[ { "Name": "AlertInfo", "TableSource": "defender", "Description": "Alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Cloud App Security, and Microsoft Defender for Identity, including severity information and threat categorization", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "AlertId", "Description": "Unique identifier for the alert", "Type": "String", "Entity": "Alert" }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ServiceSource", "Description": "Product or service that provided the alert information", "Type": "String", "Entity": null }, { "Name": "DetectionSource", "Description": "Detection technology or sensor that identified the notable component or activity", "Type": "String", "Entity": null }, { "Name": "AttackTechniques", "Description": "MITRE ATT&CK techniques associated with the activity that triggered the alert", "Type": "String", "Entity": null }, { "Name": "SentinelWorkspaceIds", "Description": "The unique identifiers of the Microsoft Sentinel workspace this alert is associated with", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "AlertsAndObservations", "TableSectionName": null }, { "Name": "AlertEvidence", "TableSource": "defender", "Description": "Files, IP addresses, URLs, users, or devices associated with alerts", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "AlertId", "Description": "Unique identifier for the alert", "Type": "String", "Entity": "Alert" }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "List of categories that the information belongs to, in JSON array format", "Type": "String", "Entity": null }, { "Name": "AttackTechniques", "Description": "MITRE ATT&CK techniques associated with the activity that triggered the alert", "Type": "String", "Entity": null }, { "Name": "ServiceSource", "Description": "Product or service that provided the alert information", "Type": "String", "Entity": null }, { "Name": "DetectionSource", "Description": "Detection technology or sensor that identified the notable component or activity", "Type": "String", "Entity": null }, { "Name": "EntityType", "Description": "Type of object, such as a file, a process, a device, or a user", "Type": "String", "Entity": null }, { "Name": "EvidenceRole", "Description": "How the entity is involved in an alert, indicating whether it is impacted or is merely related", "Type": "String", "Entity": null }, { "Name": "EvidenceDirection", "Description": "Indicates whether the entity is the source or the destination of a network connection", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "ThreatFamily", "Description": "Malware family that the suspicious or malicious file or process has been classified under", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": "Ip" }, { "Name": "RemoteUrl", "Description": "URL or fully qualified domain name (FQDN) that was being connected to", "Type": "String", "Entity": "Url" }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "LocalIP", "Description": "IP address assigned to the local machine used during communication", "Type": "String", "Entity": "Ip" }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "EmailSubject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "Int32", "Entity": null }, { "Name": "OAuthApplicationId", "Description": "Unique identifier of the third-party OAuth application", "Type": "String", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "RegistryKey", "Description": "Registry key that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueName", "Description": "Name of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueData", "Description": "Data of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "CloudResource", "Description": "Cloud resource name", "Type": "String", "Entity": null }, { "Name": "CloudPlatform", "Description": "The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform", "Type": "String", "Entity": null }, { "Name": "ResourceType", "Description": "Type of cloud resource", "Type": "String", "Entity": null }, { "Name": "ResourceID", "Description": "Unique identifier of the cloud resource accessed", "Type": "String", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier of the cloud service subscription", "Type": "String", "Entity": null }, { "Name": "SentinelWorkspaceIds", "Description": "The unique identifiers of the Microsoft Sentinel workspace this alert is associated with", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "AlertsAndObservations", "TableSectionName": null }, { "Name": "IdentityInfo", "TableSource": "defender", "Description": "Account information from various sources, including Microsoft Entra ID", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "IdentityId", "Description": "Unique identifier for the identity", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "OnPremSid", "Description": "On-premises security identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "OnPremObjectId", "Description": "The ad Object Id of the User", "Type": "String", "Entity": null }, { "Name": "AccountDisplayName", "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "CriticalityLevel", "Description": "The criticality score of each account", "Type": "Int32", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "DistinguishedName", "Description": "On premises distinguished name of the account user", "Type": "String", "Entity": null }, { "Name": "CloudSid", "Description": "Cloud security identifier of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "GivenName", "Description": "Given name or first name of the account user", "Type": "String", "Entity": null }, { "Name": "Surname", "Description": "Surname, family name, or last name of the account user", "Type": "String", "Entity": null }, { "Name": "Department", "Description": "Name of the department that the account user belongs to", "Type": "String", "Entity": null }, { "Name": "JobTitle", "Description": "Job title of the account user", "Type": "String", "Entity": null }, { "Name": "EmailAddress", "Description": "SMTP address of the account", "Type": "String", "Entity": null }, { "Name": "SipProxyAddress", "Description": "Voice of over IP (VOIP) session initiation protocol (SIP) address of the account", "Type": "String", "Entity": null }, { "Name": "Address", "Description": "Address of the account user", "Type": "String", "Entity": null }, { "Name": "City", "Description": "City where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "Country", "Description": "Country/Region where the account user is located", "Type": "String", "Entity": null }, { "Name": "IsAccountEnabled", "Description": "Indicates whether the account is enabled or not", "Type": "Boolean", "Entity": null }, { "Name": "Manager", "Description": "Manager of the account user", "Type": "String", "Entity": null }, { "Name": "Phone", "Description": "Phone number of the account user", "Type": "String", "Entity": null }, { "Name": "CreatedDateTime", "Description": "Date and time when the account user was created", "Type": "DateTime", "Entity": null }, { "Name": "SourceProvider", "Description": "The primary Identity provider of the account user", "Type": "String", "Entity": null }, { "Name": "ChangeSource", "Description": "The last source system to modify the account user", "Type": "String", "Entity": null }, { "Name": "BlastRadius", "Description": "A calculation based on the position of the user in the org tree and the user's Microsoft Entra roles and permissions. Possible values: Low, Medium, High", "Type": "String", "Entity": null }, { "Name": "CompanyName", "Description": "The name for the company in which the user works", "Type": "String", "Entity": null }, { "Name": "DeletedDateTime", "Description": "The date and time the user was deleted", "Type": "DateTime", "Entity": null }, { "Name": "EmployeeId", "Description": "The employee identifier assigned to the user by the organization", "Type": "String", "Entity": null }, { "Name": "OtherMailAddresses", "Description": "Additional email addresses of the user", "Type": "Object", "Entity": null }, { "Name": "RiskLevel", "Description": "The AAD risk level (Low/Medium/High) of the user account", "Type": "String", "Entity": null }, { "Name": "RiskLevelDetails", "Description": "Details regarding the AAD risk level", "Type": "String", "Entity": null }, { "Name": "State", "Description": "State where the sign-in occurred, if available", "Type": "String", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "Object", "Entity": null }, { "Name": "UserAccountControl", "Description": "Security attributes of the user account in the AD domain.", "Type": "Object", "Entity": null }, { "Name": "SourceProviders", "Description": "Source providers of the accounts for the identity; possible values: ActiveDirectory, EntraID, Okta", "Type": "Object", "Entity": null }, { "Name": "IdentityEnvironment", "Description": "Environment where the identity is used; possible values: CloudOnly, Hybrid, On-premises", "Type": "String", "Entity": null }, { "Name": "PrivilegedEntraPimRoles", "Description": "A snapshot of privileged role assignment schedules and eligibility schedules for the account as maintained by Microsoft Entra Privileged Identity Management (excluding activated assignments)", "Type": "Object", "Entity": null }, { "Name": "RiskScore", "Description": "The risk score of the identity as calculated by Microsoft Defender", "Type": "Int32", "Entity": null }, { "Name": "RiskScoreUpdateTime", "Description": "Date and time Microsoft Defender last updated the risk score of the identity", "Type": "DateTime", "Entity": null }, { "Name": "AssignedRoles", "Description": "Active roles assigned to the account", "Type": "Object", "Entity": null }, { "Name": "GroupMembership", "Description": "Account's group membership description", "Type": "Object", "Entity": null }, { "Name": "RiskStatus", "Description": "State of the user's risk. The possible values are none, confirmedSafe, remediated, atRisk, unknownFutureValue.", "Type": "String", "Entity": null }, { "Name": "TenantMembershipType", "Description": "The Entra Id user type. The possible values are: guest and member", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "IdentityAccountInfo", "TableSource": "defender", "Description": "Account information from various sources, including Microsoft Entra ID. This table also includes information and link to the identity that owns the account.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "SourceProviderAccountId", "Description": "Unique identifier for the source provider of the account", "Type": "String", "Entity": null }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "IdentityId", "Description": "Unique identifier for the identity", "Type": "String", "Entity": null }, { "Name": "IsPrimary", "Description": "Indicates if this account is considered as primary account for the linked identity", "Type": "Boolean", "Entity": null }, { "Name": "IdentityLinkType", "Description": "Type of linkage between the identity and account", "Type": "String", "Entity": null }, { "Name": "IdentityLinkReason", "Description": "Reason for the linkage between the identity and account", "Type": "String", "Entity": null }, { "Name": "IdentityLinkTime", "Description": "Date and time when the identity was linked to the account", "Type": "DateTime", "Entity": null }, { "Name": "IdentityLinkBy", "Description": "Identifier of the entity that linked the identity to the account", "Type": "String", "Entity": null }, { "Name": "DisplayName", "Description": "Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "EmailAddress", "Description": "SMTP address of the account", "Type": "String", "Entity": null }, { "Name": "CriticalityLevel", "Description": "The criticality score of each account", "Type": "Int32", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "GivenName", "Description": "Given name or first name of the account user", "Type": "String", "Entity": null }, { "Name": "Surname", "Description": "Surname, family name, or last name of the account user", "Type": "String", "Entity": null }, { "Name": "EmployeeId", "Description": "The employee identifier assigned to the user by the organization", "Type": "String", "Entity": null }, { "Name": "Department", "Description": "Name of the department that the account user belongs to", "Type": "String", "Entity": null }, { "Name": "JobTitle", "Description": "Job title of the account user", "Type": "String", "Entity": null }, { "Name": "Address", "Description": "Address of the account user", "Type": "String", "Entity": null }, { "Name": "City", "Description": "City where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "Country", "Description": "Country/Region where the account user is located", "Type": "String", "Entity": null }, { "Name": "Phone", "Description": "Phone number of the account user", "Type": "String", "Entity": null }, { "Name": "Manager", "Description": "Manager of the account user", "Type": "String", "Entity": null }, { "Name": "Sid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": null }, { "Name": "AccountStatus", "Description": "Current status of the account", "Type": "String", "Entity": null }, { "Name": "SourceProvider", "Description": "The primary Identity provider of the account user", "Type": "String", "Entity": null }, { "Name": "SourceProviderInstanceId", "Description": "Unique identifier for the instance of the source provider", "Type": "String", "Entity": null }, { "Name": "SourceProviderInstanceDisplayName", "Description": "Display name of the source provider instance", "Type": "String", "Entity": null }, { "Name": "AuthenticationMethod", "Description": "Authentication method used by the account", "Type": "String", "Entity": null }, { "Name": "AuthenticationSourceAccountId", "Description": "Account identifier in the authentication source system", "Type": "String", "Entity": null }, { "Name": "EnrolledMfas", "Description": "Multi-factor authentication methods enrolled for the account", "Type": "Object", "Entity": null }, { "Name": "LastPasswordChangeTime", "Description": "Date and time when the account password was last changed", "Type": "DateTime", "Entity": null }, { "Name": "GroupMembership", "Description": "Account's group membership description", "Type": "Object", "Entity": null }, { "Name": "AssignedRoles", "Description": "Active roles assigned to the account", "Type": "Object", "Entity": null }, { "Name": "EligibleRoles", "Description": "Roles that the account is eligible to activate", "Type": "Object", "Entity": null }, { "Name": "TenantMembershipType", "Description": "The Entra Id user type. The possible values are: guest and member", "Type": "String", "Entity": null }, { "Name": "CreatedDateTime", "Description": "Date and time when the account user was created", "Type": "DateTime", "Entity": null }, { "Name": "DeletedDateTime", "Description": "The date and time the user was deleted", "Type": "DateTime", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "Object", "Entity": null }, { "Name": "SourceProviderRiskLevel", "Description": "Risk level of the account as it appears in the source provider; possible values: Low, Medium, High", "Type": "String", "Entity": null }, { "Name": "SourceProviderRiskLevelDetails", "Description": "Details regarding the risk level as they appear in the source provider", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "IdentityLogonEvents", "TableSource": "defender", "Description": "Authentication events recorded by Active Directory and other Microsoft online services", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "LogonType", "Description": "Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "FailureReason", "Description": "Information explaining why the recorded action failed", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountDisplayName", "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceType", "Description": "Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer", "Type": "String", "Entity": null }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": "Ip" }, { "Name": "Port", "Description": "TCP port used during communication", "Type": "Int32", "Entity": null }, { "Name": "DestinationDeviceName", "Description": "Name of the device running the server application that processed the recorded action", "Type": "String", "Entity": "Machine" }, { "Name": "DestinationIPAddress", "Description": "IP address of the device running the server application that processed the recorded action", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "Int32", "Entity": null }, { "Name": "TargetDeviceName", "Description": "Fully qualified domain name (FQDN) of the device that the recorded action was applied to", "Type": "String", "Entity": "Machine" }, { "Name": "TargetAccountDisplayName", "Description": "Display name of the account that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ISP", "Description": "Internet service provider associated with the IP address", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "UncommonForUser", "Description": "List of features observed to be statistically uncommon for the user that performed the activity", "Type": "Object", "Entity": null }, { "Name": "LastSeenForUser", "Description": "Number of days since each statistical feature for the user was last seen", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "IdentityQueryEvents", "TableSource": "defender", "Description": "Query activities performed against Active Directory objects, such as users, groups, devices, and domains", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "QueryType", "Description": "Type of the query", "Type": "String", "Entity": null }, { "Name": "QueryTarget", "Description": "User, group, domain, or any other entity being queried", "Type": "String", "Entity": null }, { "Name": "Query", "Description": "String used to run the query", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountDisplayName", "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": "Ip" }, { "Name": "Port", "Description": "TCP port used during communication", "Type": "Int32", "Entity": null }, { "Name": "DestinationDeviceName", "Description": "Name of the device running the server application that processed the recorded action", "Type": "String", "Entity": "Machine" }, { "Name": "DestinationIPAddress", "Description": "IP address of the device running the server application that processed the recorded action", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "Int32", "Entity": null }, { "Name": "TargetDeviceName", "Description": "Fully qualified domain name (FQDN) of the device that the recorded action was applied to", "Type": "String", "Entity": "Machine" }, { "Name": "TargetAccountUpn", "Description": "User principal name (UPN) of the account that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "TargetAccountDisplayName", "Description": "Display name of the account that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "IdentityDirectoryEvents", "TableSource": "defender", "Description": "Events involving a domain controller or a directory service, such as Active Directory (AD) or Microsoft Entra ID", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "TargetAccountUpn", "Description": "User principal name (UPN) of the account that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "TargetAccountDisplayName", "Description": "Display name of the account that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "TargetDeviceName", "Description": "Fully qualified domain name (FQDN) of the device that the recorded action was applied to", "Type": "String", "Entity": "Machine" }, { "Name": "DestinationDeviceName", "Description": "Name of the device running the server application that processed the recorded action", "Type": "String", "Entity": "Machine" }, { "Name": "DestinationIPAddress", "Description": "IP address of the device running the server application that processed the recorded action", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "Int32", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountDisplayName", "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": "Ip" }, { "Name": "Port", "Description": "TCP port used during communication", "Type": "Int32", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ISP", "Description": "Internet service provider associated with the IP address", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "IdentityEvents", "TableSource": "defender", "Description": "Events collected from identity services such as IDP, PIM, PAM and others", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AccountId", "Description": "Unique identifier for the account in the source application", "Type": "String", "Entity": null }, { "Name": "AccountType", "Description": "Type of user account, indicating its general role like User, SystemPrincipal", "Type": "String", "Entity": null }, { "Name": "AccountDisplayName", "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "Alternate Id, email or name for the account in the source application", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event in the raw format received from the source application", "Type": "String", "Entity": null }, { "Name": "ActionResult", "Description": "Result of the action", "Type": "String", "Entity": null }, { "Name": "ActionFailureReason", "Description": "Information explaining why the recorded action failed", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP address assigned to the device and used during related network communications", "Type": "String", "Entity": "Ip" }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "TargetObjects", "Description": "List of the target objects of this activity. Target object can be user, group, role, domain, application and more.", "Type": "Object", "Entity": null }, { "Name": "Application", "Description": "The source application where this event was received from", "Type": "String", "Entity": null }, { "Name": "ApplicationInstanceId", "Description": "Domain of the source application", "Type": "String", "Entity": null }, { "Name": "ApplicationEventId", "Description": "Raw event ID provided by the source application", "Type": "String", "Entity": null }, { "Name": "ApplicationSessionId", "Description": "Raw session ID provided by the source application", "Type": "String", "Entity": null }, { "Name": "RawEventData", "Description": "Full raw event information from the source application or service in JSON format", "Type": "Object", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "CloudAppEvents", "TableSource": "defender", "Description": "Events involving accounts and objects in Office 365 and other cloud apps and services", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "Int32", "Entity": null }, { "Name": "AppInstanceId", "Description": "Unique identifier for the instance of an application", "Type": "Int32", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "AccountDisplayName", "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Type": "String", "Entity": null }, { "Name": "IsAdminOperation", "Description": "Indicates whether the activity was performed by an administrator", "Type": "Boolean", "Entity": null }, { "Name": "DeviceType", "Description": "Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer", "Type": "String", "Entity": null }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": "Ip" }, { "Name": "IsAnonymousProxy", "Description": "Indicates whether the IP address belongs to a known anonymous proxy", "Type": "Boolean", "Entity": null }, { "Name": "CountryCode", "Description": "Two-letter code indicating the country where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "City", "Description": "City where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "ISP", "Description": "Internet service provider associated with the IP address", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "ActivityType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "ActivityObjects", "Description": "List of objects, such as files or folders, that were involved in the recorded activity", "Type": "Object", "Entity": null }, { "Name": "ObjectName", "Description": "Name of the object that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "ObjectType", "Description": "The type of object, such as a file or a folder, that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AccountType", "Description": "Type of user account, indicating its general role and access levels, such as Regular, System, Admin, Application", "Type": "String", "Entity": null }, { "Name": "IsExternalUser", "Description": "Indicates whether a user inside the network does not belong to the organization’s domain", "Type": "Boolean", "Entity": null }, { "Name": "IsImpersonated", "Description": "Indicates whether the activity was performed by one user on behalf of another (impersonated) user", "Type": "Boolean", "Entity": null }, { "Name": "IPTags", "Description": "Customer-defined information applied to specific IP addresses and IP address ranges", "Type": "Object", "Entity": null }, { "Name": "IPCategory", "Description": "Additional information about the IP address", "Type": "String", "Entity": null }, { "Name": "UserAgentTags", "Description": "More information provided by Microsoft Cloud App Security in a tag in the user agent field. Can have any of the following values: Native client, Outdated browser, Outdated operating system, Robot", "Type": "Object", "Entity": null }, { "Name": "RawEventData", "Description": "Full raw event information from the source application or service in JSON format", "Type": "Object", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "SessionData", "Description": "Session identifiers (if provided by the audit source)", "Type": "Object", "Entity": null }, { "Name": "AuditSource", "Description": "Cloud enviorment source of the cloud audit event. Cloud be Azure, AWS, GCP, AliCloud or other", "Type": "String", "Entity": null }, { "Name": "OAuthAppId", "Description": "A unique identifier that's assigned to an application when it’s registered to Entra with OAuth 2.0.", "Type": "String", "Entity": null }, { "Name": "UncommonForUser", "Description": "List of features observed to be statistically uncommon for the user that performed the activity", "Type": "Object", "Entity": null }, { "Name": "LastSeenForUser", "Description": "Number of days since each statistical feature for the user was last seen", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "EmailEvents", "TableSource": "defender", "Description": "Office 365 email events, including email delivery and blocking events", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "InternetMessageId", "Description": "Public-facing identifier for the email that is set by the sending email system", "Type": "String", "Entity": null }, { "Name": "SenderMailFromAddress", "Description": "Sender email address in the MAIL FROM header, also known as the envelope sender or the Return-Path address", "Type": "String", "Entity": null }, { "Name": "SenderFromAddress", "Description": "Sender email address in the FROM header, which is visible to email recipients on their email clients", "Type": "String", "Entity": null }, { "Name": "SenderDisplayName", "Description": "Name of the sender displayed in the address book, typically a combination of a given or first name, a middle initial, and a last name or surname", "Type": "String", "Entity": null }, { "Name": "SenderObjectId", "Description": "Unique identifier for the sender’s account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "SenderMailFromDomain", "Description": "Sender domain in the MAIL FROM header, also known as the envelope sender or the Return-Path address", "Type": "String", "Entity": null }, { "Name": "SenderFromDomain", "Description": "Sender domain in the FROM header, which is visible to email recipients on their email clients", "Type": "String", "Entity": null }, { "Name": "SenderIPv4", "Description": "IPv4 address of the last detected mail server that relayed the message", "Type": "String", "Entity": null }, { "Name": "SenderIPv6", "Description": "IPv6 address of the last detected mail server that relayed the message", "Type": "String", "Entity": null }, { "Name": "RecipientEmailAddress", "Description": "Email address of the recipient, or email address of the recipient after distribution list expansion", "Type": "String", "Entity": null }, { "Name": "RecipientObjectId", "Description": "Unique identifier for the email recipient in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "Subject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "EmailClusterId", "Description": "Identifier for the group of similar emails clustered based on heuristic analysis of their contents", "Type": "Int64", "Entity": null }, { "Name": "EmailDirection", "Description": "Direction of the email relative to your network: Inbound, Outbound, Intra-org", "Type": "String", "Entity": null }, { "Name": "DeliveryAction", "Description": "Delivery action of the email: Delivered, Junked, Blocked, or Replaced", "Type": "String", "Entity": null }, { "Name": "DeliveryLocation", "Description": "Location where the email was delivered: Inbox/Folder, On-premises/External, Junk, Quarantine, Failed, Dropped, Deleted items", "Type": "String", "Entity": null }, { "Name": "ThreatTypes", "Description": "Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "ThreatNames", "Description": "Detection name for malware or other threats found", "Type": "String", "Entity": null }, { "Name": "DetectionMethods", "Description": "Methods used to detect malware, phishing, or other threats found in the email", "Type": "String", "Entity": null }, { "Name": "ConfidenceLevel", "Description": "List of confidence levels of any spam or phishing verdicts. For spam, this column shows the spam confidence level (SCL), indicating if the email was skipped (-1), found to be not spam (0,1), found to be spam with moderate confidence (5,6), or found to be spam with high confidence (9). For phishing, this column displays whether the confidence level is \"High\" or \"Low\".", "Type": "String", "Entity": null }, { "Name": "BulkComplaintLevel", "Description": "Threshold assigned to email from bulk mailers, a high bulk complain level (BCL) means the email is more likely to generate complaints, and thus more likely to be spam", "Type": "Int32", "Entity": null }, { "Name": "EmailAction", "Description": "Final action taken on the email based on filter verdict, policies, and user actions: Move message to junk mail folder, Add X-header, Modify subject, Redirect message, Delete message, send to quarantine, No action taken, Bcc message", "Type": "String", "Entity": null }, { "Name": "EmailActionPolicy", "Description": "Action policy that took effect: Antispam high-confidence, Antispam, Antispam bulk mail, Antispam phishing, Anti-phishing domain impersonation, Anti-phishing user impersonation, Anti-phishing spoof, Anti-phishing graph impersonation, Antimalware Safe Attachments, Enterprise Transport Rules (ETR)", "Type": "String", "Entity": null }, { "Name": "EmailActionPolicyGuid", "Description": "Unique identifier for the policy that determined the final mail action", "Type": "String", "Entity": null }, { "Name": "AuthenticationDetails", "Description": "List of pass or fail verdicts by email authentication protocols like DMARC, DKIM, SPF or a combination of multiple authentication types (CompAuth)", "Type": "String", "Entity": null }, { "Name": "AttachmentCount", "Description": "Number of attachments in the email", "Type": "Int32", "Entity": null }, { "Name": "UrlCount", "Description": "Number of embedded URLs in the email", "Type": "Int32", "Entity": null }, { "Name": "EmailLanguage", "Description": "Detected language of the email content", "Type": "String", "Entity": null }, { "Name": "Connectors", "Description": "Custom instructions that define organizational mail flow and how the email was routed", "Type": "String", "Entity": null }, { "Name": "OrgLevelAction", "Description": "Action taken on the email in response to matches to a policy defined at the organizational level", "Type": "String", "Entity": null }, { "Name": "OrgLevelPolicy", "Description": "Organizational policy that triggered the action taken on the email", "Type": "String", "Entity": null }, { "Name": "UserLevelAction", "Description": "Action taken on the email in response to matches to a mailbox policy defined by the recipient", "Type": "String", "Entity": null }, { "Name": "UserLevelPolicy", "Description": "End user mailbox policy that triggered the action taken on the email", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "ExchangeTransportRule", "Description": "Mail flow rules (also known as transport rules) are similar to Inbox rules that are available in Outlook and Outlook on the web. The main difference is mail flow rules take action on messages while they're in transit.", "Type": "String", "Entity": null }, { "Name": "DistributionList", "Description": "Name of distribution list that the recipient was a member of and to which the email was sent, if applicable; shows top-level distribution list if nested lists are involved", "Type": "String", "Entity": null }, { "Name": "ForwardingInformation", "Description": "A JSON array of forwarding details including the forwarding user and the forwarding type", "Type": "String", "Entity": null }, { "Name": "Context", "Description": "Configuration context data of the machine", "Type": "String", "Entity": null }, { "Name": "To", "Description": "Indicates the addresses which are listed in To fields of an email", "Type": "Object", "Entity": null }, { "Name": "Cc", "Description": "Indicates the addresses which are listed in Cc fields of an email", "Type": "Object", "Entity": null }, { "Name": "ThreatClassification", "Description": "Indicates the threat classification of the mail", "Type": "String", "Entity": null }, { "Name": "RecipientDomain", "Description": "Domain of the recipient of the email.", "Type": "String", "Entity": null }, { "Name": "EmailSize", "Description": "Size of the email message.", "Type": "Int64", "Entity": null }, { "Name": "IsFirstContact", "Description": "Is this the first contact between sender and reciever.", "Type": "Boolean", "Entity": null }, { "Name": "LatestDeliveryLocation", "Description": "Last known location of the email.", "Type": "String", "Entity": null }, { "Name": "LatestDeliveryAction", "Description": "Last known