Identity Threat Detection Dataset – Azure AD User Risk Events – enUS

This synthetically generated dataset contains detailed Azure Active Directory (AAD) user risk event logs enriched with contextual and threat intelligence fields, designed for analyzing and detecting identity-based threats. It captures a broad range of security-relevant signals such as sign-ins, MFA challenges, password resets, account creations, and token refreshes, along with associated risk events, detection methods, and remediation states. Each record includes: - User context – Tenant ID, user identifiers, display name, principal name, and token issuer type - Activity details – Operation type, detection timing (real-time, near-real-time, offline), activity timestamps, and correlation IDs - Threat intelligence metadata – Risk level, risk state, risk detail, MITRE ATT&CK techniques, detection sources, and event types - Network and location data – IP addresses, anonymization flags, geolocation (city, state, country, coordinates), device type, and network type - Additional forensic context – User agent strings, alert URLs, and links to cloud security portals The dataset covers both benign and suspicious user activities, including scenarios like credential compromise, unusual travel, suspicious login patterns, and anonymized IP usage. Supports use cases such as identity threat detection, behavioral analytics, SOC automation, ITDR enrichment, and threat intelligence correlation. Helps solve problems like identifying compromised accounts, detecting high-risk sign-in patterns, investigating anomalous authentication flows, and tuning security controls based on contextual risk. Because it is synthetically generated to closely mirror real-world patterns while containing no sensitive data, it is highly valuable for customers training AI/ML models for risk scoring, anomaly detection, and automated incident triage—without the compliance and privacy risks of production user logs.