Type-C port to keep your laptop powered. 10W is reserved for other interface operations. No data and video function on the Type-C port.
- 4K HDMI Display: The HDMI port supports media display at resolutions up to 4K 30Hz, keeping every incredible moment detailed and ultra vivid. Please note that the C port of the Host device needs to support video output.
- Transfer Files in Seconds: Transfer files and from your laptop at speeds up to 10 Gbps with USB A 3.2 port. Extra 2 USB A 2.0 ports are perfectly for your keyboards and mouse.
How should I centralize identity logs?
Export identity data to a centralized SIEM, Azure Monitor, or an equivalent analytics destination instead of relying solely on the identity provider’s native reports. Centralization makes it possible to correlate authentication and directory changes with Microsoft 365, cloud, endpoint, federation, and key-management activity, and to search across sources during an investigation.
Microsoft recommends establishing a baseline as an early step toward detecting unexpected events and potential attacks. A useful baseline depends on having records with enough context to compare behavior and investigate sequences, not merely a count of sign-ins. Decide which destination will receive each source, how quickly records should become searchable or alertable, and who owns the integrations and response process.
Preserve context and validate the flow
For each source, confirm which fields arrive, whether timestamps and identities can be interpreted consistently, and whether the records can be joined to relevant applications, devices, or resources. Check that the destination receives both the expected event categories and their investigation context; a connector that forwards only a partial event can weaken later analysis.
Review the full path from source to searchable archive: collection, export, ingestion, parsing, alerting or search, and retention. Detection latency and operational fit matter alongside coverage: a source that arrives too late for the intended response, or cannot be searched by the people handling incidents, is less useful in practice.
How long should identity logs be retained?
Plan retention before an incident, because native reporting windows may be shorter than the time needed to discover and investigate an attack. Microsoft’s retention documentation, accessed November 3, 2026, lists seven days for Microsoft Entra Free audit logs and sign-ins, and 30 days for P1/P2 audit logs and sign-ins. Risky sign-ins are retained for seven, 30, or 90 days depending on license.
Also popular on Amazon
- 【Read before You Buy】 Note: This adapter is USB 2.0 version and cannot transmit HDM, VGA, or other video signals. Nevertheless, they are fully capable of charging devices,duplicating files, and can be seamlessly integrated with USB-C earphones, wireless network adapters, and SD card adapters.
- 【Easy to Use and Safe】Thanks to modern manufacturing techniques, we've made these adapters sufficiently compact so that they can remain inserted in your device without noticeable protrusion or inconvenience. This means you don't have to constantly plug and unplug them, reducing the likelihood of wear and misalignment, and making them more convenient to carry around.
- 【Reliable Quality】Engineered for enhanced durability, durable aluminum alloy shell material,get excellent wear resistance and heat dissipation,the male USB C and female USB connectors & the male USB and female USB C connectors are designed to be plugged and unplugged up to 20000 times. Provides data transfer, device charging, memory space expansion, and additional computer peripherals.
- 【Think more for you】Do you need to connect a USB-C-enabled device to an odd device that only has USB-A ports? Then these USB-A male to USB-C female adapters are made for you.Simply insert the adapter into the USB-A port on the device, and you can instantly connect your USB-C device to the device that originally didn't have the correct connection port.
- 【Trusted xiwxi Quality and Service】As a responsible brand seller, you will receive xiwxi's 12-month Quality assurance and lifetime friendly customer service, you're not just buying a product,you're investing in peace of mind with all-round quality and exceptional customer service.
Microsoft Graph activity logs are not retained unless they are archived to storage or integrated with analytics tools. Export and archive the records you need before native windows expire; do not assume that enabling collection will recover older events retroactively. Set retention based on the investigation and compliance needs your organization must meet, and confirm the applicable license and configured destination rather than treating one retention period as universal.
How can I check whether the collection plan is complete?
Review coverage by identity type, event context, connected systems, and retention—not by the number of log sources alone. A practical review asks whether the organization can reconstruct an identity event across the systems it actually uses.
- Coverage: Are human users, privileged accounts, external users, service principals, managed identities, applications, and hybrid directory components represented where applicable?
- Context: Do records retain available application, device, IP, geography, user-agent, policy, risk, and session details?
- Correlation: Can analysts relate identity-provider events to Microsoft 365, cloud, endpoint, directory, federation, and key-management telemetry?
- Timeliness: How quickly do records reach the monitoring destination and become searchable or alertable?
- Retention: Does the design preserve the required data beyond native reporting windows, and is archiving in place before those windows expire?
- Operational fit: Does the architecture work with the existing SIEM or monitoring platform, cloud environment, identity providers, and incident-response process?
Close gaps in order of risk and dependency: ensure the core identity and hybrid sources are collected, validate context and export, then add the cloud and SaaS records needed to explain downstream activity. Revisit the coverage when identity systems or workload usage change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Frequently Asked Questions
What does ITDR mean?
ITDR means identity threat detection and response: the detection and investigation of threats that involve identities, authentication, or identity systems. It focuses on identity-related evidence and complements broader security monitoring rather than replacing it.
Should I send every identity event to the SIEM?
Prioritize the event categories needed to detect and investigate identity compromise, and preserve enough fields to interpret them. The right scope depends on the identities and systems in use, available integrations, monitoring capacity, and retention requirements; a large volume without usable context is not a complete detection plan.
Can I investigate an identity incident using only sign-in logs?
Sign-in records can provide authentication context, but they may not show how the identity was changed, elevated, or used in another service. Audit, risk, application, workload, and relevant cloud records help fill those gaps.
What should I do if a source does not include every recommended field?
Keep the fields the source does provide and document the limitation so analysts know what conclusions the event can support. Where possible, correlate it with another source that supplies missing context, such as device, application, or cloud activity.