action attempted on an email by the service or by an admin through manual remediation. ", "Type": "String", "Entity": null }, { "Name": "OriginalThreatTypes", "Description": "Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats at the time of delivery", "Type": "String", "Entity": null }, { "Name": "OriginalDetectionMethods", "Description": "Methods used to detect malware, phishing, or other threats found in the email at the time of delivery", "Type": "String", "Entity": null }, { "Name": "OriginalConfidenceLevel", "Description": "List of confidence levels of any spam or phishing verdicts at the time of delivery", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "EmailAttachmentInfo", "TableSource": "defender", "Description": "Information about files attached to Office 365 emails", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "SenderFromAddress", "Description": "Sender email address in the FROM header, which is visible to email recipients on their email clients", "Type": "String", "Entity": null }, { "Name": "SenderDisplayName", "Description": "Name of the sender displayed in the address book, typically a combination of a given or first name, a middle initial, and a last name or surname", "Type": "String", "Entity": null }, { "Name": "SenderObjectId", "Description": "Unique identifier for the sender’s account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "RecipientEmailAddress", "Description": "Email address of the recipient, or email address of the recipient after distribution list expansion", "Type": "String", "Entity": null }, { "Name": "RecipientObjectId", "Description": "Unique identifier for the email recipient in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FileType", "Description": "File extension type", "Type": "String", "Entity": null }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "ThreatTypes", "Description": "Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "ThreatNames", "Description": "Detection name for malware or other threats found", "Type": "String", "Entity": null }, { "Name": "DetectionMethods", "Description": "Methods used to detect malware, phishing, or other threats found in the email", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "FileExtension", "Description": "File extension of the attachment.", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "EmailUrlInfo", "TableSource": "defender", "Description": "Information about URLs on Office 365 emails", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "Url", "Description": "Full Url from email", "Type": "String", "Entity": "Url" }, { "Name": "UrlDomain", "Description": "Domain name or host name of the URL", "Type": "String", "Entity": null }, { "Name": "UrlLocation", "Description": "Indicates which part of the email the URL is located", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "UrlChainId", "Description": "Unique identifier for the root url", "Type": "String", "Entity": null }, { "Name": "UrlChainPosition", "Description": "Position of a url in a nested url list", "Type": "Int32", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "EmailPostDeliveryEvents", "TableSource": "defender", "Description": "Security events that occur post-delivery, after Office 365 has delivered an email message to the recipient mailbox", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "InternetMessageId", "Description": "Public-facing identifier for the email that is set by the sending email system", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "ActionTrigger", "Description": "Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery", "Type": "String", "Entity": null }, { "Name": "ActionResult", "Description": "Result of the action", "Type": "String", "Entity": null }, { "Name": "RecipientEmailAddress", "Description": "Email address of the recipient, or email address of the recipient after distribution list expansion", "Type": "String", "Entity": null }, { "Name": "DeliveryLocation", "Description": "Location where the email was delivered: Inbox/Folder, On-premises/External, Junk, Quarantine, Failed, Dropped, Deleted items", "Type": "String", "Entity": null }, { "Name": "ThreatTypes", "Description": "Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "DetectionMethods", "Description": "Methods used to detect malware, phishing, or other threats found in the email", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "SenderFromAddress", "Description": "Sender email address in the FROM header, which is visible to email recipients on their email clients", "Type": "String", "Entity": null }, { "Name": "EmailDirection", "Description": "Direction of the email relative to your network: Inbound, Outbound, Intra-org", "Type": "String", "Entity": null }, { "Name": "SourceLocation", "Description": "Location where the email triggered zero-hour auto purge (ZAP)", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "MessageEvents", "TableSource": "defender", "Description": "Contans details of the messages at the time of delivery", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "LastEditedTime", "Description": "Date and time when the message was last edited", "Type": "DateTime", "Entity": null }, { "Name": "TeamsMessageId", "Description": "Unique identifier for the message generated by Office 365", "Type": "String", "Entity": null }, { "Name": "SenderEmailAddress", "Description": "Email address of the sender", "Type": "String", "Entity": null }, { "Name": "SenderDisplayName", "Description": "Name of the sender displayed in the address book, typically a combination of a first name, a middle initial, and a last name or surname", "Type": "String", "Entity": null }, { "Name": "SenderObjectId", "Description": "Unique identifier for the sender’s account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "SenderType", "Description": "Type of user that sent the message, for example, User, Group, Anonymous", "Type": "String", "Entity": null }, { "Name": "RecipientDetails", "Description": "Array of recipient data (RecipientSmtpAddress, RecipientDisplayName, RecipientType, RecipientObjectId)", "Type": "Object", "Entity": null }, { "Name": "IsOwnedThread", "Description": "Boolean value indicating whether the message is owned by your organization or not (only the messages owned by your organization are remediable)", "Type": "Boolean", "Entity": null }, { "Name": "MessageId", "Description": "Identifier for the message", "Type": "String", "Entity": null }, { "Name": "ParentMessageId", "Description": "Identifier for the message that the current message was a reply to, otherwise this is the same as the MessageId", "Type": "String", "Entity": null }, { "Name": "GroupId", "Description": "Identifier for the team or group that the message was sent to", "Type": "String", "Entity": null }, { "Name": "GroupName", "Description": "Name of the team or group that the message was sent to", "Type": "String", "Entity": null }, { "Name": "ThreadId", "Description": "Identifier of the channel or chat thread that the message is part of ", "Type": "String", "Entity": null }, { "Name": "ThreadName", "Description": "Name of the channel or chat thread that the message is part of ", "Type": "String", "Entity": null }, { "Name": "ThreadType", "Description": "Type of the channel or chat thread that the message is part of ", "Type": "String", "Entity": null }, { "Name": "ThreadSubType", "Description": "Indicates the channel type, possible values: None, PrivateChannel", "Type": "String", "Entity": null }, { "Name": "IsExternalThread", "Description": "Indicates if there are external recipients in the thread", "Type": "Boolean", "Entity": null }, { "Name": "MessageType", "Description": "Type of message format possible values: RichText, Text ", "Type": "String", "Entity": null }, { "Name": "MessageSubtype", "Description": "Subtype of message format, for exmaple, HTML", "Type": "String", "Entity": null }, { "Name": "MessageVersion", "Description": "Version number of the message", "Type": "String", "Entity": null }, { "Name": "Subject", "Description": "Subject of the message, if it exists", "Type": "String", "Entity": null }, { "Name": "ThreatTypes", "Description": "Verdict from the filtering stack on whether the message contains malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "DetectionMethods", "Description": "Methods used to detect malware, phishing, or other threats found in the message", "Type": "Object", "Entity": null }, { "Name": "ConfidenceLevel", "Description": "List of confidence levels for each threat type identified", "Type": "Object", "Entity": null }, { "Name": "DeliveryAction", "Description": "Delivery action of the message: Delivered, Blocked", "Type": "String", "Entity": null }, { "Name": "DeliveryLocation", "Description": "Location of the message at the time of delivery", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "SafetyTip", "Description": "Indicates if a safe tip has been added on the message", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "MessageUrlInfo", "TableSource": "defender", "Description": "Contains information about URLs sent through messages", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "TeamsMessageId", "Description": "Unique identifier for the message generated by Office 365", "Type": "String", "Entity": null }, { "Name": "Url", "Description": "URL from message", "Type": "String", "Entity": "Url" }, { "Name": "UrlDomain", "Description": "Domain name or host name of the URL", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "UrlLocation", "Description": "Indicates which part of the Teams message the URL is located", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "MessagePostDeliveryEvents", "TableSource": "defender", "Description": "Security events that occur post-delivery of the message to recipient's inbox", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the event was recorded", "Type": "DateTime", "Entity": null }, { "Name": "TeamsMessageId", "Description": "Unique identifier for the message generated by Office 365", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the message", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "ActionTrigger", "Description": "Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery", "Type": "String", "Entity": null }, { "Name": "ActionResult", "Description": "Result of the action", "Type": "String", "Entity": null }, { "Name": "SenderEmailAddress", "Description": "Email address of the sender", "Type": "String", "Entity": null }, { "Name": "RecipientDetails", "Description": "Array of recipient data (RecipientSmtpAddress, RecipientDisplayName, RecipientType, RecipientObjectId)", "Type": "Object", "Entity": null }, { "Name": "IsExternalThread", "Description": "Indicates if there are external recipients in the thread", "Type": "Boolean", "Entity": null }, { "Name": "ThreatTypes", "Description": "Verdict from the filtering stack on whether the message contains malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "ConfidenceLevel", "Description": "List of confidence levels of any spam or phishing verdicts. For spam, this column shows the spam confidence level (SCL), indicating if the email was skipped (-1), found to be not spam (0,1), found to be spam with moderate confidence (5,6), or found to be spam with high confidence (9). For phishing, this column displays whether the confidence level is \"High\" or \"Low\".", "Type": "Object", "Entity": null }, { "Name": "DetectionMethods", "Description": "Methods used to detect malware, phishing, or other threats found in the email", "Type": "Object", "Entity": null }, { "Name": "LatestDeliveryLocation", "Description": "Last known location of the message", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "SafetyTip", "Description": "Indicates if a safe tip has been added on the message", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "CallActivityEvents", "TableSource": "defender", "Description": "Contains activity details during calls and meetings in Microsoft Teams", "Schema": [ { "Name": "ActivityTimestamp", "Description": "Date and time when the activity occurred during the call", "Type": "DateTime", "Entity": null }, { "Name": "CallId", "Description": "Unique identifier for the call, as generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "ActivityId", "Description": "Unique identifier of the activity log", "Type": "String", "Entity": null }, { "Name": "ActivityInitiatorId", "Description": "Unique identifier for the participant who initiated the activity", "Type": "String", "Entity": null }, { "Name": "ActivityType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "ThreadId", "Description": "Identifier of the channel or chat thread that the message is part of ", "Type": "String", "Entity": null }, { "Name": "ActivityInitiatorUpn", "Description": "Unique identifier for the account of the participant who initiated the activity", "Type": "String", "Entity": null }, { "Name": "ActivityInitiatorDisplayName", "Description": "Display name of the participant who initiated the activity", "Type": "String", "Entity": null }, { "Name": "CallSchedulingType", "Description": "Type of scheduling for the group call; possible values: Adhoc, Scheduled, Recurring", "Type": "String", "Entity": null }, { "Name": "CallJoinUrl", "Description": "Link used by the group call participants to join the call", "Type": "String", "Entity": null }, { "Name": "OriginatorUserDisplayName", "Description": "Display name of the caller who initiated the call", "Type": "String", "Entity": null }, { "Name": "OriginatorUpn", "Description": "Unique identifier for the account of the caller who initiated the call", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "UrlClickEvents", "TableSource": "defender", "Description": "Events involving URLs clicked, selected, or requested on Microsoft Defender for Office 365", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "Url", "Description": "URL that was clicked", "Type": "String", "Entity": "Url" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email from which the URL was clicked", "Type": "String", "Entity": null }, { "Name": "ThreatTypes", "Description": "Verdict on whether the URL leads to malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "DetectionMethods", "Description": "Methods used to detect whether the URL contains or leads to malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": "Ip" }, { "Name": "IsClickedThrough", "Description": "Indicates whether the user was able to click through to the original URL or not", "Type": "Boolean", "Entity": null }, { "Name": "UrlChain", "Description": "List of URLs in the redirection chain", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AppName", "Description": "The application's display name as exposed by the associated service principal", "Type": "String", "Entity": null }, { "Name": "AppVersion", "Description": "Version of the client application where click occurred", "Type": "String", "Entity": null }, { "Name": "SourceId", "Description": "Unique identifier for the source of the click", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "FileMaliciousContentInfo", "TableSource": "defender", "Description": "This table shows files that were identified as malicious by Microsoft Defender for Office 365 in SharePoint Online, OneDrive for Business, and Microsoft Teams.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileOwnerDisplayName", "Description": "Account recorded as owner of the file", "Type": "String", "Entity": null }, { "Name": "FileOwnerUpn", "Description": "Account recorded as owner of the file", "Type": "String", "Entity": null }, { "Name": "LastModifyingAccountUpn", "Description": "Account that last modified this file", "Type": "String", "Entity": null }, { "Name": "DocumentID", "Description": "Unique identifier of the file", "Type": "String", "Entity": null }, { "Name": "ThreatTypes", "Description": "Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats", "Type": "String", "Entity": null }, { "Name": "ThreatNames", "Description": "Detection name for malware or other threats found", "Type": "String", "Entity": null }, { "Name": "DetectionMethods", "Description": "Methods used to detect malware, phishing, or other threats found in the email", "Type": "Object", "Entity": null }, { "Name": "LastModifiedTime", "Description": "Date and time the item or related metadata was last modified", "Type": "DateTime", "Entity": null }, { "Name": "FileCreationTime", "Description": "Timestamp of the file creation", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "CampaignInfo", "TableSource": "defender", "Description": "This table shows information about campaigns identified by Microsoft Defender for Office 365", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "CampaignName", "Description": "Name of the email campaign", "Type": "String", "Entity": null }, { "Name": "CampaignId", "Description": "Unique identifier for the campaign, generated by Office 365", "Type": "String", "Entity": null }, { "Name": "CampaignType", "Description": "Category of the campaign", "Type": "String", "Entity": null }, { "Name": "CampaignSubType", "Description": "Contains more details about the campaign, like the brand being phished or related malware campaigns, if available", "Type": "String", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "RecipientEmailAddress", "Description": "Email address of the recipient, or email address of the recipient after distribution list expansion", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Emails", "TableSectionName": null }, { "Name": "DeviceInfo", "TableSource": "defender", "Description": "Machine information, including OS information", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ClientVersion", "Description": "Version of the endpoint agent or sensor running on the machine", "Type": "String", "Entity": null }, { "Name": "PublicIP", "Description": "Public IP address used by the onboarded machine to connect to the Windows Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy", "Type": "String", "Entity": "Ip" }, { "Name": "OSArchitecture", "Description": "Architecture of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "OSBuild", "Description": "Build version of the operating system running on the machine", "Type": "Int64", "Entity": null }, { "Name": "IsAzureADJoined", "Description": "Boolean indicator of whether machine is joined to the Microsoft Entra ID", "Type": "Boolean", "Entity": null }, { "Name": "JoinType", "Description": "The device's Microsoft Entra ID join type", "Type": "String", "Entity": null }, { "Name": "AadDeviceId", "Description": "Unique identifier for the device in Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "LoggedOnUsers", "Description": "List of all users that are logged on the machine at the time of the event in JSON array format", "Type": "String", "Entity": null }, { "Name": "RegistryDeviceTag", "Description": "Device tag added through the registry", "Type": "String", "Entity": null }, { "Name": "OSVersion", "Description": "Version of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "Machine group of the machine. This group is used by role-based access control to determine access to the machine", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "OnboardingStatus", "Description": "Indicates whether the device is currently onboarded or not to Microsoft Defender For Endpoint or if the device is not supported", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "DeviceCategory", "Description": "Broader classification that groups certain device types under the following categories: Endpoint, Network device, IoT, Unknown", "Type": "String", "Entity": null }, { "Name": "DeviceType", "Description": "Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer", "Type": "String", "Entity": null }, { "Name": "DeviceSubtype", "Description": "Additional modifier for certain types of devices; for example, a mobile device can be a tablet or a smartphone; only available if device discovery finds enough information about this attribute", "Type": "String", "Entity": null }, { "Name": "Model", "Description": "Model name or number of the product from the vendor or manufacturer; only available if device discovery finds enough information about this attribute", "Type": "String", "Entity": null }, { "Name": "Vendor", "Description": "Name of the product vendor or manufacturer; only available if device discovery finds enough information about this attribute", "Type": "String", "Entity": null }, { "Name": "OSDistribution", "Description": "Distribution of the OS platform, such as Ubuntu or RedHat for Linux platforms", "Type": "String", "Entity": null }, { "Name": "OSVersionInfo", "Description": "Additional information about the OS version, such as the popular name, code name, or version number", "Type": "String", "Entity": null }, { "Name": "MergedDeviceIds", "Description": "Previous device IDs that have been assigned to the same device.", "Type": "String", "Entity": null }, { "Name": "MergedToDeviceId", "Description": "The most recent device ID assigned to a device ", "Type": "String", "Entity": null }, { "Name": "IsInternetFacing", "Description": "Indicates whether the device is internet-facing", "Type": "Boolean", "Entity": null }, { "Name": "SensorHealthState", "Description": "Indicates health of the device’s EDR sensor, if onboarded to Microsoft Defender For Endpoint", "Type": "String", "Entity": null }, { "Name": "IsExcluded", "Description": "Determines if the device is excluded from different views and reports in the portal", "Type": "Boolean", "Entity": null }, { "Name": "ExclusionReason", "Description": "The reason for the device being excluded", "Type": "String", "Entity": null }, { "Name": "ExposureLevel", "Description": "The device's level of vulnerability to exploitation based on its exposure score; can be: Low, Medium, High", "Type": "String", "Entity": null }, { "Name": "AssetValue", "Description": "Priority or value assigned to the device in relation to its importance in computing the organization's exposure score; can be: Low, Normal (Default), High", "Type": "String", "Entity": null }, { "Name": "DeviceManualTags", "Description": "Device tags created manually using the portal UI or public API", "Type": "String", "Entity": null }, { "Name": "DeviceDynamicTags", "Description": "Device tags added and removed dynamically based on dynamic rules", "Type": "String", "Entity": null }, { "Name": "HardwareUuid", "Description": "Universally Unique Identifier (UUID) of the device’s hardware", "Type": "String", "Entity": null }, { "Name": "CloudPlatforms", "Description": "The cloud platforms that the device belongs to—can be Azure, Amazon Web Services, Google Cloud Platform and Azure Arc", "Type": "String", "Entity": null }, { "Name": "AzureVmId", "Description": "Unique identifier assigned to the device in Azure", "Type": "String", "Entity": null }, { "Name": "AzureResourceId", "Description": "Unique identifier of the Azure resource associated with the device.", "Type": "String", "Entity": null }, { "Name": "AzureVmSubscriptionId", "Description": "Unique identifier of the Azure subscription associated with the device", "Type": "String", "Entity": null }, { "Name": "GcpFullResourceName", "Description": "Unique identifier specific to Google Cloud Platform devices, containing a combination of zone and ID", "Type": "String", "Entity": null }, { "Name": "AwsResourceName", "Description": "Unique identifier specific to Amazon Web Services devices, containing the Amazon Resource Name", "Type": "String", "Entity": null }, { "Name": "IsTransient", "Description": "Indicates whether this device is classified as short-lived or transient based on the frequency of appearance of the device on the network", "Type": "Boolean", "Entity": null }, { "Name": "OsBuildRevision", "Description": "Build revision number of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "HostDeviceId", "Description": "Device ID of the device running Windows Subsystem for Linux", "Type": "String", "Entity": null }, { "Name": "MitigationStatus", "Description": "Indicates the mitigation action applied to a device", "Type": "String", "Entity": null }, { "Name": "ConnectivityType", "Description": "Type of connectivity from the device to the cloud", "Type": "String", "Entity": null }, { "Name": "DlpInfo", "Description": "Properties related to Endpoint Data Loss Prevention (DLP).", "Type": "String", "Entity": null }, { "Name": "DiscoverySources", "Description": "Products or services that have seen or reported the device, including when they last reported it", "Type": "String", "Entity": null }, { "Name": "FirmwareVersions", "Description": "The firmware versions of the device", "Type": "String", "Entity": null }, { "Name": "RestrictedDeviceSecurityOperations", "Description": "The response categories that have been turned off on a device if its security operations settings is set to restricted. If the device's security operations settings is set to full operations, the value is null.", "Type": "String", "Entity": null }, { "Name": "DeviceRoles", "Description": "The functional roles of the device within the organization's infrastructure or security environment based on system configuration, observed activity, installed services, and administrative behavior patterns.", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceNetworkInfo", "TableSource": "defender", "Description": "Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "NetworkAdapterName", "Description": "Name of the network adapter", "Type": "String", "Entity": null }, { "Name": "MacAddress", "Description": "MAC address of the network adapter", "Type": "String", "Entity": null }, { "Name": "NetworkAdapterType", "Description": "Network adapter type", "Type": "String", "Entity": null }, { "Name": "NetworkAdapterStatus", "Description": "Operational status of the network adapter", "Type": "String", "Entity": null }, { "Name": "TunnelType", "Description": "Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH", "Type": "String", "Entity": null }, { "Name": "ConnectedNetworks", "Description": "Networks that the adapter is connected to. Each JSON element in the array contains the network name, category (public, private or domain), a description, and a flag indicating if it’s connected publicly to the internet", "Type": "String", "Entity": null }, { "Name": "DnsAddresses", "Description": "DNS server addresses in JSON array format", "Type": "String", "Entity": null }, { "Name": "IPv4Dhcp", "Description": "IPv4 address of DHCP server", "Type": "String", "Entity": "Ip" }, { "Name": "IPv6Dhcp", "Description": "IPv6 address of DHCP server", "Type": "String", "Entity": "Ip" }, { "Name": "DefaultGateways", "Description": "Default gateway addresses in JSON array format", "Type": "String", "Entity": null }, { "Name": "IPAddresses", "Description": "JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and the IP class (RFC 1918 & RFC 4291)", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "NetworkAdapterVendor", "Description": "Name of the manufacturer or vendor of the network adapter", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceProcessEvents", "TableSource": "defender", "Description": "Process creation and related events", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "MD5", "Description": "MD5 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "ProcessVersionInfoCompanyName", "Description": "Company name from the version information of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessVersionInfoProductName", "Description": "Product name from the version information of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessVersionInfoProductVersion", "Description": "Product version from the version information of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessVersionInfoFileDescription", "Description": "Description from the version information of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "Int64", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "ProcessIntegrityLevel", "Description": "Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources.", "Type": "String", "Entity": null }, { "Name": "ProcessTokenElevation", "Description": "Indicates the type of token elevation applied to the newly created process. Possible values: TokenElevationTypeLimited (restricted), TokenElevationTypeDefault (standard), and TokenElevationTypeFull (elevated)", "Type": "String", "Entity": null }, { "Name": "ProcessCreationTime", "Description": "Date and time the process was created", "Type": "DateTime", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "LogonId", "Description": "Identifier for a logon session. This identifier is unique on the same machine only between restarts", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": "UserSid" }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": "UserObjectId" }, { "Name": "InitiatingProcessLogonId", "Description": "Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts.", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessIntegrityLevel", "Description": "Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessTokenElevation", "Description": "Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA256", "Description": "SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileSize", "Description": "Size of the process (image file) that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessVersionInfoCompanyName", "Description": "Company name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductName", "Description": "Product name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductVersion", "Description": "Product version from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoFileDescription", "Description": "Description from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessCommandLine", "Description": "Command line used to run the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessSignerType", "Description": "Type of file signer of the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSignatureStatus", "Description": "Information about the signature status of the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSessionId", "Description": "Windows session ID of the initiating process", "Type": "Int64", "Entity": null }, { "Name": "IsInitiatingProcessRemoteSession", "Description": "Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "InitiatingProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "InitiatingProcessRemoteSessionIP", "Description": "IP address of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "CreatedProcessSessionId", "Description": "Windows session ID of the created process", "Type": "Int64", "Entity": null }, { "Name": "IsProcessRemoteSession", "Description": "Indicates whether the created process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "ProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the created process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "ProcessRemoteSessionIP", "Description": "IP address of the remote device from which the created process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "ProcessUniqueId", "Description": "Unique identifier of the process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessUniqueId", "Description": "Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceNetworkEvents", "TableSource": "defender", "Description": "Network connection and related events", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": "Ip" }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "Int32", "Entity": null }, { "Name": "RemoteUrl", "Description": "URL or fully qualified domain name (FQDN) that was being connected to", "Type": "String", "Entity": "Url" }, { "Name": "LocalIP", "Description": "IP address assigned to the local machine used during communication", "Type": "String", "Entity": "Ip" }, { "Name": "LocalPort", "Description": "TCP port on the local machine used during communication", "Type": "Int32", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "LocalIPType", "Description": "Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast", "Type": "String", "Entity": null }, { "Name": "RemoteIPType", "Description": "Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA256", "Description": "SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileSize", "Description": "Size of the process (image file) that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessVersionInfoCompanyName", "Description": "Company name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductName", "Description": "Product name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductVersion", "Description": "Product version from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoFileDescription", "Description": "Description from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessCommandLine", "Description": "Command line used to run the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": "UserSid" }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": "UserObjectId" }, { "Name": "InitiatingProcessIntegrityLevel", "Description": "Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessTokenElevation", "Description": "Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSessionId", "Description": "Windows session ID of the initiating process", "Type": "Int64", "Entity": null }, { "Name": "IsInitiatingProcessRemoteSession", "Description": "Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "InitiatingProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "InitiatingProcessRemoteSessionIP", "Description": "IP address of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "InitiatingProcessUniqueId", "Description": "Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceFileEvents", "TableSource": "defender", "Description": "File creation, modification, and other file system events", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "MD5", "Description": "MD5 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileOriginUrl", "Description": "URL where the file was downloaded from", "Type": "String", "Entity": "Url" }, { "Name": "FileOriginReferrerUrl", "Description": "URL of the web page that links to the downloaded file", "Type": "String", "Entity": "Url" }, { "Name": "FileOriginIP", "Description": "IP address where the file was downloaded