How to express authentication success or failure? #1996

Description of the issue:

The way I think of querying for an authentication success in a log event is event.category: authentication and event.outcome: success or conversely for an authentication failure event.category: authentication and event.outcome: failure. But this usage of event.outcome is in conflict with the ECS definition.

event.outcome simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.

From the perspective of the entity that produced the log (e.g. Windows Active Directory) this was a "success" (there was no failure while denying the authentication). IMO this mean ECS does not have a standard way to represent an authentication attempt that resulted in allowed / denied.

I think most implementations today are using event.outcome contrary to its definition. Should we clarify event.outcome to match how it's being used in practice? Should we add an allowed and denied to the list of allowed event.type values for event.category: authentication (this would be similar to how firewall blocking is represented)? Something else?

Any additional context or examples:

elastic/beats#29581 (comment):

if the firewall is successfully denying traffic, event.outcome should be success. On the flipside, if the rule was intended to deny traffic, but allowed it, event.outcome would then be failure.

https://www.elastic.co/guide/en/security/current/siem-field-reference.html#_authentication_fields:

Elastic Security relies on these fields and values to analyze and display host authentication data:

event.category:authentication
event.outcome:success or event.outcome:failure

Related:

• How to represent Auth Logs in ECS? #230