Stefan Papakostopoulos added a comment - 10/Oct/2024 9:43 PM - edited Hi from CES-53693 I'd like for the logs (I'm talking about audit logs sent to a SIEM via webhook) to contain information on which authentication policy was used (by name and id), and the current settings of the authentication policy (since they can change).  In the json for the audit event "action": "user_login" it would be nice to either add another block or add more information under context. attributes.context.attributes.authFactors shows I had SAML authentication, but what if there is more than one IDP and more than one Authentication policy requiring Single Sign On? Perhaps consider adding something like authenticationPolicy.Name authenticationPolicy.Id authenticationPolicy.SingleSignOnEnforced (true/false) authenticationPolicy.SingleSignOnIDP (IDP Entity ID from the associated SAML configuration) authenticationPolicy.ApiTokens (true/false) authenticationPolicy.IdleSessionDuration etc. and all the fields like Password Requirements and expiration for policies that are not enforcing single sign on. Fields should be null if not set, but present for consistent reporting/visualization.