from", "Type": "String", "Entity": "Ip" }, { "Name": "PreviousFolderPath", "Description": "Original folder containing the file before the recorded action was applied", "Type": "String", "Entity": null }, { "Name": "PreviousFileName", "Description": "Original name of the file that was renamed as a result of the action", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": "UserSid" }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": "UserObjectId" }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA256", "Description": "SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileSize", "Description": "Size of the process (image file) that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessVersionInfoCompanyName", "Description": "Company name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductName", "Description": "Product name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductVersion", "Description": "Product version from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoFileDescription", "Description": "Description from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessCommandLine", "Description": "Command line used to run the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessIntegrityLevel", "Description": "Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessTokenElevation", "Description": "Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "RequestProtocol", "Description": "Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS", "Type": "String", "Entity": null }, { "Name": "RequestSourceIP", "Description": "IPv4 or IPv6 address of the remote device that initiated the activity", "Type": "String", "Entity": null }, { "Name": "RequestSourcePort", "Description": "Source port on the remote device that initiated the activity", "Type": "Int32", "Entity": null }, { "Name": "RequestAccountName", "Description": "User name of account used to remotely initiate the activity", "Type": "String", "Entity": null }, { "Name": "RequestAccountDomain", "Description": "Domain of the account used to remotely initiate the activity", "Type": "String", "Entity": null }, { "Name": "RequestAccountSid", "Description": "Security Identifier (SID) of the account used to remotely initiate the activity", "Type": "String", "Entity": "UserSid" }, { "Name": "ShareName", "Description": "Name of shared folder containing the file", "Type": "String", "Entity": null }, { "Name": "SensitivityLabel", "Description": "Label applied to an email, file, or other content to classify it for information protection", "Type": "String", "Entity": null }, { "Name": "SensitivitySubLabel", "Description": "Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently", "Type": "String", "Entity": null }, { "Name": "IsAzureInfoProtectionApplied", "Description": "Indicates whether the file is encrypted by Azure Information Protection", "Type": "Boolean", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSessionId", "Description": "Windows session ID of the initiating process", "Type": "Int64", "Entity": null }, { "Name": "IsInitiatingProcessRemoteSession", "Description": "Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "InitiatingProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "InitiatingProcessRemoteSessionIP", "Description": "IP address of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "InitiatingProcessUniqueId", "Description": "Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceRegistryEvents", "TableSource": "defender", "Description": "Creation and modification of registry entries", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "RegistryKey", "Description": "Registry key that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueType", "Description": "Data type, such as binary or string, of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueName", "Description": "Name of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueData", "Description": "Data of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "PreviousRegistryKey", "Description": "Original registry key before it was modified", "Type": "String", "Entity": null }, { "Name": "PreviousRegistryValueName", "Description": "Original name of the registry value before it was modified", "Type": "String", "Entity": null }, { "Name": "PreviousRegistryValueData", "Description": "Original data of the registry value before it was modified", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": "UserSid" }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": "UserObjectId" }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA256", "Description": "SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileSize", "Description": "Size of the process (image file) that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessVersionInfoCompanyName", "Description": "Company name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductName", "Description": "Product name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductVersion", "Description": "Product version from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoFileDescription", "Description": "Description from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessCommandLine", "Description": "Command line used to run the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessIntegrityLevel", "Description": "Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessTokenElevation", "Description": "Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSessionId", "Description": "Windows session ID of the initiating process", "Type": "Int64", "Entity": null }, { "Name": "IsInitiatingProcessRemoteSession", "Description": "Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "InitiatingProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "InitiatingProcessRemoteSessionIP", "Description": "IP address of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "InitiatingProcessUniqueId", "Description": "Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceLogonEvents", "TableSource": "defender", "Description": "\tSign-ins and other authentication events", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "LogonType", "Description": "Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "FailureReason", "Description": "Information explaining why the recorded action failed", "Type": "String", "Entity": null }, { "Name": "IsLocalAdmin", "Description": "Boolean indicator of whether the user is a local administrator on the machine", "Type": "Boolean", "Entity": null }, { "Name": "LogonId", "Description": "Identifier for a logon session. This identifier is unique on the same machine only between restarts", "Type": "Int64", "Entity": null }, { "Name": "RemoteDeviceName", "Description": "Name of the device that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information.", "Type": "String", "Entity": "Machine" }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": "Ip" }, { "Name": "RemoteIPType", "Description": "Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast", "Type": "String", "Entity": null }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "Int32", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": "UserSid" }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": "UserObjectId" }, { "Name": "InitiatingProcessIntegrityLevel", "Description": "Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessTokenElevation", "Description": "Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA256", "Description": "SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileSize", "Description": "Size of the process (image file) that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessVersionInfoCompanyName", "Description": "Company name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductName", "Description": "Product name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductVersion", "Description": "Product version from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoFileDescription", "Description": "Description from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessCommandLine", "Description": "Command line used to run the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSessionId", "Description": "Windows session ID of the initiating process", "Type": "Int64", "Entity": null }, { "Name": "IsInitiatingProcessRemoteSession", "Description": "Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "InitiatingProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "InitiatingProcessRemoteSessionIP", "Description": "IP address of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "InitiatingProcessUniqueId", "Description": "Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceImageLoadEvents", "TableSource": "defender", "Description": "DLL loading events", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "MD5", "Description": "MD5 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": "UserSid" }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": "UserObjectId" }, { "Name": "InitiatingProcessIntegrityLevel", "Description": "Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessTokenElevation", "Description": "Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA256", "Description": "SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileSize", "Description": "Size of the process (image file) that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessVersionInfoCompanyName", "Description": "Company name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductName", "Description": "Product name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductVersion", "Description": "Product version from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoFileDescription", "Description": "Description from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessCommandLine", "Description": "Command line used to run the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSessionId", "Description": "Windows session ID of the initiating process", "Type": "Int64", "Entity": null }, { "Name": "IsInitiatingProcessRemoteSession", "Description": "Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "InitiatingProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "InitiatingProcessRemoteSessionIP", "Description": "IP address of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "InitiatingProcessUniqueId", "Description": "Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceEvents", "TableSource": "defender", "Description": "Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "MD5", "Description": "MD5 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "RemoteUrl", "Description": "URL or fully qualified domain name (FQDN) that was being connected to", "Type": "String", "Entity": "Url" }, { "Name": "RemoteDeviceName", "Description": "Name of the device that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information.", "Type": "String", "Entity": "Machine" }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "Int64", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "ProcessCreationTime", "Description": "Date and time the process was created", "Type": "DateTime", "Entity": null }, { "Name": "ProcessTokenElevation", "Description": "Indicates the type of token elevation applied to the newly created process. Possible values: TokenElevationTypeLimited (restricted), TokenElevationTypeDefault (standard), and TokenElevationTypeFull (elevated)", "Type": "String", "Entity": null }, { "Name": "LogonId", "Description": "Identifier for a logon session. This identifier is unique on the same machine only between restarts", "Type": "Int64", "Entity": null }, { "Name": "RegistryKey", "Description": "Registry key that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueName", "Description": "Name of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueData", "Description": "Data of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": "Ip" }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "Int32", "Entity": null }, { "Name": "LocalIP", "Description": "IP address assigned to the local machine used during communication", "Type": "String", "Entity": "Ip" }, { "Name": "LocalPort", "Description": "TCP port on the local machine used during communication", "Type": "Int32", "Entity": null }, { "Name": "FileOriginUrl", "Description": "URL where the file was downloaded from", "Type": "String", "Entity": "Url" }, { "Name": "FileOriginIP", "Description": "IP address where the file was downloaded from", "Type": "String", "Entity": "Ip" }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessSHA256", "Description": "SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": "File" }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessFileSize", "Description": "Size of the process (image file) that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessCommandLine", "Description": "Command line used to run the process that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": "UserSid" }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": "UserObjectId" }, { "Name": "InitiatingProcessVersionInfoCompanyName", "Description": "Company name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductName", "Description": "Product name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoProductVersion", "Description": "Product version from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoInternalFileName", "Description": "Internal file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoOriginalFileName", "Description": "Original file name from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessVersionInfoFileDescription", "Description": "Description from the version information of the process (image file) responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessLogonId", "Description": "Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts.", "Type": "Int64", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessSessionId", "Description": "Windows session ID of the initiating process", "Type": "Int64", "Entity": null }, { "Name": "IsInitiatingProcessRemoteSession", "Description": "Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "InitiatingProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "InitiatingProcessRemoteSessionIP", "Description": "IP address of the remote device from which the initiating process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "CreatedProcessSessionId", "Description": "Windows session ID of the created process", "Type": "Int64", "Entity": null }, { "Name": "IsProcessRemoteSession", "Description": "Indicates whether the created process was run under a remote desktop protocol (RDP) session (true) or locally (false)", "Type": "Boolean", "Entity": null }, { "Name": "ProcessRemoteSessionDeviceName", "Description": "Device name of the remote device from which the created process’s RDP session was initiated", "Type": "String", "Entity": "Machine" }, { "Name": "ProcessRemoteSessionIP", "Description": "IP address of the remote device from which the created process’s RDP session was initiated", "Type": "String", "Entity": "Ip" }, { "Name": "InitiatingProcessUniqueId", "Description": "Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceFileCertificateInfo", "TableSource": "defender", "Description": "Certificate information of signed files obtained from certificate verification events on endpoints", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "IsSigned", "Description": "Indicates whether the file is signed", "Type": "Boolean", "Entity": null }, { "Name": "SignatureType", "Description": "Indicates whether signature information was read as embedded content in the file itself or read from an external catalog file", "Type": "String", "Entity": null }, { "Name": "Signer", "Description": "Information about the signer of the file", "Type": "String", "Entity": null }, { "Name": "SignerHash", "Description": "Unique hash value identifying the signer", "Type": "String", "Entity": null }, { "Name": "Issuer", "Description": "Information about the issuing certificate authority (CA)", "Type": "String", "Entity": null }, { "Name": "IssuerHash", "Description": "Unique hash value identifying issuing certificate authority (CA)", "Type": "String", "Entity": null }, { "Name": "CertificateSerialNumber", "Description": "Identifier for the certificate that is unique to the issuing certificate authority (CA)", "Type": "String", "Entity": null }, { "Name": "CrlDistributionPointUrls", "Description": "JSON array listing the URLs of network shares that contain certificates and certificate revocation lists (CRLs)", "Type": "String", "Entity": null }, { "Name": "CertificateCreationTime", "Description": "Date and time the certificate was created", "Type": "DateTime", "Entity": null }, { "Name": "CertificateExpirationTime", "Description": "Date and time the certificate is set to expire", "Type": "DateTime", "Entity": null }, { "Name": "CertificateCountersignatureTime", "Description": "Date and time the certificate was countersigned", "Type": "DateTime", "Entity": null }, { "Name": "IsTrusted", "Description": "Indicates whether the file is trusted based on the results of the WinVerifyTrust function, which checks for unknown root certificate information, invalid signatures, revoked certificates, and other questionable attributes", "Type": "Boolean", "Entity": null }, { "Name": "IsRootSignerMicrosoft", "Description": "Indicates whether the signer of the root certificate is Microsoft", "Type": "Boolean", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DynamicEventCollection", "TableSource": "sentinel", "Description": "Microsoft Defender for Endpoints (MDE) table for generic windows events. Fields of the raw events are available as part of the AdditionalFields column.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "AppGuardContainerId", "Description": "Identifier for the virtualized container used by Application Guard to isolate browser activity", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": null }, { "Name": "EventId", "Description": "Contains the unique event identifier", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessAccountDomain", "Description": "Domain of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountName", "Description": "User name of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountObjectId", "Description": "Microsoft Entra object ID of the user account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountSid", "Description": "Security Identifier (SID) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessAccountUpn", "Description": "User principal name (UPN) of the account that ran the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessCreationTime", "Description": "Date and time when the process that initiated the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessFolderPath", "Description": "Folder containing the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessLogonId", "Description": "Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts.", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessMD5", "Description": "MD5 hash of the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentCreationTime", "Description": "Date and time when the parent of the process responsible for the event was started", "Type": "DateTime", "Entity": null }, { "Name": "InitiatingProcessParentFileName", "Description": "Name of the parent process that spawned the process responsible for the event", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessParentId", "Description": "Process ID (PID) of the parent process that spawned the process responsible for the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessSHA1", "Description": "SHA-1 hash of the process (image file) that initiated the event", "Type": "String", "Entity": null }, { "Name": "LocalIP", "Description": "IP address assigned to the local machine used during communication", "Type": "String", "Entity": null }, { "Name": "LocalPort", "Description": "TCP port on the local machine used during communication", "Type": "Int32", "Entity": null }, { "Name": "MachineGroup", "Description": "Machine group of the machine. This group is used by role-based access control to determine access to the machine", "Type": "String", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "RemoteDeviceName", "Description": "Name of the device that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information.", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": null }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "Int32", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "Int64", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time the event was recorded by the MDE agent on the endpoint.", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Devices", "TableSectionName": null }, { "Name": "DisruptionAndResponseEvents", "TableSource": "defender", "Description": "A table exposing and organizing all Disruption block and policy application events, that correlated to a specific attack disruption policy applied", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "SourceDeviceId", "Description": "Unique identifier for the device that the attack originated from", "Type": "String", "Entity": "Machine" }, { "Name": "TargetDeviceId", "Description": "Unique identifier for the device that was targeted or attacked", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "DomainName", "Description": "Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack", "Type": "String", "Entity": null }, { "Name": "SourceDeviceName", "Description": "Host name of the device where the attack originated from", "Type": "String", "Entity": "Machine" }, { "Name": "SourceDomainName", "Description": "Domain name of the device where the attack originated from", "Type": "String", "Entity": null }, { "Name": "TargetDeviceName", "Description": "Fully qualified domain name (FQDN) of the device that the recorded action was applied to", "Type": "String", "Entity": "Machine" }, { "Name": "TargetDomainName", "Description": "Domain name of the device that was targeted or attacked", "Type": "String", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessFileName", "Description": "Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead", "Type": "String", "Entity": null }, { "Name": "SourceUserSid", "Description": "The security identifier of the account conducting the malicious activity", "Type": "String", "Entity": "UserObjectId" }, { "Name": "SourceUserName", "Description": "The user name of the account conducting the malicious activity", "Type": "String", "Entity": "User" }, { "Name": "SourceUserDomainName", "Description": "The domain name of the account conducting the malicious activity", "Type": "String", "Entity": null }, { "Name": "SourceIpAddress", "Description": "IP address where the attacker communication originated from and was blocked by automatic attack disruption", "Type": "String", "Entity": null }, { "Name": "SourcePort", "Description": "Port where the attacker communication originated from", "Type": "Int32", "Entity": null }, { "Name": "IpAddress", "Description": "IP address that the attacker attempted to access", "Type": "String", "Entity": "Ip" }, { "Name": "Port", "Description": "TCP port used during communication", "Type": "Int32", "Entity": null }, { "Name": "AuthenticationProtocol", "Description": "Authentication protocol that the compromised user used to sign in; possible values: Undefined, NTLM, Kerberos", "Type": "String", "Entity": null }, { "Name": "Service", "Description": "Name of the service the attacker attempted to use, if the attacker signed in using Kerberos or NTLM; for example: SMB, HTTP, cifs, SMB, host, ldap, SMB, krbtgt", "Type": "String", "Entity": null }, { "Name": "InterfaceUuid", "Description": "Unique identifier (UUID) for the Remote Procedure Call (RPC) interface that the attacker attempted to access", "Type": "String", "Entity": null }, { "Name": "InterfaceFriendlyName", "Description": "Friendly name of the interface represented by the interface UUID", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "ShareName", "Description": "Name of shared folder containing the file", "Type": "String", "Entity": null }, { "Name": "LogonType", "Description": "Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service", "Type": "String", "Entity": null }, { "Name": "LogonId", "Description": "Identifier for a logon session. This identifier is unique on the same machine only between restarts", "Type": "Int64", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "Int64", "Entity": null }, { "Name": "CompromisedAccountCount", "Description": "Number of compromised accounts that are part of the policy", "Type": "Int32", "Entity": null }, { "Name": "PolicyId", "Description": "Unique identifier for the policy", "Type": "String", "Entity": null }, { "Name": "PolicyName", "Description": "Name of the policy", "Type": "String", "Entity": null }, { "Name": "PolicyVersion", "Description": "Version of the policy", "Type": "String", "Entity": null }, { "Name": "PolicyHash", "Description": "Unique hash of the policy", "Type": "String", "Entity": null }, { "Name": "DataSource", "Description": "Data source of the cloud audit event. Could be Azure ARM Logs, AWS CloudTrail, GCP Logging or other", "Type": "String", "Entity": null }, { "Name": "ReportType", "Description": "Type of reported event; Prevented/Blocked/PolicyUpdated", "Type": "String", "Entity": null }, { "Name": "IsPolicyOn", "Description": "Indicates the current state of the policy on the device at the time of the disruption event; possible values: true (the policy is on, therefore it was applied or enforced), false (the policy was turned off or revoked from the device)", "Type": "Boolean", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Devices", "TableSectionName": null }, { "Name": "DeviceTvmSoftwareVulnerabilities", "TableSource": "defender", "Description": "Software vulnerabilities found on devices and the list of available security updates that address each vulnerability", "Schema": [ { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "OSVersion", "Description": "Version of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "OSArchitecture", "Description": "Architecture of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "SoftwareVendor", "Description": "Name of the software vendor", "Type": "String", "Entity": null }, { "Name": "SoftwareName", "Description": "Name of the software product", "Type": "String", "Entity": null }, { "Name": "SoftwareVersion", "Description": "Version number of the software product", "Type": "String", "Entity": null }, { "Name": "CveId", "Description": "Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system", "Type": "String", "Entity": null }, { "Name": "VulnerabilitySeverityLevel", "Description": "Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape", "Type": "String", "Entity": null }, { "Name": "RecommendedSecurityUpdate", "Description": "Name or description of the security update provided by the software vendor to address the vulnerability", "Type": "String", "Entity": null }, { "Name": "RecommendedSecurityUpdateId", "Description": "Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles", "Type": "String", "Entity": null }, { "Name": "CveTags", "Description": "Array of tags relevant to the CVE; example: ZeroDay, NoSecurityUpdate", "Type": "Object", "Entity": null }, { "Name": "CveMitigationStatus", "Description": "Indicates the status of the workaround mitigation for the CVE on this device (possible values: applied, not applied, partially applied, pending reboot)", "Type": "String", "Entity": null }, { "Name": "AadDeviceId", "Description": "Unique identifier for the device in Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "ProductCategory", "Description": "Category of the software product", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "DeviceTvmSoftwareVulnerabilitiesKB", "TableSource": "defender", "Description": "Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available", "Schema": [ { "Name": "CveId", "Description": "Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system", "Type": "String", "Entity": null }, { "Name": "CvssScore", "Description": "Severity score assigned to the security vulnerability under the Common Vulnerability Scoring System (CVSS)", "Type": "Double", "Entity": null }, { "Name": "CvssVector", "Description": "Cvss Vector is a compressed textual representation that reflects the values used to derive the score", "Type": "String", "Entity": null }, { "Name": "CveSupportability", "Description": "Cve Supportability is an indicator to indicate whether Microsoft supports the Cve or supports it in a Premium plan", "Type": "String", "Entity": null }, { "Name": "IsExploitAvailable", "Description": "Indicates whether exploit code for the vulnerability is publicly available", "Type": "Boolean", "Entity": null }, { "Name": "VulnerabilitySeverityLevel", "Description": "Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape", "Type": "String", "Entity": null }, { "Name": "LastModifiedTime", "Description": "Date and time the item or related metadata was last modified", "Type": "DateTime", "Entity": null }, { "Name": "PublishedDate", "Description": "Date vulnerability was disclosed to the public", "Type": "DateTime", "Entity": null }, { "Name": "VulnerabilityDescription", "Description": "Description of the vulnerability and associated risks", "Type": "String", "Entity": null }, { "Name": "AffectedSoftware", "Description": "List of all software products affected by the vulnerability", "Type": "String", "Entity": null }, { "Name": "EpssScore", "Description": "Represents the probability that a vulnerability will be exploited. This probability is expressed as a number between 0 and 1 (0%-100%) according to the EPSS model.", "Type": "Double", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "DeviceTvmSecureConfigurationAssessment", "TableSource": "defender", "Description": "Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices", "Schema": [ { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ConfigurationId", "Description": "Unique identifier for a specific configuration", "Type": "String", "Entity": null }, { "Name": "ConfigurationCategory", "Description": "Category or grouping to which the configuration belongs", "Type": "String", "Entity": null }, { "Name": "ConfigurationSubcategory", "Description": "Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features.", "Type": "String", "Entity": null }, { "Name": "ConfigurationImpact", "Description": "Rated impact of the configuration to the overall configuration score (1-10)", "Type": "Double", "Entity": null }, { "Name": "IsCompliant", "Description": "Indicates whether the configuration or policy is properly configured", "Type": "Boolean", "Entity": null }, { "Name": "IsApplicable", "Description": "Indicates whether the configuration or policy is applicable", "Type": "Boolean", "Entity": null }, { "Name": "Context", "Description": "Configuration context data of the machine", "Type": "Object", "Entity": null }, { "Name": "IsExpectedUserImpact", "Description": "Indicates whether there will be user impact if the configuration will be applied", "Type": "Boolean", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "DeviceTvmSecureConfigurationAssessmentKB", "TableSource": "defender", "Description": "Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks", "Schema": [ { "Name": "ConfigurationId", "Description": "Unique identifier for a specific configuration", "Type": "String", "Entity": null }, { "Name": "ConfigurationImpact", "Description": "Rated impact of the configuration to the overall configuration score (1-10)", "Type": "Double", "Entity": null }, { "Name": "ConfigurationName", "Description": "Display name of the configuration", "Type": "String", "Entity": null }, { "Name": "ConfigurationDescription", "Description": "Description of the configuration", "Type": "String", "Entity": null }, { "Name": "RiskDescription", "Description": "Description of any associated risks", "Type": "String", "Entity": null }, { "Name": "ConfigurationCategory", "Description": "Category or grouping to which the configuration belongs", "Type": "String", "Entity": null }, { "Name": "ConfigurationSubcategory", "Description": "Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features.", "Type": "String", "Entity": null }, { "Name": "ConfigurationBenchmarks", "Description": "List of industry benchmarks recommending the same or similar configuration", "Type": "Object", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "Object", "Entity": null }, { "Name": "RemediationOptions", "Description": "Recommended actions to reduce or address any associated risks", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "DeviceTvmSoftwareInventory", "TableSource": "defender", "Description": "Inventory of software installed on devices, including their version information and end-of-support status", "Schema": [ { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "OSVersion", "Description": "Version of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "OSArchitecture", "Description": "Architecture of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "SoftwareVendor", "Description": "Name of the software vendor", "Type": "String", "Entity": null }, { "Name": "SoftwareName", "Description": "Name of the software product", "Type": "String", "Entity": null }, { "Name": "SoftwareVersion", "Description": "Version number of the software product", "Type": "String", "Entity": null }, { "Name": "EndOfSupportStatus", "Description": "Indicates the lifecycle stage of the software product relative to its specified end-of-support (EOS) or end-of-life (EOL) date", "Type": "String", "Entity": null }, { "Name": "EndOfSupportDate", "Description": "End-of-support (EOS) or end-of-life (EOL) date of the software product", "Type": "DateTime", "Entity": null }, { "Name": "ProductCodeCpe", "Description": "The standard Common Platform Enumeration (CPE) name of the software product version", "Type": "String", "Entity": null }, { "Name": "SoftwareTags", "Description": "Array of tags applied to the software product. Example: AI (present for AI-related software products such as `langchain`, `torch`, `@anthropic-ai/sdk`)", "Type": "Object", "Entity": null }, { "Name": "ProductCategory", "Description": "Category of the software product", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "DeviceTvmInfoGathering", "TableSource": "defender", "Description": "The DeviceTvmInfoGathering table contains Threat & Vulnerability Management assessment events including the status of various configurations and attack surface area states of devices.