Difference xdr_login_events and authentication_story

[micomi]

Does anyone know the difference between the preset xdr_login_events and authentication_story?

Which datasets are these presets based on?

I can't find any documentation about the preset xdr_login_events

Thanks in advance

[jmazzeo · Accepted solution]

Hi @micomi,

The xdr_login_events preset includes XDR Agent only events as the source. The authentication_story preset can include events from third party authentication sources, like Azure AD, Okta SSO, NGFW authentications, and any other third party integration for authentication purposes.

If this post answers your question, please mark it as the solution.