Authentication data available in zeek logs

Zeek
1

I am not aware of Zeek having an authoritative list of all authentication data so from your experience which Zeek logs would provide useful event data when authenticating to each of the following:

  1. web applications

  2. API’s

  3. SSO

  4. SSH

  5. Windows authentication

  6. FTP

Kind regards,

tim