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "LastSeenTime", "Description": "Date and time when the service last saw the device", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "DeviceTvmInfoGatheringKB", "TableSource": "defender", "Description": "The DeviceTvmInfoGatheringKB table contains the list of various configuration and attack surface area assessments used by Threat & Vulnerability Management information gathering to assess devices", "Schema": [ { "Name": "IgId", "Description": "Unique identifier for the piece of information gathered", "Type": "DateTime", "Entity": null }, { "Name": "FieldName", "Description": "Name of the field where this information appears in the AdditionalFields column of the DeviceTvmInfoGathering table", "Type": "DateTime", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "List of categories that the information belongs to, in JSON array format", "Type": "String", "Entity": null }, { "Name": "DataStructure", "Description": "The data structure of the information gathered", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "DeviceTvmSoftwareEvidenceBeta", "TableSource": "defender", "Description": "Evidence indicating the existence of a software on a device based on registry paths, disk paths, or both.", "Schema": [ { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "SoftwareVendor", "Description": "Name of the software vendor", "Type": "String", "Entity": null }, { "Name": "SoftwareName", "Description": "Name of the software product", "Type": "String", "Entity": null }, { "Name": "SoftwareVersion", "Description": "Version number of the software product", "Type": "String", "Entity": null }, { "Name": "RegistryPaths", "Description": "Registry paths on which evidence indicating the existence of a software on a device was detected", "Type": "Object", "Entity": null }, { "Name": "DiskPaths", "Description": "Disk paths on which file level evidence indicating the existence of a software on a device was detected", "Type": "Object", "Entity": null }, { "Name": "LastSeenTime", "Description": "Date and time when the service last saw the device", "Type": "DateTime", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Tvm", "TableSectionName": null }, { "Name": "CloudAuditEvents", "TableSource": "defender", "Description": "The CloudAuditEvents table in the advanced hunting schema contains information about activities in various cloud environments and resources covered by Microsoft Defender for Cloud", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "AuditSource", "Description": "Cloud enviorment source of the cloud audit event. Cloud be Azure, AWS, GCP, AliCloud or other", "Type": "String", "Entity": null }, { "Name": "DataSource", "Description": "Data source of the cloud audit event. Could be Azure ARM Logs, AWS CloudTrail, GCP Logging or other", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "AzureResourceId", "Description": "An identifier for the Azure cloud resource as found by Microsoft Defender for Cloud.", "Type": "String", "Entity": null }, { "Name": "AwsResourceName", "Description": "An identifier for the Aws cloud resource as found by Microsoft Defender for Cloud.", "Type": "String", "Entity": null }, { "Name": "GcpFullResourceName", "Description": "An identifier for the Google cloud resource as found by Microsoft Defender for Cloud.", "Type": "String", "Entity": null }, { "Name": "Account", "Description": "An identifier for the account as found by Microsoft Defender for Cloud. Could be Microsoft Entra ID, user principal name, IaM role or other identifiers", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "The client IP address used to access the cloud resource or control plane", "Type": "String", "Entity": null }, { "Name": "IsAnonymousProxy", "Description": "Indicates whether the IP address belongs to a known anonymous proxy", "Type": "Boolean", "Entity": null }, { "Name": "CountryCode", "Description": "Two-letter code indicating the country where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "City", "Description": "City where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "ISP", "Description": "Internet service provider associated with the IP address", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "RawEventData", "Description": "Full raw event information from the source application or service in JSON format", "Type": "Object", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Cloud", "TableSectionName": null }, { "Name": "CloudProcessEvents", "TableSource": "defender", "Description": "The CloudProcessEvents table in the advanced hunting schema contains information about process creation and related events from cloud infrastructure environments. Use this reference to construct queries that return information from this table.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "AzureResourceId", "Description": "Unique identifier of the Azure resource associated with the process", "Type": "String", "Entity": null }, { "Name": "AwsResourceName", "Description": "Unique identifier specific to Amazon Web Services devices, containing the Amazon resource name", "Type": "String", "Entity": null }, { "Name": "GcpFullResourceName", "Description": "Unique identifier specific to Google Cloud Platform devices, containing a combination of zone and ID for GCP", "Type": "String", "Entity": null }, { "Name": "ContainerImageName", "Description": "The container image name or ID, if it exists", "Type": "String", "Entity": null }, { "Name": "KubernetesNamespace", "Description": "The Kubernetes namespace name", "Type": "String", "Entity": null }, { "Name": "KubernetesPodName", "Description": "The Kubernetes pod name", "Type": "String", "Entity": null }, { "Name": "KubernetesResource", "Description": "Unique identifier for the Kubernetes resource that includes the namespace, resource type and name", "Type": "String", "Entity": null }, { "Name": "ContainerName", "Description": "Name of the container in Kubernetes or another runtime environment", "Type": "String", "Entity": null }, { "Name": "ContainerId", "Description": "The container identifier in Kubernetes or another runtime environment", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "Int64", "Entity": null }, { "Name": "ProcessName", "Description": "The name of the process", "Type": "String", "Entity": null }, { "Name": "ParentProcessName", "Description": "The name of the parent process", "Type": "String", "Entity": null }, { "Name": "ParentProcessId", "Description": "The process ID (PID) of the parent process", "Type": "Int64", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "ProcessCreationTime", "Description": "Date and time the process was created", "Type": "DateTime", "Entity": null }, { "Name": "ProcessCurrentWorkingDirectory", "Description": "Current working directory of the running process", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "LogonId", "Description": "Identifier for a logon session. This identifier is unique on the same machine only between restarts", "Type": "Int64", "Entity": null }, { "Name": "InitiatingProcessId", "Description": "Process ID (PID) of the process that initiated the event", "Type": "Int64", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The cluster's region", "Type": "String", "Entity": null }, { "Name": "ImageDigest", "Description": "The container's image digest", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "The agent's id", "Type": "String", "Entity": null }, { "Name": "HostName", "Description": "The node's hostname", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Cloud", "TableSectionName": null }, { "Name": "CloudStorageAggregatedEvents", "TableSource": "defender", "Description": "The CloudStorageAggregatedEvents table contains aggregated and enriched logs for cloud storage resources, providing comprehensive visibility into storage activities to support investigation, monitoring, and security analysis.", "Schema": [ { "Name": "DataAggregationStartTime", "Description": "The start time during which the data was aggregated", "Type": "DateTime", "Entity": null }, { "Name": "DataAggregationEndTime", "Description": "The end time during which the data was aggregated", "Type": "DateTime", "Entity": null }, { "Name": "DataSource", "Description": "The source of the aggregated logs", "Type": "String", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier assigned to the Azure subscription", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "Name of the resource group where the storage account resides", "Type": "String", "Entity": null }, { "Name": "StorageAccount", "Description": "The identifier for the storage account", "Type": "String", "Entity": null }, { "Name": "StorageContainer", "Description": "The identifier for the storage container", "Type": "String", "Entity": null }, { "Name": "StorageFileShare", "Description": "The identifier for the storage file share", "Type": "String", "Entity": null }, { "Name": "ServiceType", "Description": "Specifies the type of storage service (e.g., Blob, ADLS Gen2, Files.REST, Files.SMB)", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "The IP address from which the storage was accessed", "Type": "String", "Entity": null }, { "Name": "UserAgentHeader", "Description": "Details of the user agent accessing the storage (e.g., browser or application)", "Type": "String", "Entity": null }, { "Name": "OperationNamesList", "Description": "A list of storage operations performed (e.g., CreateContainer, DeleteContainer)", "Type": "Object", "Entity": null }, { "Name": "AuthenticationType", "Description": "The authentication method used to access the storage (e.g., AccountKey, SAS, Oauth)", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "The unique identifier of the object making the storage access", "Type": "String", "Entity": null }, { "Name": "AccountTenantId", "Description": "The unique identifier of the Azure tenant", "Type": "String", "Entity": null }, { "Name": "AccountApplicationId", "Description": "The application ID associated with the storage access", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "The user principal name of the accessing user", "Type": "String", "Entity": null }, { "Name": "AccountType", "Description": "The Account type used", "Type": "String", "Entity": null }, { "Name": "OperationsCount", "Description": "The total number of storage operations performed", "Type": "Int64", "Entity": null }, { "Name": "SuccessfulOperationsCount", "Description": "The count of successful storage operations", "Type": "Int64", "Entity": null }, { "Name": "FailedOperationsCount", "Description": "The count of failed storage operations", "Type": "Int64", "Entity": null }, { "Name": "TotalResponseLength", "Description": "The total response length of all GET operations during the aggregation period", "Type": "Int64", "Entity": null }, { "Name": "SuccessfulReadOperations", "Description": "The count of successful read operations", "Type": "Int64", "Entity": null }, { "Name": "DistinctGetOperations", "Description": "The count of distinct GET operations performed", "Type": "Int64", "Entity": null }, { "Name": "AnonymousSuccessfulOperations", "Description": "The count of successful anonymous operations", "Type": "Int64", "Entity": null }, { "Name": "HasAnonymousResourceNotFoundFailures", "Description": "Indicates whether anonymous resource not found failures occurred", "Type": "Boolean", "Entity": null }, { "Name": "Md5Hashes", "Description": "A list of MD5 hash reputations for the accessed resources", "Type": "Object", "Entity": null }, { "Name": "AzureResourceId", "Description": "The Azure Resource ID of the storage account", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "The location of the storage account (region)", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Guid to identify the record in the specific table", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of action (aggragated logs)", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Cloud", "TableSectionName": null }, { "Name": "CloudKeyVaultEvents", "TableSource": "defender", "Description": "The CloudKeyVaultEvents table contains raw logs for Azure Key Vault resources, providing detailed per-operation visibility into key vault activities to support investigation, monitoring, and security analysis.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Guid to identify the record in the specific table", "Type": "String", "Entity": null }, { "Name": "DataSource", "Description": "The source of the key vault logs", "Type": "String", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier assigned to the Azure subscription", "Type": "String", "Entity": null }, { "Name": "AzureResourceId", "Description": "The Azure Resource ID of the Key Vault", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "The location of the Key Vault (region)", "Type": "String", "Entity": null }, { "Name": "ActivityName", "Description": "The name of the Key Vault activity performed", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "The IP address from which the Key Vault was accessed", "Type": "String", "Entity": null }, { "Name": "HttpStatusCode", "Description": "HTTP status code returned by the Key Vault operation", "Type": "Int32", "Entity": null }, { "Name": "ResultSignature", "Description": "The result signature of the Key Vault operation", "Type": "String", "Entity": null }, { "Name": "AccountTenantId", "Description": "The unique identifier of the Azure tenant", "Type": "String", "Entity": null }, { "Name": "AccountApplicationId", "Description": "The application ID associated with the Key Vault access", "Type": "String", "Entity": null }, { "Name": "AccountType", "Description": "The account type used (e.g., app, user)", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "The unique identifier of the object making the Key Vault access", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "The user principal name of the accessing user", "Type": "String", "Entity": null }, { "Name": "RequestUri", "Description": "The URI of the Key Vault request", "Type": "String", "Entity": null }, { "Name": "VaultName", "Description": "Name of the Key Vault", "Type": "String", "Entity": null }, { "Name": "UserAgentHeader", "Description": "The user agent string from the HTTP request", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Cloud", "TableSectionName": null }, { "Name": "CloudPolicyEnforcementEvents", "TableSource": "defender", "Description": "The CloudPolicyEnforcementEvents table contains policy enforcement events, providing comprehensive visibility into policy enforcement action of security gating events.", "Schema": [ { "Name": "TenantId", "Description": "The tenant ID associated with the policy enforcement event", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "DataSource", "Description": "Data source of the cloud events; possible values: Google Kubernetes Engine, Elastic Kubernetes Service, or Azure Kubernetes Service", "Type": "String", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier assigned to the Azure subscription", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that resulted from the policy enforcement operation; possible values: Audit, Deny, or Allow", "Type": "String", "Entity": null }, { "Name": "AzureResourceId", "Description": "Unique identifier of the Azure resource associated with the event", "Type": "String", "Entity": null }, { "Name": "AwsResourceName", "Description": "Unique identifier specific to Amazon Web Services devices, containing the Amazon resource name", "Type": "String", "Entity": null }, { "Name": "GcpFullResourceName", "Description": "Unique identifier specific to Google Cloud Platform devices, containing a combination of zone and ID for GCP", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The region associated with the Kubernetes cluster", "Type": "String", "Entity": null }, { "Name": "ResourceKind", "Description": "Type or kind of Kubernetes resource created or managed (for example, pod or deployment)", "Type": "String", "Entity": null }, { "Name": "ResourceName", "Description": "Name of the Kubernetes resource", "Type": "String", "Entity": null }, { "Name": "KubernetesNamespace", "Description": "The Kubernetes namespace name", "Type": "String", "Entity": null }, { "Name": "Reason", "Description": "Information explaining the action result", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Cloud", "TableSectionName": null }, { "Name": "CloudDnsEvents", "TableSource": "defender", "Description": "The CloudDnsEvents table in the advanced hunting schema contains information about DNS activity events from cloud infrastructure environments. Use this reference to construct queries that return information from this table.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "AzureResourceId", "Description": "The Azure Resource ID associated with the DNS event", "Type": "String", "Entity": null }, { "Name": "AwsResourceName", "Description": "The AWS resource name associated with the DNS event", "Type": "String", "Entity": null }, { "Name": "GcpFullResourceName", "Description": "The full GCP resource name associated with the DNS event", "Type": "String", "Entity": null }, { "Name": "KubernetesResource", "Description": "Unique identifier for the Kubernetes resource that includes the namespace, resource type and name", "Type": "String", "Entity": null }, { "Name": "KubernetesNamespace", "Description": "The Kubernetes namespace name", "Type": "String", "Entity": null }, { "Name": "KubernetesPodName", "Description": "The Kubernetes pod name", "Type": "String", "Entity": null }, { "Name": "ContainerName", "Description": "Name of the container in Kubernetes or another runtime environment", "Type": "String", "Entity": null }, { "Name": "ContainerId", "Description": "The container identifier in Kubernetes or another runtime environment", "Type": "String", "Entity": null }, { "Name": "ImageName", "Description": "The container image name or id", "Type": "String", "Entity": null }, { "Name": "ProcessName", "Description": "The command that performed the DNS query/response", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "The process ID that initiated the DNS query/response", "Type": "Int64", "Entity": null }, { "Name": "EventType", "Description": "Indicates the operation reported by the record", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Either 'request' or 'response'", "Type": "String", "Entity": null }, { "Name": "DnsQuery", "Description": "The domain that the request tries to resolve", "Type": "String", "Entity": null }, { "Name": "DnsQueryTypeName", "Description": "The DNS Resource Record Type names", "Type": "String", "Entity": null }, { "Name": "DnsResponseCodeName", "Description": "For DNS events, this field provides the DNS response code", "Type": "String", "Entity": null }, { "Name": "DnsNetworkDuration", "Description": "The amount of time, in milliseconds, for the completion of DNS request", "Type": "Int64", "Entity": null }, { "Name": "TransactionIdHex", "Description": "The DNS query unique ID as assigned by the DNS client, in hexadecimal format", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Cloud", "TableSectionName": null }, { "Name": "ExposureGraphNodes", "TableSource": "defender", "Description": "Contains organizational entities such as devices, users, user groups and virtual machines (VMs), along with their respective properties. Each node corresponds to an individual entity and encapsulates information about its characteristics and attributes within the organizational structure.", "Schema": [ { "Name": "NodeId", "Description": "Unique node identifier", "Type": "String", "Entity": null }, { "Name": "NodeLabel", "Description": "Label of node", "Type": "String", "Entity": null }, { "Name": "NodeName", "Description": "Node display name", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "Categories of the node", "Type": "Object", "Entity": null }, { "Name": "NodeProperties", "Description": "Properties of the node, including insights related to the resource, such as whether the resource is exposed to the internet, or vulnerable to remote code execution", "Type": "Object", "Entity": null }, { "Name": "EntityIds", "Description": "All known node identifiers", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Xspm", "TableSectionName": null }, { "Name": "ExposureGraphEdges", "TableSource": "defender", "Description": "Represents the relationships between the nodes in the graph. It contains edges connecting the organizational entities such as devices, identities, and virtual machines (VMs). These edges capture the various types of relationships that exist between the nodes, reflecting dependencies, associations, or interactions within the organizational context.", "Schema": [ { "Name": "EdgeId", "Description": "Unique edge id Unique identifier for the relationship/edge", "Type": "String", "Entity": null }, { "Name": "EdgeLabel", "Description": "Label of edge", "Type": "String", "Entity": null }, { "Name": "SourceNodeId", "Description": "Node ID of the edge's source", "Type": "String", "Entity": null }, { "Name": "SourceNodeName", "Description": "Display name of source node", "Type": "String", "Entity": null }, { "Name": "SourceNodeLabel", "Description": "Label of the edge source node", "Type": "String", "Entity": null }, { "Name": "SourceNodeCategories", "Description": "Categories of the source node", "Type": "Object", "Entity": null }, { "Name": "TargetNodeId", "Description": "Node ID of the edge's target", "Type": "String", "Entity": null }, { "Name": "TargetNodeName", "Description": "Display name of target node", "Type": "String", "Entity": null }, { "Name": "TargetNodeLabel", "Description": "Label of the edge target node", "Type": "String", "Entity": null }, { "Name": "TargetNodeCategories", "Description": "Categories of the target node", "Type": "Object", "Entity": null }, { "Name": "EdgeProperties", "Description": "Optional data relevant for the relationship between the nodes", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Xspm", "TableSectionName": null }, { "Name": "ExposureRecommendations", "TableSource": "defender", "Description": "Exposure Management unified security recommendations for assets discovered across Microsoft security products. Each row is a recommendation for an asset, including its status, severity, and remediation guidance.", "Schema": [ { "Name": "AssessmentKey", "Description": "Stable id of the assessment type (unique per recommendation logic). If not provided, it will be calculated based on AssessmentTypeId.", "Type": "String", "Entity": null }, { "Name": "AssessmentTypeId", "Description": "The provider's unique type id for the assessment.", "Type": "String", "Entity": null }, { "Name": "ReportTime", "Description": "Date and time when the record was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AssetType", "Description": "Type of asset identification.", "Type": "String", "Entity": null }, { "Name": "AssetName", "Description": "Display name of the asset.", "Type": "String", "Entity": null }, { "Name": "AssetId", "Description": "Unique identifier for the asset the recommendation applies to.", "Type": "String", "Entity": null }, { "Name": "Identifiers", "Description": "All known identifiers of the asset.", "Type": "Object", "Entity": null }, { "Name": "StatusCode", "Description": "The recommendation health status of the asset. Possible values are Healthy, Unhealthy and NotApplicable.", "Type": "String", "Entity": null }, { "Name": "StatusReason", "Description": "Status code reasoning information.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (Critical, high, medium, or low) of the recommendation.", "Type": "String", "Entity": null }, { "Name": "Title", "Description": "Title of the recommendation.", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered.", "Type": "String", "Entity": null }, { "Name": "RemediationSteps", "Description": "The remediation steps of the recommendation.", "Type": "String", "Entity": null }, { "Name": "ProductName", "Description": "Defender workload/product.", "Type": "String", "Entity": null }, { "Name": "ProductComponentNames", "Description": "Defender service / plan / sub-domain related to the product.", "Type": "Object", "Entity": null }, { "Name": "EnvironmentType", "Description": "Platform / environment type.", "Type": "String", "Entity": null }, { "Name": "FindingType", "Description": "Type of posture finding.", "Type": "String", "Entity": null }, { "Name": "MitreTactics", "Description": "MITRE ATT&CK / ATLAS tactic ids associated with the recommendation.", "Type": "Object", "Entity": null }, { "Name": "MitreTechniques", "Description": "MITRE ATT&CK / ATLAS technique ids associated with the recommendation.", "Type": "Object", "Entity": null }, { "Name": "IsPreview", "Description": "True when the recommendation is in preview; false when generally available.", "Type": "Boolean", "Entity": null }, { "Name": "SupportingEvidence", "Description": "Supporting evidence for the recommendation.", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional fields for this recommendation.", "Type": "Object", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Xspm", "TableSectionName": null }, { "Name": "DataSecurityBehaviors", "TableSource": "", "Description": "Information about suspicious user behaviors that violated customer-defined or default policies configured in the Microsoft Purview suite of solutions.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "BehaviorId", "Description": "Unique identifier for the behavior", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "ServiceSource", "Description": "Product or service that provided the alert information", "Type": "String", "Entity": null }, { "Name": "ActionCategory", "Description": "Category of action that triggered the event", "Type": "String", "Entity": null }, { "Name": "DetectionSource", "Description": "Detection technology or sensor that identified the notable component or activity", "Type": "String", "Entity": null }, { "Name": "ActivityCount", "Description": "Total user activity events recorded under this behavior", "Type": "Int32", "Entity": null }, { "Name": "IsAnomalous", "Description": "Indicates if this user behavior is anomalous by itself or based on insider risk management global settings", "Type": "Boolean", "Entity": null }, { "Name": "IsContentHidden", "Description": "Indicates if the behavior involves hidden content on a device", "Type": "Boolean", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountEmail", "Description": "Email address of the account", "Type": "String", "Entity": null }, { "Name": "UrlDomainInfo", "Description": "Details about the websites or service URLs involved in the event", "Type": "Object", "Entity": null }, { "Name": "IsUnderIrmPolicy", "Description": "Indicates if this behavior is detected based on a Microsoft Purview Insider Risk Management policy", "Type": "Boolean", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "DeviceInfo", "Description": "List of device information for the device involved in this behavior, including device ID, device name, and the number of events in which the device is involved", "Type": "Object", "Entity": null }, { "Name": "SensitivityLabelInfo", "Description": "List of sensitivity labels assigned to content involed in this behavior, including the unique identifier for the Microsoft Information Protection sensitivity label assigned to the related content, the name of the sensitivity label, and the number of events in the behavior involving this label", "Type": "Object", "Entity": null }, { "Name": "SensitiveInfoTypesInfo", "Description": "List of sensitive info types detected in the content involved in this behavior, including the unique identifier for the sensitive info type, the name of the sensitive info type, and the number of events in the behavior involving this sensitive info type", "Type": "Object", "Entity": null }, { "Name": "SharepointSiteInfo", "Description": "List of SharePoint sites involved in this behavior, including the unique identifier for the SharePoint site, the name of the SharePoint site, and the number of events in the behavior involving the SharePoint site", "Type": "Object", "Entity": null }, { "Name": "RemovableMediaInfo", "Description": "List of any removable media involved in the behavior, including the serial number of the removable media deivce, the manufacturer of the removable media device, and the model of the removable device", "Type": "Object", "Entity": null }, { "Name": "PolicyMatchInfo", "Description": "List of insider risk management policy matches with this behavior, including the unique identifier and the name of the policy configured in Microsoft Insider Risk Management, the number of events in this behavior that matches priority content defined in the insider risk management policy, and the risk score assigned to this behavior by specific policies", "Type": "Object", "Entity": null }, { "Name": "AttackTechniques", "Description": "MITRE ATT&CK techniques associated with the activity that triggered the alert", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "List of categories that the information belongs to, in JSON array format", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "RecipientEmailInfo", "Description": "List of information about the recipient involved in the behavior, including the email address of the recipient and the number of events in the behavior involving the recipient", "Type": "Object", "Entity": null }, { "Name": "PrinterName", "Description": "List of printers involved in the behavior", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "DataSecurityEvents", "TableSource": "", "Description": "Information about user activities that violate customer-defined or default policies in the Microsoft Purview suite of solutions.", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "EventTime", "Description": "Indicates the timestamp of when the event occurred", "Type": "DateTime", "Entity": null }, { "Name": "ApplicationNames", "Description": "List of application names used or related to the event", "Type": "String", "Entity": null }, { "Name": "DlpPolicyMatchInfo", "Description": "Information around the list of data loss prevention (DLP) policies matching this event", "Type": "Object", "Entity": null }, { "Name": "DlpPolicyEnforcementMode", "Description": "Indicates the Data Loss Prevention policy that was enforced; value can be: 0 (None), 1 (Audit), 2 (Warn), 3 (Warn and bypass), 4 (Block), 5 (Allow)", "Type": "Int32", "Entity": null }, { "Name": "DlpPolicyRuleMatchInfo", "Description": "Details of the data loss prevention (DLP) rules that matched with this event", "Type": "Object", "Entity": null }, { "Name": "FileRenameInfo", "Description": "Details of the file (file name and extension) prior to this event", "Type": "Object", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "Department", "Description": "Name of the department that the account user belongs to", "Type": "String", "Entity": null }, { "Name": "SourceCodeInfo", "Description": "Details of the source code repository involved in the event", "Type": "Object", "Entity": null }, { "Name": "CcPolicyMatchInfo", "Description": "Details of the Communications Compliance policy matches for this event", "Type": "Object", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": null }, { "Name": "DeviceSourceLocationType", "Description": "Indicates the type of location where the endpoint signals originated from; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)", "Type": "String", "Entity": null }, { "Name": "DeviceDestinationLocationType", "Description": "Indicates the type of location where the endpoint signals connected to; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)", "Type": "String", "Entity": null }, { "Name": "IrmPolicyMatchInfo", "Description": "Details of Insider Risk Management policy matches for the content involved in the event", "Type": "Object", "Entity": null }, { "Name": "UnallowedUrlDomains", "Description": "Websites or service URLs involved in this event that are configured as Unallowed in Insider Risk Management global settings", "Type": "String", "Entity": null }, { "Name": "ExternalUrlDomains", "Description": "Websites or service URLs involved in this event that are classified as External in Insider Risk Management global settings", "Type": "String", "Entity": null }, { "Name": "UrlDomainInfo", "Description": "Details about the websites or service URLs involved in the event", "Type": "Object", "Entity": null }, { "Name": "SourceUrlDomain", "Description": "Domain where the device and email signals originated", "Type": "String", "Entity": null }, { "Name": "TargetUrlDomain", "Description": "Domain where the content was shared with or the user has browsed to", "Type": "String", "Entity": null }, { "Name": "InternetMessageId", "Description": "Public-facing identifier for the email that is set by the sending email system", "Type": "String", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "EmailSubject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActivityId", "Description": "Unique identifier of the activity log", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "SensitiveInfoTypeInfo", "Description": "Details of Data Loss Prevention sensitive info types detected in the impacted asset", "Type": "Object", "Entity": null }, { "Name": "SensitivityLabelId", "Description": "The current Microsoft Information Protection sensitivity label ID associated with the item", "Type": "String", "Entity": null }, { "Name": "SharepointSiteSensitivityLabelId", "Description": "The current Microsoft Information Protection sensitivity label ID assigned to the parent site of the item related to SharePoint activities", "Type": "String", "Entity": null }, { "Name": "PreviousSensitivityLabelId", "Description": "The previous Microsoft Information Protection sensitivity label ID associated with the item in case of activities where the sensitivity label was changed", "Type": "String", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "String", "Entity": null }, { "Name": "Recipients", "Description": "List of information about the recipient involved in the behavior, including the email address of the recipient and the number of events in the behavior involving the recipient", "Type": "String", "Entity": null }, { "Name": "SourceRelativeUrl", "Description": "The URL of the folder that contains the file accessed by the user", "Type": "String", "Entity": null }, { "Name": "TargetFilePath", "Description": "Target file path of endpoint activities", "Type": "String", "Entity": null }, { "Name": "PrinterName", "Description": "List of printers involved in the behavior", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "IrmActionCategory", "Description": "A unique enumeration value indicating the activity category in Microsoft Purview Insider Risk Management", "Type": "String", "Entity": null }, { "Name": "DeviceInfo", "Description": "List of device information for the device involved in this behavior, including device ID, device name, and the number of events in which the device is involved", "Type": "Object", "Entity": null }, { "Name": "PhysicalAccessPointInfo", "Description": "Information about the physical access in the event, including the physical access point's unique identifier, name, status, and the tag assigned to the asset", "Type": "Object", "Entity": null }, { "Name": "RemovableMediaInfo", "Description": "List of any removable media involved in the behavior, including the serial number of the removable media deivce, the manufacturer of the removable media device, and the model of the removable device", "Type": "Object", "Entity": null }, { "Name": "TeamsChannelInfo", "Description": "Information about the Teams channel involved in the event", "Type": "Object", "Entity": null }, { "Name": "ContentInfo", "Description": "Information about the content involved in the event", "Type": "Object", "Entity": null }, { "Name": "ParentContentInfo", "Description": "Information about the parent content of the content involved in the event", "Type": "Object", "Entity": null }, { "Name": "IrmSequenceInfo", "Description": "Information about the sequence of activities in the event", "Type": "Object", "Entity": null }, { "Name": "AlertInfo", "Description": "Information about the alert to which the activity is a part of", "Type": "Object", "Entity": null }, { "Name": "UserAlternateEmails", "Description": "Alternate emails or aliases of the user", "Type": "String", "Entity": null }, { "Name": "RiskyAIUsageAppCategory", "Description": "Details of the category of the application involved in the risky AI usage event", "Type": "String", "Entity": null }, { "Name": "RiskyAIUsageAccessedResourceInfo", "Description": "Details of the resources accessed or referenced by the application involved in the risky AI usage event", "Type": "Object", "Entity": null }, { "Name": "RiskyAIUsageSensitivityLabelsInfo", "Description": "Information regarding the sensitivity labels of entities involved in the risky AI usage event", "Type": "Object", "Entity": null }, { "Name": "AttachmentInfo", "Description": "Details of attachments", "Type": "Object", "Entity": null }, { "Name": "IsIrmInteresting", "Description": "Indicates if the event is included in insider risk alerts (true) or not (false)", "Type": "Boolean", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "ConnectorStatusInfo", "TableSource": "defender", "Description": "The ConnectorStatusInfo table includes information regarding the status and the health of the connector", "Schema": [ { "Name": "TimeGenerated", "Description": "The time (in UTC) at which the connection health status event occurred.", "Type": "DateTime", "Entity": null }, { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SentinelWorkspaceId", "Description": "Unique identifier of the Microsoft Sentinel workspace into which the data connector ingests data, if applicable.", "Type": "String", "Entity": null }, { "Name": "ConnectorId", "Description": "Unique identifier for the Microsoft Sentinel data connector.", "Type": "String", "Entity": null }, { "Name": "InstanceId", "Description": "Unique identifier for an instance of the data connector.", "Type": "String", "Entity": null }, { "Name": "MessageType", "Description": "Type of message; possible values are: Status change message, Periodic failure report message, or Current status message", "Type": "String", "Entity": null }, { "Name": "CurrentConnectionStatus", "Description": "Current connection status of the data connector; possible values: OK, Error, Warning, or Validating.", "Type": "String", "Entity": null }, { "Name": "PreviousConnectionStatus", "Description": "Previous connection status of the data connector if the message indicates a status change; possible values: OK, Error, Warning, or Validating.", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "More information about the message.", "Type": "String", "Entity": null }, { "Name": "InternalMessageCode", "Description": "The internal message code (for internal use only).", "Type": "String", "Entity": null }, { "Name": "ConnectorName", "Description": "Display name of the data connector.", "Type": "String", "Entity": null }, { "Name": "InstanceName", "Description": "Display name of the data connector instance.", "Type": "String", "Entity": null }, { "Name": "ConnectionName", "Description": "Display name of the connection.", "Type": "String", "Entity": null }, { "Name": "ProtectionTypes", "Description": "The types of protection provided by the product or service being ingested by the data connector.", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "Timestamp", "Description": "The time (in UTC) at which the connection health status event occurred.", "Type": "DateTime", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Health", "TableSectionName": null }, { "Name": "DeviceAlertEvents", "TableSource": "", "Description": "Alerts on Microsoft Defender Security Center", "Schema": [ { "Name": "AlertId", "Description": "Unique identifier for the alert", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RemoteUrl", "Description": "URL or fully qualified domain name (FQDN) that was being connected to", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": null }, { "Name": "AttackTechniques", "Description": "MITRE ATT&CK techniques associated with the activity that triggered the alert", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.", "Type": "Int64", "Entity": null }, { "Name": "Table", "Description": "Indicates the table in which the event's data is located", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "ThreatIntelEntities", "TableSource": "defender", "Description": "The ThreatIntelEntities table contains threat intelligence indicators, including indicators of compromise (IOCs) such as IP addresses, URLs, and file hashes.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique identifier for the threat intelligence entity document", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "Source system that provided the threat intelligence entity", "Type": "String", "Entity": null }, { "Name": "LastUpdateMethod", "Description": "Method used for the most recent update to the indicator", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional fields associated with the indicator in dynamic format", "Type": "Object", "Entity": null }, { "Name": "Data", "Description": "Raw indicator data in dynamic format", "Type": "Object", "Entity": null }, { "Name": "IsActive", "Description": "Indicates whether the indicator is currently active", "Type": "Boolean", "Entity": null }, { "Name": "Revoked", "Description": "Indicates whether the indicator has been revoked by its source", "Type": "Boolean", "Entity": null }, { "Name": "ValidUntil", "Description": "Date and time until which the indicator is considered valid", "Type": "DateTime", "Entity": null }, { "Name": "ValidFrom", "Description": "Date and time from which the indicator is considered valid", "Type": "DateTime", "Entity": null }, { "Name": "Created", "Description": "Date and time when the indicator was created", "Type": "DateTime", "Entity": null }, { "Name": "Modified", "Description": "Date and time when the indicator was last modified", "Type": "DateTime", "Entity": null }, { "Name": "Tags", "Description": "Tags associated with the indicator", "Type": "Object", "Entity": null }, { "Name": "Confidence", "Description": "Confidence score of the indicator (0-100)", "Type": "Int32", "Entity": null }, { "Name": "Pattern", "Description": "STIX pattern expression for the indicator (e.g., [ipv4-addr:value = '1.2.3.4'])", "Type": "String", "Entity": null }, { "Name": "ObservableKey", "Description": "Observable type extracted from the pattern (e.g., ipv4-addr:value, domain-name:value, network-traffic:src_ref.value)", "Type": "String", "Entity": null }, { "Name": "ObservableValue", "Description": "Observable value extracted from the pattern (e.g., an IP address, domain, or URL)", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "Type of the record, indicating the source table name", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "ThreatIntelligence", "TableSectionName": null }, { "Name": "EntraIdSignInEvents", "TableSource": "defender", "Description": "Information about Microsoft Entra ID sign-in events either by a user (interactive) or a client on the user's behalf (non-interactive)", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "String", "Entity": null }, { "Name": "LogonType", "Description": "Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service", "Type": "String", "Entity": null }, { "Name": "EndpointCall", "Description": "Information about the Microsoft Entra ID endpoint that the request was sent to and the type of request sent during sign in", "Type": "String", "Entity": null }, { "Name": "ErrorCode", "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Type": "Int32", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "AccountDisplayName", "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "IsExternalUser", "Description": "Indicates whether a user inside the network does not belong to the organization’s domain", "Type": "Int32", "Entity": null }, { "Name": "IsGuestUser", "Description": "Indicates whether the user that signed in is a guest in the tenant", "Type": "Boolean", "Entity": null }, { "Name": "AlternateSignInName", "Description": "On-premises user principal name (UPN) of the user signing in to Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "LastPasswordChangeTimestamp", "Description": "Date and time when the user that signed in last changed their password", "Type": "DateTime", "Entity": null }, { "Name": "ResourceDisplayName", "Description": "Display name of the resource accessed. The display name can contain any character.", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceTenantId", "Description": "Unique identifier of the tenant of the resource accessed", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "OSPlatform", "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Type": "String", "Entity": null }, { "Name": "DeviceTrustType", "Description": "Indicates the trust type of the device that signed in. For managed device scenarios only. Possible values are Workplace, AzureAd, and ServerAd.", "Type": "String", "Entity": null }, { "Name": "IsManaged", "Description": "Indicates if the device is managed by the organization (True) or not (False)", "Type": "Int32", "Entity": null }, { "Name": "IsCompliant", "Description": "Indicates whether the device that initiated the event is compliant or not", "Type": "Int32", "Entity": null }, { "Name": "AuthenticationProcessingDetails", "Description": "Details about the authentication processor", "Type": "String", "Entity": null }, { "Name": "AuthenticationRequirement", "Description": "Type of authentication required for the sign-in. Possible values: multiFactorAuthentication (MFA was required) and singleFactorAuthentication (no MFA was required).", "Type": "String", "Entity": null }, { "Name": "TokenIssuerType", "Description": "Indicates if the token issuer is Microsoft Entra ID (0) or Active Directory Federation Services (1)", "Type": "String", "Entity": null }, { "Name": "RiskLevelAggregated", "Description": "Aggregated risk level during sign-in. Possible values: 0 (aggregated risk level not set), 1 (none), 10 (low), 50 (medium), or 100 (high).", "Type": "Int32", "Entity": null }, { "Name": "RiskLevelDuringSignIn", "Description": "User risk level at sign-in", "Type": "Int32", "Entity": null }, { "Name": "RiskEventTypes", "Description": "Array of risk event types applicable to the event", "Type": "String", "Entity": null }, { "Name": "RiskState", "Description": "Indicates risky user state. Possible values: 0 (none), 1 (confirmed safe), 2 (remediated), 3 (dismissed), 4 (at risk), or 5 (confirmed compromised).", "Type": "Int32", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "ClientAppUsed", "Description": "Indicates the client app used", "Type": "String", "Entity": null }, { "Name": "Browser", "Description": "Details about the version of the browser used to sign in", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessPolicies", "Description": "Details of the conditional access policies applied to the sign-in event", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessStatus", "Description": "Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).", "Type": "Int32", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": "Ip" }, { "Name": "Country", "Description": "Country/Region where the account user is located", "Type": "String", "Entity": null }, { "Name": "State", "Description": "State where the sign-in occurred, if available", "Type": "String", "Entity": null }, { "Name": "City", "Description": "City where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "Latitude", "Description": "The north to south coordinates of the sign-in location", "Type": "String", "Entity": null }, { "Name": "Longitude", "Description": "The east to west coordinates of the sign-in location", "Type": "String", "Entity": null }, { "Name": "NetworkLocationDetails", "Description": "Network location details of the authentication processor of the sign-in event", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "EntraIdDeviceId", "Description": "Unique identifier for the device in Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "UniqueTokenId", "Description": "A unique identifier for the token passed during sign-in. This identifier is used to correlate the sign-in with the token request.", "Type": "String", "Entity": null }, { "Name": "IsSignInThroughGlobalSecureAccess", "Description": "Indicates whether the sign-in event came through Global Secure Access.", "Type": "Boolean", "Entity": null }, { "Name": "GatewayJA4", "Description": "The JA4 fingerprint is a hash derived from the TLS Client Hello request. This JA4 fingerprint serves as a unique identifier for the client's TLS configuration.", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "EntraIdSpnSignInEvents", "TableSource": "defender", "Description": "Information about sign-in events initiated by Microsoft Entra ID service principal or managed identities", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "String", "Entity": null }, { "Name": "IsManagedIdentity", "Description": "Indicates whether the sign-in was initiated by a managed identity", "Type": "Boolean", "Entity": null }, { "Name": "ErrorCode", "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Type": "Int32", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalName", "Description": "Name of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "ResourceDisplayName", "Description": "Display name of the resource accessed. The display name can contain any character.", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceTenantId", "Description": "Unique identifier of the tenant of the resource accessed", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": "Ip" }, { "Name": "Country", "Description": "Country/Region where the account user is located", "Type": "String", "Entity": null }, { "Name": "State", "Description": "State where the sign-in occurred, if available", "Type": "String", "Entity": null }, { "Name": "City", "Description": "City where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "Latitude", "Description": "The north to south coordinates of the sign-in location", "Type": "String", "Entity": null }, { "Name": "Longitude", "Description": "The east to west coordinates of the sign-in location", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "IsConfidentialClient", "Description": "Indicates if the sign in was done via confidential client applications", "Type": "Boolean", "Entity": null }, { "Name": "GatewayJA4", "Description": "The JA4 fingerprint is a hash derived from the TLS Client Hello request. This JA4 fingerprint serves as a unique identifier for the client's TLS configuration.", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "UniqueTokenId", "Description": "A unique identifier for the token passed during sign-in. This identifier is used to correlate the sign-in with the token request.", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "GraphAPIAuditEvents", "TableSource": "defender", "Description": "Microsoft Graph API events provide details of API requests made to Microsoft Graph for resources in the tenant", "Schema": [ { "Name": "IdentityProvider", "Description": "Identity provider that authenticated the subject of the token", "Type": "String", "Entity": null }, { "Name": "ApiVersion", "Description": "The API version of the event", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "String", "Entity": null }, { "Name": "ClientRequestId", "Description": "Identifier for the client request sent; if none is available, the operation identifier is used instead", "Type": "String", "Entity": null }, { "Name": "OperationId", "Description": "Identifier for a batch of requests; the same identifier is used for all requests in a batch but if requests are non-batched, the identifier is unique per request", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "RequestDuration", "Description": "Duration of the request in milliseconds", "Type": "String", "Entity": null }, { "Name": "RequestMethod", "Description": "HTTP method of the request", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ResponseStatusCode", "Description": "HTTP response status code for the request", "Type": "String", "Entity": null }, { "Name": "Scopes", "Description": "Scopes in token claims", "Type": "String", "Entity": null }, { "Name": "EntityType", "Description": "Type of object, such as a file, a process, a device, or a user", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "RequestUri", "Description": "Uniform resource identifier (URI) of the request", "Type": "String", "Entity": null }, { "Name": "UniqueTokenIdentifier", "Description": "Unique identifier embedded in every access token and ID token that were issued", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "IpAddress", "Description": "IP address that the attacker attempted to access", "Type": "String", "Entity": "Ip" }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "TargetWorkload", "Description": "The target workload (for example, Microsoft.Exchange, Microsoft.SharePoint) the API call was made to.", "Type": "String", "Entity": null }, { "Name": "ResponseSize", "Description": "The size of the response in bytes.", "Type": "Int64", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "BehaviorInfo", "TableSource": "defender", "Description": "Contains information about behaviors, which in the context of Microsoft Defender XDR refers to a conclusion or insight based on one or more raw events, which can provide analysts more context in investigations", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "BehaviorId", "Description": "Unique identifier for the behavior", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of behavior", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of behavior", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "Type of threat indicator or breach activity identified by the behavior", "Type": "String", "Entity": null }, { "Name": "AttackTechniques", "Description": "MITRE ATT&CK techniques associated with the activity that triggered the behavior", "Type": "String", "Entity": null }, { "Name": "ServiceSource", "Description": "Product or service that identified the behavior", "Type": "String", "Entity": null }, { "Name": "DetectionSource", "Description": "Detection technology or sensor that identified the notable component or activity", "Type": "String", "Entity": null }, { "Name": "DataSources", "Description": "Products or services that provided information for the behavior", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the behavior", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "Insights", "Description": "Insights related to the behavior.", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "AlertsAndObservations", "TableSectionName": null }, { "Name": "BehaviorEntities", "TableSource": "defender", "Description": "Contains information about entities (file, process, device, user, and others) that are involved in a behavior", "Schema": [ { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "BehaviorId", "Description": "Unique identifier for the behavior", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of behavior", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "Type of threat indicator or breach activity identified by the behavior", "Type": "String", "Entity": null }, { "Name": "ServiceSource", "Description": "Product or service that identified the behavior", "Type": "String", "Entity": null }, { "Name": "DetectionSource", "Description": "Detection technology or sensor that identified the notable component or activity", "Type": "String", "Entity": null }, { "Name": "DataSources", "Description": "Products or services that provided information for the behavior", "Type": "String", "Entity": null }, { "Name": "EntityType", "Description": "Type of object, such as a file, a process, a device, or a user", "Type": "String", "Entity": null }, { "Name": "EntityRole", "Description": "Indicates whether the entity is impacted or merely related", "Type": "String", "Entity": null }, { "Name": "DetailedEntityRole", "Description": "The role of the entity in the behavior", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": "File" }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "ThreatFamily", "Description": "Malware family that the suspicious or malicious file or process has been classified under", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": "Ip" }, { "Name": "RemoteUrl", "Description": "URL or fully qualified domain name (FQDN) that was being connected to", "Type": "String", "Entity": "Url" }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": "UserSid" }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": "UserObjectId" }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": "Machine" }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": "Machine" }, { "Name": "LocalIP", "Description": "IP address assigned to the local machine used during communication", "Type": "String", "Entity": "Ip" }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "EmailSubject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "EmailClusterId", "Description": "Identifier for the group of similar emails clustered based on heuristic analysis of their contents", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "Int32", "Entity": null }, { "Name": "OAuthApplicationId", "Description": "Unique identifier of the third-party OAuth application", "Type": "String", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "RegistryKey", "Description": "Registry key that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueName", "Description": "Name of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueData", "Description": "Data of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the behavior", "Type": "String", "Entity": null }, { "Name": "TenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "MachineGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "CloudResource", "Description": "Cloud resource name", "Type": "String", "Entity": null }, { "Name": "CloudPlatform", "Description": "The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform", "Type": "String", "Entity": null }, { "Name": "CloudResourceType", "Description": "Type of cloud resource.", "Type": "String", "Entity": null }, { "Name": "CloudResourceId", "Description": "Unique identifier of the cloud resource accessed.", "Type": "String", "Entity": null }, { "Name": "CloudSubscriptionId", "Description": "Unique identifier of the cloud service subscription.", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "AlertsAndObservations", "TableSectionName": null }, { "Name": "AADManagedIdentitySignInLogs", "TableSource": "sentinel", "Description": "Managed identity Azure Active Directory sign-in logs.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "Details of source system of the object being provisioned", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time of the event in UTC", "Type": "DateTime", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "OperationVersion", "Description": "The REST API version that's requested by the client", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ResultType", "Description": "Result of the operation. Possible values: Success, Failure", "Type": "String", "Entity": null }, { "Name": "ResultSignature", "Description": "Contains the error code, if any, for the sign-in operation", "Type": "String", "Entity": null }, { "Name": "ResultDescription", "Description": "Additional description of the operation's result", "Type": "String", "Entity": null }, { "Name": "DurationMs", "Description": "The duration of the operation in milliseconds", "Type": "Int64", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "Resource group for the logs", "Type": "String", "Entity": null }, { "Name": "Identity", "Description": "The identity from the token that was presented when you made the request. It can be a user account, system account, or service principal", "Type": "String", "Entity": null }, { "Name": "Level", "Description": "The severity level of the event", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "AADTenantId", "Description": "The AADTenantId GUID that's associated with the logs", "Type": "String", "Entity": null }, { "Name": "Agent", "Description": "Details of agentic sign-in.", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "Unique GUID representing the app ID in the Azure Active Directory", "Type": "String", "Entity": null }, { "Name": "AppOwnerTenantId", "Description": "Specifies the ID of the tenant where the app was registered", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextClassReferences", "Description": "The authentication contexts of the sign-in", "Type": "String", "Entity": null }, { "Name": "AuthenticationProcessingDetails", "Description": "Details about the authentication processor", "Type": "String", "Entity": null }, { "Name": "ClientCredentialType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessAudiences", "Description": "Details of the conditional access audiences being applied for the sign-in.", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessPolicies", "Description": "Details of the conditional access policies applied to the sign-in event", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessStatus", "Description": "Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).", "Type": "String", "Entity": null }, { "Name": "CreatedDateTime", "Description": "Date and time when the account user was created", "Type": "DateTime", "Entity": null }, { "Name": "FederatedCredentialId", "Description": "Th identifier of an application's federated identity credential if a federated identity credential was used to sign in.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": null }, { "Name": "LocationDetails", "Description": "Details of the sign-in location", "Type": "String", "Entity": null }, { "Name": "ManagedServiceIdentity", "Description": "Details of the Managed Service Identity used to Sign In.", "Type": "String", "Entity": null }, { "Name": "NetworkLocationDetails", "Description": "Network location details of the authentication processor of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ResourceDisplayName", "Description": "Display name of the resource accessed. The display name can contain any character.", "Type": "String", "Entity": null }, { "Name": "ResourceIdentity", "Description": "ID of the resource that the service principal signed into", "Type": "String", "Entity": null }, { "Name": "ResourceOwnerTenantId", "Description": "The tenant identifier of the owner of the resource referenced in the sign in", "Type": "String", "Entity": null }, { "Name": "ResourceServicePrincipalId", "Description": "Service Principal Id of the resource", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalCredentialKeyId", "Description": "Key id of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalCredentialThumbprint", "Description": "Thumbprint of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalName", "Description": "Name of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "SourceAppClientId", "Description": "The client ID of the application that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "UniqueTokenIdentifier", "Description": "Unique identifier embedded in every access token and ID token that were issued", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "AADNonInteractiveUserSignInLogs", "TableSource": "sentinel", "Description": "Non-interactive Azure Active Directory sign-in logs from user.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "Details of source system of the object being provisioned.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time of the event in UTC.", "Type": "DateTime", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "OperationVersion", "Description": "The REST API version that's requested by the client.", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ResultType", "Description": "Result of the operation. Possible values: Success, Failure", "Type": "String", "Entity": null }, { "Name": "ResultSignature", "Description": "Contains the error code, if any, for the sign-in operation.", "Type": "String", "Entity": null }, { "Name": "ResultDescription", "Description": "Additional description of the operation's result", "Type": "String", "Entity": null }, { "Name": "DurationMs", "Description": "The duration of the operation in milliseconds.", "Type": "Int64", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "Resource group for the logs.", "Type": "String", "Entity": null }, { "Name": "Identity", "Description": "The identity from the token that was presented when you made the request. It can be a user account, system account, or service principal.", "Type": "String", "Entity": null }, { "Name": "Level", "Description": "The severity level of the event.", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "AADTenantId", "Description": "The AADTenantId GUID that's associated with the logs", "Type": "String", "Entity": null }, { "Name": "Agent", "Description": "Details of agentic sign-in.", "Type": "String", "Entity": null }, { "Name": "AlternateSignInName", "Description": "On-premises user principal name (UPN) of the user signing in to Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "AppDisplayName", "Description": "App name displayed in the Azure portal.", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "Unique GUID representing the app ID in the Azure Active Directory.", "Type": "String", "Entity": null }, { "Name": "AppliedEventListeners", "Description": "Detailed information about the applied event listeners or listeners that are triggered by the corresponding events in an authentication activity. It's called appliedEventListeners in ALP and MSGraph, but use Authentication Events to match name on UX.", "Type": "Object", "Entity": null }, { "Name": "AppOwnerTenantId", "Description": "Specifies the ID of the tenant where the app was registered", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextClassReferences", "Description": "The authentication contexts of the sign-in.", "Type": "String", "Entity": null }, { "Name": "AuthenticationDetails", "Description": "List of pass or fail verdicts by email authentication protocols like DMARC, DKIM, SPF or a combination of multiple authentication types (CompAuth)", "Type": "String", "Entity": null }, { "Name": "AuthenticationMethodsUsed", "Description": "List of authentication methods used.", "Type": "String", "Entity": null }, { "Name": "AuthenticationProcessingDetails", "Description": "Details about the authentication processor", "Type": "String", "Entity": null }, { "Name": "AuthenticationProtocol", "Description": "Authentication protocol that the compromised user used to sign in; possible values: Undefined, NTLM, Kerberos", "Type": "String", "Entity": null }, { "Name": "AuthenticationRequirement", "Description": "Type of authentication required for the sign-in. Possible values: multiFactorAuthentication (MFA was required) and singleFactorAuthentication (no MFA was required).", "Type": "String", "Entity": null }, { "Name": "AuthenticationRequirementPolicies", "Description": "Set of CA policies that apply to this sign-in, each as CA: policy name, and/or MFA: Per-user.", "Type": "String", "Entity": null }, { "Name": "AuthenticatorAppLocation", "Description": "The location of the authenticator app.", "Type": "String", "Entity": null }, { "Name": "AutonomousSystemNumber", "Description": "Autonomous System Number for the network.", "Type": "String", "Entity": null }, { "Name": "ClientAppUsed", "Description": "Indicates the client app used", "Type": "String", "Entity": null }, { "Name": "ClientCredentialType", "Description": "The type of client credential used. Examples include client assertion, client secret, etc.", "Type": "String", "Entity": null }, { "Name": "ClientSessionId", "Description": "The client session ID associated with the sign-in.", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessAudiences", "Description": "Details of the conditional access audiences being applied for the sign-in.", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessPolicies", "Description": "Details of the conditional access policies applied to the sign-in event", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessStatus", "Description": "Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).", "Type": "String", "Entity": null }, { "Name": "CreatedDateTime", "Description": "Date and time when the account user was created", "Type": "DateTime", "Entity": null }, { "Name": "CrossTenantAccessType", "Description": "Describes the type of cross-tenant access used by the actor to access the resource. Possible values are: none, b2bCollaboration, b2bDirectConnect, microsoftSupport, serviceProvider, unknownFutureValue. If the sign in did not cross tenant boundaries, the value is none.", "Type": "String", "Entity": null }, { "Name": "DeviceDetail", "Description": "Details of the device used for the sign-in.", "Type": "String", "Entity": null }, { "Name": "FederatedCredentialId", "Description": "Federated Credential Id.", "Type": "String", "Entity": null }, { "Name": "GlobalSecureAccessIpAddress", "Description": "Global secure IP address that user signed in from.", "Type": "String", "Entity": null }, { "Name": "HomeTenantId", "Description": "The home tenant ID for cross-tenant scenarios.", "Type": "String", "Entity": null }, { "Name": "HomeTenantName", "Description": "The tenant name of the external tenant who homes the entitity taking action in the customer's tenant.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "IncomingTokenType", "Description": "The type of token utilized to signIn (examples: primary refresh token, saml assertion).", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": null }, { "Name": "IsInteractive", "Description": "Indicates if a sign-in is interactive or not.", "Type": "Boolean", "Entity": null }, { "Name": "IsRisky", "Description": "Indicates if a sign-in is considered risky or not.", "Type": "Boolean", "Entity": null }, { "Name": "IsTenantRestricted", "Description": "Indicates if a signIn is under a tenant restrictions policy or not.", "Type": "Boolean", "Entity": null }, { "Name": "IsThroughGlobalSecureAccess", "Description": "Displays whether or not a user came through Global Secure Access service or not.", "Type": "Boolean", "Entity": null }, { "Name": "LocationDetails", "Description": "Details of the sign-in location.", "Type": "String", "Entity": null }, { "Name": "MfaDetail", "Description": "Details of the Multi-factor authentication.", "Type": "String", "Entity": null }, { "Name": "NetworkLocationDetails", "Description": "Network location details of the authentication processor of the sign-in event", "Type": "String", "Entity": null }, { "Name": "OriginalRequestId", "Description": "The request id of the first request in the authentication sequence.", "Type": "String", "Entity": null }, { "Name": "OriginalTransferMethod", "Description": "Transfer method used to initiate a session throughout all subsequent requests.", "Type": "String", "Entity": null }, { "Name": "ProcessingTimeInMs", "Description": "Request processing time in milliseconds in AD STS.", "Type": "String", "Entity": null }, { "Name": "ResourceDisplayName", "Description": "Display name of the resource accessed. The display name can contain any character.", "Type": "String", "Entity": null }, { "Name": "ResourceIdentity", "Description": "ID of the resource that the user signed into.", "Type": "String", "Entity": null }, { "Name": "ResourceOwnerTenantId", "Description": "The tenant identifier of the owner of the resource referenced in the sign in.", "Type": "String", "Entity": null }, { "Name": "ResourceServicePrincipalId", "Description": "Service Principal Id of the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceTenantId", "Description": "Unique identifier of the tenant of the resource accessed", "Type": "String", "Entity": null }, { "Name": "RootActorID", "Description": "The root actor virtual ID associated with the sign-in.", "Type": "String", "Entity": null }, { "Name": "RiskDetail", "Description": "Risky user state details.", "Type": "String", "Entity": null }, { "Name": "RiskEventTypes", "Description": "Array of risk event types applicable to the event", "Type": "String", "Entity": null }, { "Name": "RiskEventTypes_V2", "Description": "The list of risk event types associated with the sign-in. These are strings.", "Type": "String", "Entity": null }, { "Name": "RiskLevelAggregated", "Description": "Aggregated risk level during sign-in. Possible values: 0 (aggregated risk level not set), 1 (none), 10 (low), 50 (medium), or 100 (high).", "Type": "String", "Entity": null }, { "Name": "RiskLevelDuringSignIn", "Description": "User risk level at sign-in", "Type": "String", "Entity": null }, { "Name": "RiskState", "Description": "Indicates risky user state. Possible values: 0 (none), 1 (confirmed safe), 2 (remediated), 3 (dismissed), 4 (at risk), or 5 (confirmed compromised).", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "SessionLifetimePolicies", "Description": "Policies and settings that applied to the sign-in that enforced or revoked a session lifetime.", "Type": "String", "Entity": null }, { "Name": "SignInEventTypes", "Description": "The types that are associated with the sign-in. Examples include \"interactive\", \"refreshToken\", \"managedIdentity\", \"continuousAccessEvaluation\" and many more.", "Type": "String", "Entity": null }, { "Name": "SignInIdentifierType", "Description": "The type of sign in identifier. Possible values are: userPrincipalName, phoneNumber, proxyAddress, qrCode, onPremisesUserPrincipalName, unknownFutureValue.", "Type": "String", "Entity": null }, { "Name": "TokenProtectionStatusDetails", "Description": "Token protection creates a cryptographically secure tie between the token and the device it's issued to. This field indicates whether the signin token was bound to the device or not.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "TokenIssuerName", "Description": "Name of the identity provider (e.g. sts.microsoft.com ).", "Type": "String", "Entity": null }, { "Name": "TokenIssuerType", "Description": "Indicates if the token issuer is Microsoft Entra ID (0) or Active Directory Federation Services (1)", "Type": "String", "Entity": null }, { "Name": "UniqueTokenIdentifier", "Description": "Unique identifier embedded in every access token and ID token that were issued", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "UserDisplayName", "Description": "Display name of the user that initiated the sign-in.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "ID of the user that initiated the sign-in.", "Type": "String", "Entity": null }, { "Name": "UserPrincipalName", "Description": "User principal name of the user that initiated the sign-in.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "Identifies whether the user is a member or guest in the tenant. Possible values are: member, guest, unknownFutureValue.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "AADServicePrincipalSignInLogs", "TableSource": "sentinel", "Description": "Service principal Azure Active Directory sign-in logs.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "Details of source system of the object being provisioned", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time of the event in UTC", "Type": "DateTime", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "OperationVersion", "Description": "The REST API version that's requested by the client", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ResultType", "Description": "Result of the operation. Possible values: Success, Failure", "Type": "String", "Entity": null }, { "Name": "ResultSignature", "Description": "Contains the error code, if any, for the sign-in operation", "Type": "String", "Entity": null }, { "Name": "ResultDescription", "Description": "Additional description of the operation's result", "Type": "String", "Entity": null }, { "Name": "DurationMs", "Description": "The duration of the operation in milliseconds", "Type": "Int64", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "Resource group for the logs", "Type": "String", "Entity": null }, { "Name": "Identity", "Description": "The identity from the token that was presented when you made the request. It can be a user account, system account, or service principal", "Type": "String", "Entity": null }, { "Name": "Level", "Description": "The severity level of the event", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "Unique GUID representing the app ID in the Azure Active Directory", "Type": "String", "Entity": null }, { "Name": "AppOwnerTenantId", "Description": "Specifies the ID of the tenant where the app was registered", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextClassReferences", "Description": "The authentication contexts of the sign-in", "Type": "String", "Entity": null }, { "Name": "AutonomousSystemNumber", "Description": "Autonomous System Number for the network.", "Type": "String", "Entity": null }, { "Name": "AuthenticationProcessingDetails", "Description": "Details about the authentication processor", "Type": "String", "Entity": null }, { "Name": "ClientCredentialType", "Description": "The type of client credential used. Examples include client assertion, client secret, etc.", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessAudiences", "Description": "Details of the conditional access audiences being applied for the sign-in.", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessPolicies", "Description": "Details of the conditional access policies applied to the sign-in event", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessStatus", "Description": "Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).", "Type": "String", "Entity": null }, { "Name": "CreatedDateTime", "Description": "Date and time when the account user was created", "Type": "DateTime", "Entity": null }, { "Name": "FederatedCredentialId", "Description": "Th identifier of an application's federated identity credential if a federated identity credential was used to sign in.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": null }, { "Name": "LocationDetails", "Description": "Details of the sign-in location", "Type": "String", "Entity": null }, { "Name": "NetworkLocationDetails", "Description": "Network location details of the authentication processor of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ResourceDisplayName", "Description": "Display name of the resource accessed. The display name can contain any character.", "Type": "String", "Entity": null }, { "Name": "ResourceIdentity", "Description": "ID of the resource that the service principal signed into", "Type": "String", "Entity": null }, { "Name": "ResourceOwnerTenantId", "Description": "The tenant identifier of the owner of the resource referenced in the sign in", "Type": "String", "Entity": null }, { "Name": "ResourceServicePrincipalId", "Description": "Service Principal Id of the resource", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalCredentialKeyId", "Description": "Key id of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalCredentialThumbprint", "Description": "Thumbprint of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalName", "Description": "Name of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "UniqueTokenIdentifier", "Description": "Unique identifier embedded in every access token and ID token that were issued", "Type": "String", "Entity": null }, { "Name": "Agent", "Description": "Details of agentic sign-in.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "AADTenantId", "Description": "ID of the AAD tenant.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "ABAPAuditLog", "TableSource": "sentinel", "Description": "SAP security audit log is used to keep records of important user transactions and system events within an SAP system. This table stores information such as who accessed the system, which transactions were executed, and when. It provides a useful tool for monitoring activity and detecting potential security breaches.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "UpdatedOn", "Description": "The date and time of the event occured in the SAP system in UTC format.", "Type": "DateTime", "Entity": null }, { "Name": "SystemId", "Description": "The SystemId is a unique identifier for a specific SAP system. It is a three-character alphanumeric code that is used to distinguish between different SAP systems.", "Type": "String", "Entity": null }, { "Name": "SystemNumber", "Description": "The SystemNumber is a two-digit number that identifies a specific SAP system. It is set during the installation of an SAP system and cannot be changed afterwards. The SystemNumber is used in various SAP transactions and configuration settings to identify the system and ensure that the correct system is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "ClientId", "Description": "The ClientId is a three-digit number that identifies a specific client within an SAP system. The ClientId is used in various SAP transactions and configuration settings to identify the client and ensure that the correct client is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "Instance", "Description": "The Instance refers to a specific installation of an SAP system on a server. An SAP system can have multiple instances running on the same server, each with its own set of processes and resources. The Instance is identified by a unique name that is set during the installation of the SAP system, following syntax: __.", "Type": "String", "Entity": null }, { "Name": "AuditClassId", "Description": "The AuditClassId is a numeric identifier used to classify different types of audit events in SAP. It helps group similar events together and is used in various transactions and reports to provide information about audit events and to help with auditing and compliance requirements.", "Type": "Double", "Entity": null }, { "Name": "MonitoringObjectName", "Description": "The MonitoringObjectName is the name of the object being monitored by a specific monitoring activity. It is used in various SAP monitoring tools and reports to provide information about the status and performance of the monitored object.", "Type": "String", "Entity": null }, { "Name": "SalDateChar8", "Description": "The SalDateChar8 is the date the event occured in char8 format (yyyyMMdd) eg: 20190101.", "Type": "String", "Entity": null }, { "Name": "SalTimeChar6", "Description": "The SalTimeChar6 is the time the event occured in char6 format (hhMMss) eg: 110804.", "Type": "String", "Entity": null }, { "Name": "MonitorShortName", "Description": "The MonitorShortName is the short name of the MTE(Monitoring Tree Element) in which the alert occurred.", "Type": "String", "Entity": null }, { "Name": "MessageId", "Description": "Identifier for the message", "Type": "String", "Entity": null }, { "Name": "MessageText", "Description": "The MessageText is the text of a specific message or log entry. It provides information about the event or issue that is being logged and is used in various SAP transactions and reports to provide context and details about specific messages or log entries.", "Type": "String", "Entity": null }, { "Name": "MessageClass", "Description": "The MessageClass is a grouping or category for specific messages or log entries used to organize and classify messages and log entries within an SAP system.", "Type": "String", "Entity": null }, { "Name": "MessageContainerId", "Description": "The MessageContainerId is a unique identifier for a specific message container, which is a logical grouping of related messages or log entries within an SAP system.", "Type": "String", "Entity": null }, { "Name": "AlertValue", "Description": "The AlertValue represents the importance of the message of a log attribute, characterized by color and severity.", "Type": "Double", "Entity": null }, { "Name": "AlertSeverity", "Description": "The AlertSeverity is a number between 0 and 255; the larger the number, the greater the severity.", "Type": "Double", "Entity": null }, { "Name": "AlertSeverityText", "Description": "The AlertSeverityText refers to the text description associated with a specific alert or notification severity level. It provides a detailed explanation of the severity level and is used in various SAP transactions and reports.", "Type": "String", "Entity": null }, { "Name": "User", "Description": "The User who performed the a specific event or activity.", "Type": "String", "Entity": null }, { "Name": "TransactionCode", "Description": "the TransactionCode is a unique identifier for a specific SAP transaction used to identify and execute a specific transaction within the SAP system. It is typically a four-character alphanumeric code and can be used in various SAP transactions and reports.", "Type": "String", "Entity": null }, { "Name": "AbapProgramName", "Description": "The AbapProgramName is a four-character alphanumeric code that is used identify a specific program within the SAP system.", "Type": "String", "Entity": null }, { "Name": "SapProcessType", "Description": "The SapProcessType refers to the type of process that is being executed within the SAP system. This can include various types of processes such as background jobs, dialog processes, or update processes.", "Type": "String", "Entity": null }, { "Name": "SapWorkProcessName", "Description": "The SapWorkProcessName refers to the name of a specific work process within the SAP system used to identify and monitor specific work processes. It is typically a unique alphanumeric code.", "Type": "String", "Entity": null }, { "Name": "Email", "Description": "The Email refers to the email address associated with a specific user. It is used to identify the user via email within the SAP system.", "Type": "String", "Entity": null }, { "Name": "Host", "Description": "The Host refers to the name of the computer or server on which the SAP system is running. It is used to identify and locate the SAP system within a network.", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "The Computer refers to the name or IP address of the user's machine. It is used to identify the machine from which a specific activity or event was performed.", "Type": "String", "Entity": null }, { "Name": "SalIpAddress", "Description": "The SALIpAddress refers to the IP address associated with a specific user or system that generated a specific log entry.", "Type": "String", "Entity": null }, { "Name": "TerminalIpV6", "Description": "The TerminalIPv6 refers to the IPv6 address associated with the user's terminal or device. It is used to identify the location and origin of specific activities or events performed by the user within the SAP system.", "Type": "String", "Entity": null }, { "Name": "Variable1", "Description": "The Variable1 used by the SAP system for additional information regarding the event or activity that was performed.", "Type": "String", "Entity": null }, { "Name": "Variable2", "Description": "The Variable2 used by the SAP system for additional information regarding the event or activity that was performed.", "Type": "String", "Entity": null }, { "Name": "Variable3", "Description": "The Variable3 used by the SAP system for additional information regarding the event or activity that was performed.", "Type": "String", "Entity": null }, { "Name": "Variable4", "Description": "The Variable4 used by the SAP system for additional information regarding the event or activity that was performed.", "Type": "String", "Entity": null }, { "Name": "SystemRole", "Description": "The SAP system's role.", "Type": "String", "Entity": null }, { "Name": "SystemUniqueId", "Description": "Unique system identifier.", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "RemoteIpLongitude", "Description": "The Longitude of the TerminalIpV6 according to the GEO information at the time of the record ingestion.", "Type": "Double", "Entity": null }, { "Name": "RemoteIpLatitude", "Description": "The Latitude of the TerminalIpV6 according to the GEO information at the time of the record ingestion.", "Type": "Double", "Entity": null }, { "Name": "RemoteIpCountry", "Description": "The country of the TerminalIpV6 according to the GEO information at the time of the record ingestion.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ABAPAuthorizationDetails", "TableSource": "sentinel", "Description": "SAP authorizations details per role.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "Role", "Description": "The SAP role name.", "Type": "String", "Entity": null }, { "Name": "RoleType", "Description": "Single or composite role", "Type": "String", "Entity": null }, { "Name": "UpdatedOn", "Description": "The date and time when the role was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "TypeOfChange", "Description": "I and J for insert, U for update, D and E for deletion.", "Type": "String", "Entity": null }, { "Name": "Authorization", "Description": "The authorization identifier.", "Type": "String", "Entity": null }, { "Name": "AuthorizationGroup", "Description": "The authorization group.", "Type": "String", "Entity": null }, { "Name": "Object", "Description": "The authorization object name.", "Type": "String", "Entity": null }, { "Name": "Field", "Description": "The authorization field name.", "Type": "String", "Entity": null }, { "Name": "Low", "Description": "The low value of the authorization field.", "Type": "String", "Entity": null }, { "Name": "High", "Description": "The high value of the authorization field.", "Type": "String", "Entity": null }, { "Name": "ChildRole", "Description": "The child role name, if the role is a composite one.", "Type": "String", "Entity": null }, { "Name": "SystemId", "Description": "The SystemId is a unique identifier for a specific SAP system. It is a three-character alphanumeric code that is used to distinguish between different SAP systems.", "Type": "String", "Entity": null }, { "Name": "ClientId", "Description": "The ClientId is a three-digit number that identifies a specific client within an SAP system. The ClientId is used in various SAP transactions and configuration settings to identify the client and ensure that the correct client is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "SystemRole", "Description": "The SAP system's role.", "Type": "String", "Entity": null }, { "Name": "SystemUniqueId", "Description": "Unique system identifier.", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ABAPChangeDocsLog", "TableSource": "sentinel", "Description": "SAP NetWeaver Application Server ABAP logs changes to business data objects in change documents. This table stores information about the changes made to business objects, including the user who made the change, the date and time of the change, and the type of change that was made.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was generated.", "Type": "DateTime", "Entity": null }, { "Name": "UpdatedOn", "Description": "The date and time of the event occured in the SAP system in UTC format.", "Type": "DateTime", "Entity": null }, { "Name": "SystemId", "Description": "The SystemId is a unique identifier for a specific SAP system. It is a three-character alphanumeric code that is used to distinguish between different SAP systems.", "Type": "String", "Entity": null }, { "Name": "SystemNumber", "Description": "The SystemNumber is a two-digit number that identifies a specific SAP system. It is set during the installation of an SAP system and cannot be changed afterwards. The SystemNumber is used in various SAP transactions and configuration settings to identify the system and ensure that the correct system is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "ClientId", "Description": "The ClientId is a three-digit number that identifies a specific client within an SAP system. The ClientId is used in various SAP transactions and configuration settings to identify the client and ensure that the correct client is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "Instance", "Description": "The Instance refers to a specific installation of an SAP system on a server. An SAP system can have multiple instances running on the same server, each with its own set of processes and resources. The Instance is identified by a unique name that is set during the installation of the SAP system, following syntax: __.", "Type": "String", "Entity": null }, { "Name": "User", "Description": "The User who performed the a specific event or activity.", "Type": "String", "Entity": null }, { "Name": "SystemRole", "Description": "The SAP system's role.", "Type": "String", "Entity": null }, { "Name": "SystemUniqueId", "Description": "Unique system identifier.", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "ActualChangeNumber", "Description": "Actual change number.", "Type": "String", "Entity": null }, { "Name": "ChangedTableKey", "Description": "Changed table key.", "Type": "String", "Entity": null }, { "Name": "ChangeNumber", "Description": "Document change number.", "Type": "String", "Entity": null }, { "Name": "CreatedFromPlannedChange", "Description": "Created from planned change, in the following syntax:('X' , ' ').", "Type": "String", "Entity": null }, { "Name": "CurrencyKeyNew", "Description": "Currency key: new value.", "Type": "String", "Entity": null }, { "Name": "CurrencyKeyOld", "Description": "Currency key: old value.", "Type": "String", "Entity": null }, { "Name": "FieldName", "Description": "Name of the field where this information appears in the AdditionalFields column of the DeviceTvmInfoGathering table", "Type": "String", "Entity": null }, { "Name": "FlagText", "Description": "Flag text.", "Type": "String", "Entity": null }, { "Name": "Language", "Description": "Document language.", "Type": "String", "Entity": null }, { "Name": "ObjectClass", "Description": "Object class, such as BELEG, BPAR, PFCG, IDENTITY.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "PlannedChangeNumber", "Description": "Planned change number.", "Type": "String", "Entity": null }, { "Name": "TableName", "Description": "The name of the table in the hunting schema that contains this event", "Type": "String", "Entity": null }, { "Name": "TransactionCode", "Description": "Transaction code.", "Type": "String", "Entity": null }, { "Name": "HeaderTypeOfChange", "Description": "Header type of change, including: U = Change; I = Insert; E = Delete Single Docu; D = Delete; J = Insert Single Docu.", "Type": "String", "Entity": null }, { "Name": "ItemTypeOfChange", "Description": "Item type of change, including: U = Change; I = Insert; E = Delete Single Docu; D = Delete; J = Insert Single Docu.", "Type": "String", "Entity": null }, { "Name": "UOMNew", "Description": "Unit of measure: new value.", "Type": "String", "Entity": null }, { "Name": "UOMOld", "Description": "Unit of measure: old value.", "Type": "String", "Entity": null }, { "Name": "ValueNew", "Description": "Field content: new value.", "Type": "String", "Entity": null }, { "Name": "ValueOld", "Description": "Field content: old value.", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ABAPTableDataLog", "TableSource": "sentinel", "Description": "SAP NetWeaver Application Server ABAP logs changes to tables. This log stores information about the changes made to selected tables, including the user who made the change, the date and time of the change, and the type of change that was made.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was generated.", "Type": "DateTime", "Entity": null }, { "Name": "UpdatedOn", "Description": "The date and time of the event occured in the SAP system in UTC format.", "Type": "DateTime", "Entity": null }, { "Name": "SystemId", "Description": "The SystemId is a unique identifier for a specific SAP system. It is a three-character alphanumeric code that is used to distinguish between different SAP systems.", "Type": "String", "Entity": null }, { "Name": "SystemNumber", "Description": "The SystemNumber is a two-digit number that identifies a specific SAP system. It is set during the installation of an SAP system and cannot be changed afterwards. The SystemNumber is used in various SAP transactions and configuration settings to identify the system and ensure that the correct system is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "Instance", "Description": "The Instance refers to a specific installation of an SAP system on a server. An SAP system can have multiple instances running on the same server, each with its own set of processes and resources. The Instance is identified by a unique name that is set during the installation of the SAP system, following syntax: __.", "Type": "String", "Entity": null }, { "Name": "ClientId", "Description": "The ClientId is a three-digit number that identifies a specific client within an SAP system. The ClientId is used in various SAP transactions and configuration settings to identify the client and ensure that the correct client is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "User", "Description": "The User who performed the a specific event or activity.", "Type": "String", "Entity": null }, { "Name": "SystemRole", "Description": "The SAP system's role.", "Type": "String", "Entity": null }, { "Name": "SystemUniqueId", "Description": "Unique system identifier.", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "DBLogId", "Description": "The unique identifier of the database log.", "Type": "String", "Entity": null }, { "Name": "LogKey", "Description": "The unique identifier of the log key.", "Type": "String", "Entity": null }, { "Name": "Host", "Description": "The hostname of the SAP system.", "Type": "String", "Entity": null }, { "Name": "TransactionCode", "Description": "The transaction code of the event.", "Type": "String", "Entity": null }, { "Name": "Program", "Description": "The program that was executed.", "Type": "String", "Entity": null }, { "Name": "OperationTypeSQL", "Description": "The type of operation that was performed, such as insert, update and delete.", "Type": "String", "Entity": null }, { "Name": "VersionNumber", "Description": "The version number of the event.", "Type": "String", "Entity": null }, { "Name": "Language", "Description": "The language of the event.", "Type": "String", "Entity": null }, { "Name": "TableName", "Description": "The name of the table in the hunting schema that contains this event", "Type": "String", "Entity": null }, { "Name": "TableField", "Description": "The field of the table that produced the change.", "Type": "String", "Entity": null }, { "Name": "OldValue", "Description": "The old value of the field.", "Type": "String", "Entity": null }, { "Name": "NewValue", "Description": "The new value of the field.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ABAPUserDetails", "TableSource": "sentinel", "Description": "SAP User details, such as roles and profiles assigned.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was sent to Sentinel.", "Type": "DateTime", "Entity": null }, { "Name": "User", "Description": "SAP User.", "Type": "String", "Entity": null }, { "Name": "UserGroup", "Description": "SAP User group.", "Type": "String", "Entity": null }, { "Name": "Email", "Description": "Email address.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "User Type (dialog, system).", "Type": "String", "Entity": null }, { "Name": "Timezone", "Description": "User default Time zone.", "Type": "String", "Entity": null }, { "Name": "LockedStatus", "Description": "Locked status: 0: Not Locked, 32: Locked Globally By Administrator, 64: Locked Locally By Administrator, 128: Locked Due To Incorrect Logons.", "Type": "String", "Entity": null }, { "Name": "LastSeen", "Description": "Timestamp of the newest record associated with the entity", "Type": "DateTime", "Entity": null }, { "Name": "CreatedOn", "Description": "Date and time when the profile was created", "Type": "DateTime", "Entity": null }, { "Name": "ChangedOn", "Description": "Last changed on date and time.", "Type": "DateTime", "Entity": null }, { "Name": "ValidityDate", "Description": "Last valid day for login in.", "Type": "DateTime", "Entity": null }, { "Name": "LastChangedBy", "Description": "Last changed by.", "Type": "String", "Entity": null }, { "Name": "Profiles", "Description": "List of profiles generated for the user.", "Type": "Object", "Entity": null }, { "Name": "Roles", "Description": "List of roles assigned to user.", "Type": "Object", "Entity": null }, { "Name": "SystemId", "Description": "The SystemId is a unique identifier for a specific SAP system. It is a three-character alphanumeric code that is used to distinguish between different SAP systems.", "Type": "String", "Entity": null }, { "Name": "ClientId", "Description": "The ClientId is a three-digit number that identifies a specific client within an SAP system. The ClientId is used in various SAP transactions and configuration settings to identify the client and ensure that the correct client is being accessed or configured.", "Type": "String", "Entity": null }, { "Name": "SystemRole", "Description": "The SAP system's role.", "Type": "String", "Entity": null }, { "Name": "SystemUniqueId", "Description": "Unique system identifier.", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimAgentEventLogs", "TableSource": "sentinel", "Description": "Microsoft Sentinel normalized agent event logs table. Stores events associated with agent interactions, ensuring consistent and efficient analysis across different data sources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the log was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventUid", "Description": "A unique identifier for the event.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "The original unique identifier of the event as provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventSchema", "Description": "The name of the ASIM schema for the event.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the ASIM schema used.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "The time at which the event started.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time at which the event ended.", "Type": "DateTime", "Entity": null }, { "Name": "EventCount", "Description": "The number of events aggregated in this record.", "Type": "Int32", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product that generated the event.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product that generated the event.", "Type": "String", "Entity": null }, { "Name": "SrcAgentId", "Description": "The unique identifier of the source agent.", "Type": "String", "Entity": null }, { "Name": "SrcAgentName", "Description": "The name of the source agent.", "Type": "String", "Entity": null }, { "Name": "SrcAgentOriginalType", "Description": "The original type of the source agent as reported by the source.", "Type": "String", "Entity": null }, { "Name": "SrcAgentDescription", "Description": "A description of the source agent.", "Type": "String", "Entity": null }, { "Name": "SrcAgentBlueprintId", "Description": "The blueprint identifier of the source agent.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the source.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The fully qualified domain name of the source.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The port number of the source.", "Type": "Int32", "Entity": null }, { "Name": "TargetAgentId", "Description": "The unique identifier of the target agent.", "Type": "String", "Entity": null }, { "Name": "TargetAgentName", "Description": "The name of the target agent.", "Type": "String", "Entity": null }, { "Name": "TargetAgentUsername", "Description": "The username associated with the target agent.", "Type": "String", "Entity": null }, { "Name": "TargetAgentUserId", "Description": "The user identifier associated with the target agent.", "Type": "String", "Entity": null }, { "Name": "TargetAgentOriginalType", "Description": "The original type of the target agent as reported by the source.", "Type": "String", "Entity": null }, { "Name": "TargetAgentDescription", "Description": "A description of the target agent.", "Type": "String", "Entity": null }, { "Name": "TargetAgentBlueprintId", "Description": "The blueprint identifier of the target agent.", "Type": "String", "Entity": null }, { "Name": "PlatformTargetAgentId", "Description": "The unique identifier of the platform target agent.", "Type": "String", "Entity": null }, { "Name": "PlatformTargetAgentName", "Description": "The name of the platform target agent.", "Type": "String", "Entity": null }, { "Name": "PlatformTargetAgentDescription", "Description": "A description of the platform target agent.", "Type": "String", "Entity": null }, { "Name": "PlatformTargetOriginalAgentType", "Description": "The original type of the platform target agent as reported by the source.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "The unique identifier of the actor user.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of the actor user identifier.", "Type": "String", "Entity": null }, { "Name": "ActorUserScope", "Description": "The scope of the actor user.", "Type": "String", "Entity": null }, { "Name": "ActorUserScopeId", "Description": "The scope identifier of the actor user.", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The username of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "The type of the actor username.", "Type": "String", "Entity": null }, { "Name": "ActingAppName", "Description": "The name of the application that initiated the event.", "Type": "String", "Entity": null }, { "Name": "ActingAppId", "Description": "The identifier of the application that initiated the event.", "Type": "String", "Entity": null }, { "Name": "ActingAppType", "Description": "The type of the application that initiated the event.", "Type": "String", "Entity": null }, { "Name": "EventSessionId", "Description": "The unique identifier of the event session.", "Type": "String", "Entity": null }, { "Name": "EventSessionName", "Description": "The name of the event session.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "The type of the event.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type as provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventRequestId", "Description": "The unique identifier of the request associated with the event.", "Type": "String", "Entity": null }, { "Name": "EventRequestTemperature", "Description": "The temperature parameter used in the event request.", "Type": "Double", "Entity": null }, { "Name": "EventRequestTopP", "Description": "The top-p (nucleus sampling) parameter used in the event request.", "Type": "Double", "Entity": null }, { "Name": "EventRequestPresencePenalty", "Description": "The presence penalty parameter used in the event request.", "Type": "Double", "Entity": null }, { "Name": "EventRequestFrequencyPenalty", "Description": "The frequency penalty parameter used in the event request.", "Type": "Double", "Entity": null }, { "Name": "EventRequestSeed", "Description": "The seed parameter used in the event request for reproducibility.", "Type": "Int64", "Entity": null }, { "Name": "EventResponseId", "Description": "The unique identifier of the response associated with the event.", "Type": "String", "Entity": null }, { "Name": "EventOriginalRequestDetails", "Description": "The original request details as provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details as provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventErrorDetails", "Description": "Details about any error that occurred during the event.", "Type": "String", "Entity": null }, { "Name": "EventOriginalErrorType", "Description": "The original error type as provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventThoughtProcessDetails", "Description": "Details about the thought process or reasoning during the event.", "Type": "String", "Entity": null }, { "Name": "EventThoughtProcessId", "Description": "The unique identifier of the thought process associated with the event.", "Type": "String", "Entity": null }, { "Name": "EventFinishReasons", "Description": "The reasons for the event completion.", "Type": "Object", "Entity": null }, { "Name": "EventOutputType", "Description": "The type of the event output.", "Type": "String", "Entity": null }, { "Name": "ToolId", "Description": "The unique identifier of the tool used in the event.", "Type": "String", "Entity": null }, { "Name": "ToolName", "Description": "The name of the tool used in the event.", "Type": "String", "Entity": null }, { "Name": "ToolDescription", "Description": "A description of the tool used in the event.", "Type": "String", "Entity": null }, { "Name": "ToolOriginalType", "Description": "The original type of the tool as reported by the source.", "Type": "String", "Entity": null }, { "Name": "ModelProviderName", "Description": "The name of the model provider.", "Type": "String", "Entity": null }, { "Name": "ModelName", "Description": "The name of the model used in the event.", "Type": "String", "Entity": null }, { "Name": "InputTokensUsed", "Description": "The number of input tokens consumed during the event.", "Type": "Int64", "Entity": null }, { "Name": "OutputTokensUsed", "Description": "The number of output tokens generated during the event.", "Type": "Int64", "Entity": null }, { "Name": "ActorUserEntityKey", "Description": "The entity key associated with the actor user.", "Type": "String", "Entity": null }, { "Name": "ActingApplicationEntityKey", "Description": "The entity key associated with the acting application.", "Type": "String", "Entity": null }, { "Name": "SrcAgentEntityKey", "Description": "The entity key associated with the source agent.", "Type": "String", "Entity": null }, { "Name": "TargetAgentEntityKey", "Description": "The entity key associated with the target agent.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "ActorUserAdditionalIds", "Description": "Additional identifiers associated with the actor user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimAlertEventLogs", "TableSource": "sentinel", "Description": "Microsoft Sentinel normalized alert events table. Stores events associated with security events and alerts, ensuring consistent and efficient analysis across different data sources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record.", "Type": "Int32", "Entity": null }, { "Name": "EventStartTime", "Description": "The time (UTC) in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time (UTC) in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventType", "Description": "Describes the operation reported by the record.", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Describes a subdivision of the operation reported in the EventType field.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason or details for the result reported in the EventResult field.", "Type": "String", "Entity": null }, { "Name": "EventUid", "Description": "A machine-readable, alphanumeric string that uniquely identifies an alert within a system.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "For reporting security systems, the action taken by the system.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "AlertId", "Description": "Unique identifier for the alert", "Type": "String", "Entity": null }, { "Name": "AlertName", "Description": "Title or name of the alert.", "Type": "String", "Entity": null }, { "Name": "AlertDescription", "Description": "Alias or friendly name for EventMessage field.", "Type": "String", "Entity": null }, { "Name": "AlertVerdict", "Description": "The final determination or outcome of the alert, indicating whether the alert was confirmed as a threat, deemed suspicious, or resolved as a false positive.", "Type": "String", "Entity": null }, { "Name": "AlertStatus", "Description": "Indicates the current state or progress of the alert.", "Type": "String", "Entity": null }, { "Name": "AlertOriginalStatus", "Description": "The status of the alert as reported by the originating system.", "Type": "String", "Entity": null }, { "Name": "DetectionMethod", "Description": "Provides detailed information about the specific detection method, technology, or data source that contributed to the generation of the alert.", "Type": "String", "Entity": null }, { "Name": "Rule", "Description": "Either the value of RuleName or the value of RuleNumber.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the alert.", "Type": "Int32", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule associated with the alert.", "Type": "String", "Entity": null }, { "Name": "RuleDescription", "Description": "Description of the rule associated with the alert.", "Type": "String", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the alert.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "Date and time when the threat was first reported.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "Date and time when the threat was last reported.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in the alert.", "Type": "String", "Entity": null }, { "Name": "ThreatOriginalCategory", "Description": "The category of the threat as reported by the originating system.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "Indicates whether the threat is currently active.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the originating system.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The confidence level as reported by the originating system.", "Type": "String", "Entity": null }, { "Name": "IndicatorType", "Description": "The type or category of the indicator.", "Type": "String", "Entity": null }, { "Name": "IndicatorAssociation", "Description": "Specifies whether the indicator is linked to or directly impacted by the threat.", "Type": "String", "Entity": null }, { "Name": "AttackTactics", "Description": "The attack tactics (name, ID, or both) associated with the alert.", "Type": "String", "Entity": null }, { "Name": "AttackTechniques", "Description": "MITRE ATT&CK techniques associated with the activity that triggered the alert", "Type": "String", "Entity": null }, { "Name": "AttackRemediationSteps", "Description": "Recommended actions or steps to mitigate or remediate the identified attack or threat.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "A machine-readable, alphanumeric, unique representation of the user associated with the alert.", "Type": "String", "Entity": null }, { "Name": "UserIdType", "Description": "The type of the user ID, such as GUID, SID, or Email.", "Type": "String", "Entity": null }, { "Name": "Username", "Description": "Name of the user associated with the alert, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "User", "Description": "Alias or friendly name for Username field.", "Type": "String", "Entity": null }, { "Name": "UsernameType", "Description": "Specifies the type of the user name stored in the Username field.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of the Actor.", "Type": "String", "Entity": null }, { "Name": "OriginalUserType", "Description": "The user type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "UserSessionId", "Description": "The unique ID of the user's session associated with the alert.", "Type": "String", "Entity": null }, { "Name": "UserScopeId", "Description": "The scope ID, such as Microsoft Entra Directory ID, in which UserId and Username are defined.", "Type": "String", "Entity": null }, { "Name": "UserScope", "Description": "The scope, such as Microsoft Entra tenant, in which UserId and Username are defined.", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "ProcessName", "Description": "The name of the process", "Type": "String", "Entity": null }, { "Name": "ProcessFileCompany", "Description": "Company that created the process image file.", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FilePath", "Description": "The full, normalized path of the target file, including the folder or location, the file name, and the extension.", "Type": "String", "Entity": null }, { "Name": "FileSHA1", "Description": "SHA1 hash of the file.", "Type": "String", "Entity": null }, { "Name": "FileSHA256", "Description": "SHA256 hash of the file.", "Type": "String", "Entity": null }, { "Name": "FileMD5", "Description": "MD5 hash of the file.", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "String", "Entity": null }, { "Name": "Url", "Description": "Full Url from email", "Type": "String", "Entity": null }, { "Name": "RegistryKey", "Description": "Registry key that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValue", "Description": "Registry value.", "Type": "String", "Entity": null }, { "Name": "RegistryValueData", "Description": "Data of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueType", "Description": "Data type, such as binary or string, of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "EmailMessageId", "Description": "Unique identifier for the email message, associated with the alert.", "Type": "String", "Entity": null }, { "Name": "EmailSubject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "UserEntityKey", "Description": "The entity key associated with the user.", "Type": "String", "Entity": null }, { "Name": "ProcessEntityKey", "Description": "The entity key associated with the process.", "Type": "String", "Entity": null }, { "Name": "FileEntityKey", "Description": "The entity key associated with the file.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "UserAdditionalIds", "Description": "Additional identifiers associated with the user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimAssetEntityLogs", "TableSource": "sentinel", "Description": "Microsoft Sentinel normalized asset entity events table. Stores events associated with security events and alerts, ensuring consistent and efficient analysis across different data sources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the log was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EntitySchema", "Description": "The ASIM schema name for this entity record.", "Type": "String", "Entity": null }, { "Name": "EntitySchemaVersion", "Description": "The version of the ASIM schema used for this entity record.", "Type": "String", "Entity": null }, { "Name": "EntityUpdatedTime", "Description": "The timestamp (UTC) of when the entity record was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "EntityIngestionTime", "Description": "The timestamp (UTC) of when the entity record was ingested into the system.", "Type": "DateTime", "Entity": null }, { "Name": "EntityKey", "Description": "The unique identifier of the entity, used for correlation across schemas.", "Type": "String", "Entity": null }, { "Name": "EntityId", "Description": "A unique identifier for the entity within the normalized schema.", "Type": "String", "Entity": null }, { "Name": "EntityIdType", "Description": "The type or format of the entity identifier.", "Type": "String", "Entity": null }, { "Name": "EntityOriginalId", "Description": "The original identifier for the entity as reported by the source system.", "Type": "String", "Entity": null }, { "Name": "EntityName", "Description": "The display name or identifier of the entity.", "Type": "String", "Entity": null }, { "Name": "EntityNameType", "Description": "The type or format of the entity name, such as UPN, or username.", "Type": "String", "Entity": null }, { "Name": "AssetType", "Description": "The high-level type of the asset, such as File, or Site.", "Type": "String", "Entity": null }, { "Name": "AssetOriginalType", "Description": "The original type of the asset as reported by the source system.", "Type": "String", "Entity": null }, { "Name": "EntityVendor", "Description": "The vendor or provider that reported the entity.", "Type": "String", "Entity": null }, { "Name": "EntitySource", "Description": "The data source or connector that provided the entity record.", "Type": "String", "Entity": null }, { "Name": "EntityOriginalSource", "Description": "The original data source or connector that provided the entity record.", "Type": "String", "Entity": null }, { "Name": "EntityProduct", "Description": "The product name associated with the source that reported the entity.", "Type": "String", "Entity": null }, { "Name": "EntitySubProduct", "Description": "The sub-product or component name associated with the source that reported the entity.", "Type": "String", "Entity": null }, { "Name": "EntityCreatedTime", "Description": "The timestamp (UTC) of when the entity was originally created in the source system.", "Type": "DateTime", "Entity": null }, { "Name": "EntityLastAccessedTime", "Description": "The timestamp (UTC) of when the entity was last accessed.", "Type": "DateTime", "Entity": null }, { "Name": "EntityLastModifiedTime", "Description": "The timestamp (UTC) of when the entity was last modified in the source system.", "Type": "DateTime", "Entity": null }, { "Name": "EntityIsDeleted", "Description": "Indicates whether the entity has been deleted in the source system.", "Type": "Boolean", "Entity": null }, { "Name": "EntityFeedType", "Description": "The type or category of the data feed that provided the entity record.", "Type": "String", "Entity": null }, { "Name": "EntitySnapshotId", "Description": "The identifier of the snapshot to which the current record belongs.", "Type": "String", "Entity": null }, { "Name": "AssetOwnerId", "Description": "The identifier of the user or principal that owns the asset.", "Type": "String", "Entity": null }, { "Name": "AssetOwnerIdType", "Description": "The type or format of the asset owner identifier, such as UPN or SID.", "Type": "String", "Entity": null }, { "Name": "AssetOwnerType", "Description": "The type of the asset owner, such as User, Group, or ServicePrincipal.", "Type": "String", "Entity": null }, { "Name": "AssetOwnerScope", "Description": "The organizational or administrative scope to which the asset owner belongs.", "Type": "String", "Entity": null }, { "Name": "AssetOwnerScopeId", "Description": "The identifier of the scope to which the asset owner belongs.", "Type": "String", "Entity": null }, { "Name": "AdditionalAssetOwners", "Description": "A dynamic collection of additional owners or co-owners associated with the asset.", "Type": "Object", "Entity": null }, { "Name": "AssetOriginalPermissions", "Description": "The original permission set assigned to the asset as reported by the source system.", "Type": "Object", "Entity": null }, { "Name": "AssetOriginalRiskDetails", "Description": "The full risk details for the asset as provided by the source system.", "Type": "Object", "Entity": null }, { "Name": "AssetRiskName", "Description": "The normalized name of the risk or threat associated with the asset.", "Type": "String", "Entity": null }, { "Name": "AssetRiskLevel", "Description": "The normalized risk level assigned to the asset, such as Low, Medium, High, or Critical.", "Type": "String", "Entity": null }, { "Name": "AssetOriginalRiskLevel", "Description": "The risk level assigned to the asset as reported by the source system, before normalization.", "Type": "String", "Entity": null }, { "Name": "AssetRiskFirstReportedTime", "Description": "The timestamp (UTC) of when the risk associated with the asset was first reported.", "Type": "DateTime", "Entity": null }, { "Name": "AssetRiskLastReportedTime", "Description": "The timestamp (UTC) of when the risk associated with the asset was most recently reported.", "Type": "DateTime", "Entity": null }, { "Name": "AssetSensitivityLabel", "Description": "The sensitivity label applied to the asset, such as Confidential or Public.", "Type": "String", "Entity": null }, { "Name": "AssetOriginalSensitivityLevel", "Description": "The sensitivity level as reported by the source system, before normalization.", "Type": "String", "Entity": null }, { "Name": "AssetIsProtectedByDlp", "Description": "Indicates whether the asset is protected by a Data Loss Prevention (DLP) policy.", "Type": "Boolean", "Entity": null }, { "Name": "AssetRelatedIndicators", "Description": "A dynamic collection of threat indicators or signals related to the asset.", "Type": "Object", "Entity": null }, { "Name": "AssetOriginalDataClassificationType", "Description": "The original data classification type(s) assigned to the asset as reported by the source system.", "Type": "Object", "Entity": null }, { "Name": "AssetClassificationLastScanDateTime", "Description": "The timestamp (UTC) of when the asset was last scanned for data classification.", "Type": "DateTime", "Entity": null }, { "Name": "AADTenantId", "Description": "The Azure Active Directory tenant identifier associated with the asset or entity.", "Type": "String", "Entity": null }, { "Name": "IdentityDirectoryName", "Description": "The name of the identity directory, such as Active Directory or Azure AD, associated with the entity.", "Type": "String", "Entity": null }, { "Name": "IdentityDirectoryId", "Description": "The identifier of the identity directory associated with the entity.", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "InternalUsersCount", "Description": "The number of internal users associated with or having access to the asset.", "Type": "Int32", "Entity": null }, { "Name": "ExternalUsersCount", "Description": "The number of external users associated with or having access to the asset.", "Type": "Int32", "Entity": null }, { "Name": "FilePath", "Description": "The full path of the file associated with the asset.", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "FileMD5", "Description": "The MD5 hash of the file associated with the asset.", "Type": "String", "Entity": null }, { "Name": "FileSHA1", "Description": "The SHA-1 hash of the file associated with the asset.", "Type": "String", "Entity": null }, { "Name": "FileSHA256", "Description": "The SHA-256 hash of the file associated with the asset.", "Type": "String", "Entity": null }, { "Name": "FileSHA512", "Description": "The SHA-512 hash of the file associated with the asset.", "Type": "String", "Entity": null }, { "Name": "FileExtension", "Description": "File extension of the attachment.", "Type": "String", "Entity": null }, { "Name": "FileIsSignatureValid", "Description": "Indicates whether the digital signature of the file is valid.", "Type": "Boolean", "Entity": null }, { "Name": "FileSignatureDetails", "Description": "Details about the digital signature of the file, such as the signer or certificate information.", "Type": "String", "Entity": null }, { "Name": "SitePath", "Description": "The path of the site or storage location associated with the asset.", "Type": "String", "Entity": null }, { "Name": "SitePrimaryUri", "Description": "The primary URI of the site or storage location associated with the asset.", "Type": "String", "Entity": null }, { "Name": "AssetPath", "Description": "The alias of either FilePath or SitePath.", "Type": "String", "Entity": null }, { "Name": "User", "Description": "The alias of AssetOwnerId.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimAuditEventLogs", "TableSource": "sentinel", "Description": "Microsoft Sentinel normalized audit events table. Stores events associated with the audit trail of information systems and audit trail logs system configuration activities and policy changes. Such changes are often performed by system administrators, but can also be performed by users when configuring the settings of their own applications.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record.", "Type": "Int32", "Entity": null }, { "Name": "EventStartTime", "Description": "The time (UTC) in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time (UTC) in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventType", "Description": "Describes the operation reported by the record", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Describes a subdivision of the operation reported in the EventType field.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason or details for the result reported in the EventResult field.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the audit activity.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in audit activity.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the identified threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True if the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "ThreatIpAddr", "Description": "An IP address or Domain for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "For reporting security systems, the action taken by the system.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "A machine-readable, alphanumeric, unique representation of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserAadId", "Description": "The Azure Active Directory ID of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserSid", "Description": "The Windows user ID (SIDs) of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of the ID stored in the ActorUserId field.", "Type": "String", "Entity": null }, { "Name": "ActorScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorScope", "Description": "The scope, such as Azure AD tenant, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The Actor's username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "The type of the Actor's username specified in ActionUsername field", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActorOriginalUserType", "Description": "The user type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ActorSessionId", "Description": "The unique ID of the sign-in session of the Actor.", "Type": "String", "Entity": null }, { "Name": "TargetAppId", "Description": "The ID of the application to which the event applies, including a process, browser, or service.", "Type": "String", "Entity": null }, { "Name": "TargetAppName", "Description": "The name of the application to which event applies, including a service, a URL, or a SaaS application.", "Type": "String", "Entity": null }, { "Name": "TargetAppType", "Description": "The type of the application authorizing on behalf of the Actor.", "Type": "String", "Entity": null }, { "Name": "TargetOriginalAppType", "Description": "The target application type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetUrl", "Description": "A URL associated with the target application.", "Type": "String", "Entity": null }, { "Name": "ActingAppId", "Description": "The ID of the application that initiated the activity reported, including a process, browser, or service.", "Type": "String", "Entity": null }, { "Name": "ActingAppName", "Description": "The name of the application that initiated the activity reported, including a service, a URL, or a SaaS application.", "Type": "String", "Entity": null }, { "Name": "ActingAppType", "Description": "The type of acting application.", "Type": "String", "Entity": null }, { "Name": "ActingOriginalAppType", "Description": "The acting application type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "HttpUserAgent", "Description": "When authentication is performed over HTTP or HTTPS, this field's value is the user_agent HTTP header provided by the acting application when performing the authentication.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The Source IP address from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The Source IP port from which the connection originated.", "Type": "Int32", "Entity": null }, { "Name": "SrcHostname", "Description": "The source device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of SrcDomain.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The source device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcDescription", "Description": "A descriptive text associated with the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of SrcDvcId.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScopeId", "Description": "The cloud platform scope ID the source device belongs to. SrcDvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScope", "Description": "The cloud platform scope the source device belongs to. SrcDvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcRiskLevel", "Description": "The risk level associated with the identified Source.", "Type": "Int32", "Entity": null }, { "Name": "SrcOriginalRiskLevel", "Description": "The risk level associaeted with the identified Source as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetIpAddr", "Description": "The Target IP address from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "TargetPortNumber", "Description": "The Target IP port from which the connection originated.", "Type": "Int32", "Entity": null }, { "Name": "TargetHostname", "Description": "The target device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "TargetDomain", "Description": "The domain of the target device.", "Type": "String", "Entity": null }, { "Name": "TargetDomainType", "Description": "The type of TargetDomain.", "Type": "String", "Entity": null }, { "Name": "TargetFQDN", "Description": "The target device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "TargetDescription", "Description": "A descriptive text associated with the target device.", "Type": "String", "Entity": null }, { "Name": "TargetDvcId", "Description": "The ID of the target device.", "Type": "String", "Entity": null }, { "Name": "TargetDvcIdType", "Description": "The type of TargetDvcId.", "Type": "String", "Entity": null }, { "Name": "TargetDvcScopeId", "Description": "The cloud platform scope ID the target device belongs to. TargetDvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "TargetDvcScope", "Description": "The cloud platform scope the target device belongs to. TargetDvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "TargetDeviceType", "Description": "The type of the target device.", "Type": "String", "Entity": null }, { "Name": "TargetGeoCountry", "Description": "The country associated with the target IP address.", "Type": "String", "Entity": null }, { "Name": "TargetGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the target IP address.", "Type": "Double", "Entity": null }, { "Name": "TargetGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the target IP address.", "Type": "Double", "Entity": null }, { "Name": "TargetGeoRegion", "Description": "The region within a country associated with the target IP address.", "Type": "String", "Entity": null }, { "Name": "TargetGeoCity", "Description": "The city associated with the target IP address.", "Type": "String", "Entity": null }, { "Name": "TargetRiskLevel", "Description": "The risk level associated with the target.", "Type": "Int32", "Entity": null }, { "Name": "TargetOriginalRiskLevel", "Description": "The risk level associated with the target, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetDvcOs", "Description": "The OS of the target device.", "Type": "String", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "Object", "Description": "The name of the object on which the operation identified by EventType is performed.", "Type": "String", "Entity": null }, { "Name": "ObjectType", "Description": "The type of object, such as a file or a folder, that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "OriginalObjectType", "Description": "The object type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "OldValue", "Description": "The old value of Object prior to the operation.", "Type": "String", "Entity": null }, { "Name": "NewValue", "Description": "The new value of Object after the operation was performed.", "Type": "String", "Entity": null }, { "Name": "ValueType", "Description": "The type of the old and new values.", "Type": "String", "Entity": null }, { "Name": "ActorUserEntityKey", "Description": "The entity key associated with the actor user.", "Type": "String", "Entity": null }, { "Name": "TargetApplicationEntityKey", "Description": "The entity key associated with the target application.", "Type": "String", "Entity": null }, { "Name": "TargetSystemEntityKey", "Description": "The entity key associated with the target system.", "Type": "String", "Entity": null }, { "Name": "ActingApplicationEntityKey", "Description": "The entity key associated with the acting application.", "Type": "String", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "ActorUserAdditionalIds", "Description": "Additional identifiers associated with the actor user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimAuthenticationEventLogs", "TableSource": "sentinel", "Description": "Microsoft Sentinel normalized authentication events table. Stores events associated, for example, with the user authentication, sign-in, and sign-out.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record.", "Type": "Int32", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventType", "Description": "Describes the operation reported by the record", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "The sign-in type for example System, Interactive, RemoteInteractive, Service, RemoteService, Remote or AssumeRole.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "The details associated with the event result. This field is typically populated when the result is a failure.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the audit activity.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in audit activity.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the identified threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True if the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "ThreatIpAddr", "Description": "An IP address for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "For reporting security systems, the action taken by the system.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "A machine-readable, alphanumeric, unique representation of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of the ID stored in the ActorUserId field.", "Type": "String", "Entity": null }, { "Name": "ActorScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorScope", "Description": "The scope, such as Azure AD tenant, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The Actor's username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "Specifies the type of the user name stored in the ActorUsername field.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActorOriginalUserType", "Description": "The user type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ActorSessionId", "Description": "The unique ID of the sign-in session of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActingAppId", "Description": "The ID of the application authorizing on behalf of the actor, including a process, browser, or service.", "Type": "String", "Entity": null }, { "Name": "ActingAppName", "Description": "The name of the application authorizing on behalf of the actor, including a process, browser, or service.", "Type": "String", "Entity": null }, { "Name": "ActingAppType", "Description": "The type of acting application.", "Type": "String", "Entity": null }, { "Name": "ActingOriginalAppType", "Description": "The acting application type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "HttpUserAgent", "Description": "When authentication is performed over HTTP or HTTPS, this field's value is the user_agent HTTP header provided by the acting application when performing the authentication.", "Type": "String", "Entity": null }, { "Name": "TargetUserId", "Description": "A machine-readable, alphanumeric, unique representation of the actor.", "Type": "String", "Entity": null }, { "Name": "TargetUserIdType", "Description": "The type of the ID stored in the TargetUserId field.", "Type": "String", "Entity": null }, { "Name": "TargetUserScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which TargetUserId and TargetUsername are defined.", "Type": "String", "Entity": null }, { "Name": "TargetUserScope", "Description": "The scope, such as Azure AD tenant, in which TargetUserId and TargetUsername are defined.", "Type": "String", "Entity": null }, { "Name": "TargetUsername", "Description": "The Target actor's username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "TargetUsernameType", "Description": "The type of the Target actor's username specified in TargetUsername field", "Type": "String", "Entity": null }, { "Name": "TargetUserType", "Description": "The type of the Target actor.", "Type": "String", "Entity": null }, { "Name": "TargetOriginalUserType", "Description": "The user type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetSessionId", "Description": "The unique ID of the sign-in session of the Target actor.", "Type": "String", "Entity": null }, { "Name": "TargetAppId", "Description": "The ID of the application to which the authorization is required, often assigned by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetAppName", "Description": "The name of the application to which the authorization is required, including a service, a URL, or a SaaS application.", "Type": "String", "Entity": null }, { "Name": "TargetAppType", "Description": "The type of the application authorizing on behalf of the Actor.", "Type": "String", "Entity": null }, { "Name": "TargetOriginalAppType", "Description": "The target application type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetUrl", "Description": "A URL associated with the target application.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The IP port from which the connection originated.", "Type": "Int32", "Entity": null }, { "Name": "SrcHostname", "Description": "The source device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of SrcDomain.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The source device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcDescription", "Description": "A descriptive text associated with the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of SrcDvcId.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScopeId", "Description": "The cloud platform scope ID the source device belongs to. SrcDvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScope", "Description": "The cloud platform scope the source device belongs to. SrcDvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcRiskLevel", "Description": "The risk level associated with the identified Source.", "Type": "Int32", "Entity": null }, { "Name": "SrcOriginalRiskLevel", "Description": "The risk level associaeted with the identified Source as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcIsp", "Description": "The Internet Service Provider (ISP) used by the source device to connect to the internet.", "Type": "String", "Entity": null }, { "Name": "SrcDvcOs", "Description": "The OS of the source device.", "Type": "String", "Entity": null }, { "Name": "TargetIpAddr", "Description": "The IP address of the target device.", "Type": "String", "Entity": null }, { "Name": "TargetPortNumber", "Description": "The port of the target device.", "Type": "Int32", "Entity": null }, { "Name": "TargetHostname", "Description": "The target device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "TargetDomain", "Description": "The domain of the target device.", "Type": "String", "Entity": null }, { "Name": "TargetDomainType", "Description": "The type of TargetDomain.", "Type": "String", "Entity": null }, { "Name": "TargetFQDN", "Description": "The target device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "TargetDescription", "Description": "A descriptive text associated with the target device.", "Type": "String", "Entity": null }, { "Name": "TargetDvcId", "Description": "The ID of the target device.", "Type": "String", "Entity": null }, { "Name": "TargetDvcIdType", "Description": "The type of TargetDvcId.", "Type": "String", "Entity": null }, { "Name": "TargetDvcScopeId", "Description": "The cloud platform scope ID the target device belongs to. TargetDvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "TargetDvcScope", "Description": "The cloud platform scope the target device belongs to. TargetDvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "TargetDeviceType", "Description": "The type of the target device.", "Type": "String", "Entity": null }, { "Name": "TargetGeoCountry", "Description": "The country associated with the target IP address.", "Type": "String", "Entity": null }, { "Name": "TargetGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the target IP address.", "Type": "Double", "Entity": null }, { "Name": "TargetGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the target IP address.", "Type": "Double", "Entity": null }, { "Name": "TargetGeoRegion", "Description": "The region within a country associated with the target IP address.", "Type": "String", "Entity": null }, { "Name": "TargetGeoCity", "Description": "The city associated with the target IP address.", "Type": "String", "Entity": null }, { "Name": "TargetRiskLevel", "Description": "The risk level associated with the target.", "Type": "Int32", "Entity": null }, { "Name": "TargetOriginalRiskLevel", "Description": "The risk level associated with the target, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetDvcOs", "Description": "The OS of the target device.", "Type": "String", "Entity": null }, { "Name": "LogonMethod", "Description": "The method used to perform authentication.", "Type": "String", "Entity": null }, { "Name": "LogonProtocol", "Description": "The protocol used to perform authentication.", "Type": "String", "Entity": null }, { "Name": "ActingApplicationEntityKey", "Description": "The entity key associated with the acting application.", "Type": "String", "Entity": null }, { "Name": "ActorUserEntityKey", "Description": "The entity key associated with the actor user.", "Type": "String", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "TargetApplicationEntityKey", "Description": "The entity key associated with the target application.", "Type": "String", "Entity": null }, { "Name": "TargetSystemEntityKey", "Description": "The entity key associated with the target system.", "Type": "String", "Entity": null }, { "Name": "TargetUserEntityKey", "Description": "The entity key associated with the target user.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "ActorUserAdditionalIds", "Description": "Additional identifiers associated with the actor user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "TargetUserAdditionalIds", "Description": "Additional identifiers associated with the target user.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimDhcpEventLogs", "TableSource": "sentinel", "Description": "The ASIM DHCP schema represents DHCP server activity, including serving requests for DHCP IP address leased from client systems and updating a DNS server with the leases granted.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event. The value should be one of the values listed in Vendors and Products.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event. The value should be one of the values listed in Vendors and Products.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable).", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "Describes the operation reported by the record.", "Type": "String", "Entity": null }, { "Name": "SrcHostname", "Description": "The device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcMacAddr", "Description": "The MAC address of the network interface from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "DhcpCircuitId", "Description": "The DHCP circuit ID, as defined by RFC3046.", "Type": "String", "Entity": null }, { "Name": "DhcpLeaseDuration", "Description": "The length of the lease granted to a client, in seconds.", "Type": "Int32", "Entity": null }, { "Name": "DhcpSessionDuration", "Description": "The amount of time, in milliseconds, for the completion of the DHCP session.", "Type": "Int32", "Entity": null }, { "Name": "DhcpSessionId", "Description": "The session identifier as reported by the reporting device. For the Windows DHCP server, set this to the TransactionID field.", "Type": "String", "Entity": null }, { "Name": "DhcpSrcDHCId", "Description": "The DHCP client ID, as defined by RFC4701.", "Type": "String", "Entity": null }, { "Name": "DhcpSubscriberId", "Description": "The DHCP subscriber ID, as defined by RFC3993.", "Type": "String", "Entity": null }, { "Name": "DhcpUserClass", "Description": "The DHCP User Class, as defined by RFC3004.", "Type": "String", "Entity": null }, { "Name": "DhcpUserClassId", "Description": "The DHCP User Class Id, as defined by RFC3004.", "Type": "String", "Entity": null }, { "Name": "DhcpVendorClass", "Description": "The DHCP Vendor Class, as defined by RFC3925.", "Type": "String", "Entity": null }, { "Name": "DhcpVendorClassId", "Description": "The DHCP Vendor Class Id, as defined by RFC3925.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason or details for the result reported in the EventResult field.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP address of the device on which the event occurred or which reported the event, depending on the schema.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device on which the event occurred or which reported the event, depending on the schema.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "For reporting security systems, the action taken by the system, if applicable.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device on which the event occurred or which reported the event, depending on the schema", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event, depending on the schema.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event, depending on the schema.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured. This field is typically relevant to network related activity which is captured by an intermediate or tap device.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription name on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event, depending on the schema. The zone is defined by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the device.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record. This value is used when the source supports aggregation, and a single record might represent multiple events.", "Type": "Int32", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description, either included in or generated from the record.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source. This value is used to derive EventResultDetails, which should have only one of the values documented for each schema.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device. This value is used to derive EventSeverity.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Describes a subdivision of the operation reported in the EventType field.", "Type": "String", "Entity": null }, { "Name": "RequestedIpAddr", "Description": "The IP address requested by the DHCP client, when available.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the device.", "Type": "String", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of the domain.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of the DvcId.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScope", "Description": "The cloud platform scope the device belongs to.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScopeId", "Description": "The cloud platform scope ID the device belongs to.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "SrcOriginalUserType", "Description": "The original source user type, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The IP port on which the device communicated, if applicable.", "Type": "Int32", "Entity": null }, { "Name": "SrcUserId", "Description": "A machine-readable, alphanumeric, unique representation of the user.", "Type": "String", "Entity": null }, { "Name": "SrcUserIdType", "Description": "The type of SrcUserId.", "Type": "String", "Entity": null }, { "Name": "SrcUsername", "Description": "The user's username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcUsernameType", "Description": "The type of username.", "Type": "String", "Entity": null }, { "Name": "SrcUserScope", "Description": "The type of username.", "Type": "String", "Entity": null }, { "Name": "SrcUserScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which UserId and Username are defined.", "Type": "String", "Entity": null }, { "Name": "SrcUserSessionId", "Description": "The unique ID of the sign-in session of the user.", "Type": "String", "Entity": null }, { "Name": "SrcUserType", "Description": "The type of user", "Type": "String", "Entity": null }, { "Name": "SrcUserUid", "Description": "The Unix or Linux user ID of the user.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address..", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcRiskLevel", "Description": "The risk level associated with the identified Source.", "Type": "Int32", "Entity": null }, { "Name": "SrcOriginalRiskLevel", "Description": "The risk level associaeted with the identified Source as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule by associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the activity.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in activity.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the identified threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "EventSchema", "Description": "The schema the event is normalized to. Each schema documents its schema name.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema. Each schema documents its current version.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time when the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time when the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "SrcUserEntityKey", "Description": "The entity key associated with the source user.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "SrcUserAdditionalIds", "Description": "Additional identifiers associated with the source user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimDnsActivityLogs", "TableSource": "sentinel", "Description": "The ASim DNS activity schema represents DNS protocol activity, which may be logged either by a DNS server or by a device sending DNS requests to a DNS server. The DNS protocol activity includes DNS queries, DNS server updates, and DNS bulk data transfers. Since the schema represents protocol activity, it is governed by RFCs and officially assigned parameter lists. The DNS activity schema does not represent DNS server audit events.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record. This value is used when the source supports aggregation, and a single record may represent multiple events.", "Type": "Int32", "Entity": null }, { "Name": "EventType", "Description": "Indicates the operation reported by the record. For DNS activity events, this value is the DNS opcode as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Either request or response.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "The DNS response code as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, for example, the original Windows event ID.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain. Possible values include \"Windows\" and \"FQDN\".", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the client sending the DNS request. For a recursive DNS request, this value would typically be the reporting device, and in most cases, set to 127.0.0.1.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "Source port of the DNS query.", "Type": "Int32", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region, or state, within a country, associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "DstIpAddr", "Description": "The IP address of the server receiving the DNS request. For a regular DNS request, this value would typically be the reporting device, and in most cases set to 127.0.0.1.", "Type": "String", "Entity": null }, { "Name": "DstGeoCountry", "Description": "The country associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoRegion", "Description": "The region, or state, within a country, associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoCity", "Description": "The city associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the destination IP address.", "Type": "Double", "Entity": null }, { "Name": "DstGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the destination IP address.", "Type": "Double", "Entity": null }, { "Name": "DnsQuery", "Description": "The domain that needs to be resolved.", "Type": "String", "Entity": null }, { "Name": "DnsQueryType", "Description": "The DNS resource record type codes as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "Int32", "Entity": null }, { "Name": "DnsQueryTypeName", "Description": "The DNS resource record type name as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "String", "Entity": null }, { "Name": "DnsResponseCode", "Description": "The DNS numerical response code as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "Int32", "Entity": null }, { "Name": "DnsResponseName", "Description": "The content of the response, as included in the record. The structure of the DNS response data may vary between different reporting devices.", "Type": "String", "Entity": null }, { "Name": "TransactionIdHex", "Description": "The DNS unique hex transaction ID.", "Type": "String", "Entity": null }, { "Name": "DstDescription", "Description": "A descriptive text associated with the destination.", "Type": "String", "Entity": null }, { "Name": "DstDvcScope", "Description": "The cloud platform scope the destination device belongs to. DvcScope maps to a subscription on Azure and to an account on AWS.", "Type": "String", "Entity": null }, { "Name": "DstOriginalRiskLevel", "Description": "The risk level associated with the destination device as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstRiskLevel", "Description": "The risk level associated with the destination device.", "Type": "Int32", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device. For example: Primary Domain Controller.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured. This field is typically relevant to network related activity which is captured by an intermediate or tap device.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device. This value is used to derive EventSeverity.", "Type": "String", "Entity": null }, { "Name": "NetworkProtocolVersion", "Description": "The version of the network protocol. Typically used to differentiate between IPv4 and Ipv6.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule by associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "DnsResponseIpCountry", "Description": "The country associated with the response IP address.", "Type": "String", "Entity": null }, { "Name": "DnsResponseIpLatitude", "Description": "The Latitude of the geographical coordinate associated with the response IP address.", "Type": "Double", "Entity": null }, { "Name": "DnsResponseIpLongitude", "Description": "The longitude of the geographical coordinate associated with the response IP address.", "Type": "Double", "Entity": null }, { "Name": "NetworkProtocol", "Description": "The transport protocol used by the network resolution event. The value can be UDP or TCP.", "Type": "String", "Entity": null }, { "Name": "DnsQueryClass", "Description": "The DNS class ID as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "Int32", "Entity": null }, { "Name": "DnsQueryClassName", "Description": "The DNS class name as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "String", "Entity": null }, { "Name": "DnsNetworkDuration", "Description": "The amount of time, in milliseconds, for the completion of DNS request.", "Type": "Int32", "Entity": null }, { "Name": "DnsFlagsAuthenticated", "Description": "The DNS authenticated answer flag, which is related to DNSSEC, indicates in a response that all data included in the answer and authority sections of the response have been verified by the server according to the policies of that server. see RFC 3655 Section 6.1 for more information.", "Type": "Boolean", "Entity": null }, { "Name": "DnsFlagsAuthoritative", "Description": "The DNS authoritative answer flag indicates whether the response from the server was authoritative.", "Type": "Boolean", "Entity": null }, { "Name": "DnsFlagsRecursionDesired", "Description": "The DNS recursion desired flag indicates in a request that that client would like the server to use recursive queries.", "Type": "Boolean", "Entity": null }, { "Name": "DnsSessionId", "Description": "The DNS session identifier as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcDescription", "Description": "The number of the rule associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScope", "Description": "The cloud platform scope the source device belongs to. DvcScope maps to a subscription on Azure and to an account on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScopeId", "Description": "The cloud platform scope ID the source device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcOriginalRiskLevel", "Description": "The risk level associated with the source device as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcUserScope", "Description": "The scope, such as Azure AD tenant, in which SrcUserId and SrcUsername are defined.", "Type": "String", "Entity": null }, { "Name": "SrcUserScopeId", "Description": "The ID of the scope, such as Azure AD tenant, in which SrcUserId and SrcUsername are defined.", "Type": "String", "Entity": null }, { "Name": "SrcUserSessionId", "Description": "The unique ID of the sign-in session of the source user.", "Type": "String", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the web session.", "Type": "String", "Entity": null }, { "Name": "ThreatIpAddr", "Description": "An IP address for which a threat was identified. The field ThreatField contains the name of the field ThreatIpAddr represents. If a threat is identified in the Domain field, this field should be empty.", "Type": "String", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified. The value is either SrcIpAddr, DstIpAddr, Domain, or DnsResponseName.", "Type": "String", "Entity": null }, { "Name": "UrlCategory", "Description": "A DNS event source may also look up the category of the requested Domains.", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "If a DNS event source also provides DNS security, it may also evaluate the DNS event. For example, it can search for the IP address or domain in a threat intelligence database, and assign the domain or IP address with a Threat Category.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel_s", "Description": "The risk level associated with the threat identified, normalized to a value between 0 and a 100.", "Type": "String", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The original risk level associated with the threat identified, as reported by the reporting device.", "Type": "Int32", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "String", "Entity": null }, { "Name": "ThreatFirstReportedTime_d", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "String", "Entity": null }, { "Name": "ThreatLastReportedTime_d", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "EventStartTime", "Description": "The time at which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time at which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL of a resource that provides additional information about the event.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "Dvc", "Description": "A unique identifier of the device reporting the event. The identifier can be either an IP Address, A hostname, or a device ID.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The fully qualified hostname, including domain information, of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network segment of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DnsResponseIpCity", "Description": "The city associated with the response IP address.", "Type": "String", "Entity": null }, { "Name": "DnsResponseIpRegion", "Description": "The region, or state, within a country, associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "Src", "Description": "A unique identifier of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcHostname", "Description": "The source device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of SrcDomain.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The source device hostname, including domain information.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of SrcDvcId.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcRiskLevel", "Description": "The risk level associated with the source device.", "Type": "Int32", "Entity": null }, { "Name": "SrcUserId", "Description": "A machine-readable, alphanumeric, unique representation of the source user.", "Type": "String", "Entity": null }, { "Name": "SrcUserIdType", "Description": "The type of the ID stored in the SrcUserId field.", "Type": "String", "Entity": null }, { "Name": "SrcUsername", "Description": "The Source username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcUsernameType", "Description": "The type of the username stored in the SrcUsername field.", "Type": "String", "Entity": null }, { "Name": "SrcUserType", "Description": "The type of the source user.", "Type": "String", "Entity": null }, { "Name": "SrcOriginalUserType", "Description": "The original source user type, as provided by the source.", "Type": "String", "Entity": null }, { "Name": "SrcProcessName", "Description": "The name of the process that initiated the DNS request.", "Type": "String", "Entity": null }, { "Name": "SrcProcessId", "Description": "The process ID (PID) of the process that initiated the DNS request.", "Type": "String", "Entity": null }, { "Name": "SrcProcessGuid", "Description": "A generated unique identifier (GUID) of the process that initiated the DNS request.", "Type": "String", "Entity": null }, { "Name": "Dst", "Description": "A unique identifier of the server that received the DNS request.", "Type": "String", "Entity": null }, { "Name": "DstPortNumber", "Description": "Destination Port number.", "Type": "Int32", "Entity": null }, { "Name": "DstHostname", "Description": "The destination device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "DstDomain", "Description": "The domain of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstDomainType", "Description": "The type of DstDomain.", "Type": "String", "Entity": null }, { "Name": "DstFQDN", "Description": "The destination device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "DstDvcId", "Description": "The ID of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstDvcScopeId", "Description": "The cloud platform scope ID the destination device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DstDvcIdType", "Description": "The type of DstDvcId.", "Type": "String", "Entity": null }, { "Name": "DstDeviceType", "Description": "The type of the destination device.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "The action taken by the the reporting device on the request, such as blocking it.", "Type": "String", "Entity": null }, { "Name": "DnsFlags", "Description": "The DNS request flags, as provided by the reporting device. The structure of the DNS flags information may vary between different reporting devices.", "Type": "String", "Entity": null }, { "Name": "DnsFlagsCheckingDisabled", "Description": "The DNS CD flag, which is related to DNSSEC, indicates in a query that non-verified data is acceptable to the system sending the query.", "Type": "Boolean", "Entity": null }, { "Name": "DnsFlagsRecursionAvailable", "Description": "The DNS RA flag indicates in a response that that server supports recursive queries.", "Type": "Boolean", "Entity": null }, { "Name": "DnsFlagsTruncated", "Description": "The DNS TC flag indicates that a response was truncates as it exceeded the maximum response size.", "Type": "Boolean", "Entity": null }, { "Name": "DnsFlagsZ", "Description": "The DNS Z flag is a deprecated DNS flag, which might be reported by older DNS systems.", "Type": "Boolean", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "SrcUserEntityKey", "Description": "The entity key associated with the source user.", "Type": "String", "Entity": null }, { "Name": "SrcProcessEntityKey", "Description": "The entity key associated with the source process.", "Type": "String", "Entity": null }, { "Name": "DstSystemEntityKey", "Description": "The entity key associated with the destination system.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "SrcUserAdditionalIds", "Description": "Additional identifiers associated with the source user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimFileEventLogs", "TableSource": "sentinel", "Description": "The Advanced Security Information Model (ASIM) File Event normalization schema describes file activity such as creating, modifying, or deleting files or documents.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "The operation reported by the record.", "Type": "String", "Entity": null }, { "Name": "TargetFilePath", "Description": "Target file path of endpoint activities", "Type": "String", "Entity": null }, { "Name": "TargetFilePathType", "Description": "The type of TargetFilePath.", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The Actor username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "The HTTP status code.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain. Valid values include 'Windows' and 'FQDN'.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "The action taken on the web session.", "Type": "String", "Entity": null }, { "Name": "TargetFileName", "Description": "The name of the target file, without a path or a location, but with an extension if relevant.", "Type": "String", "Entity": null }, { "Name": "HashType", "Description": "The type of hash stored in the Hash alias field.", "Type": "String", "Entity": null }, { "Name": "SrcFileName", "Description": "The name of the source file, without a path or a location, but with an extension if relevant.", "Type": "String", "Entity": null }, { "Name": "SrcFilePath", "Description": "The full, normalized path of the source file, including the folder or location, the file name, and the extension.", "Type": "String", "Entity": null }, { "Name": "SrcFilePathType", "Description": "The type of SrcFilePath.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "A machine-readable, alphanumeric, unique representation of the actor.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "When the operation is initiated by a remote system, the IP address of this system.", "Type": "String", "Entity": null }, { "Name": "SrcHostname", "Description": "The source device hostname, excluding domain information. If no device name is available, store the relevant IP address in this field.", "Type": "String", "Entity": null }, { "Name": "SrcMacAddr", "Description": "The MAC address of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the source device.", "Type": "String", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "This value is used when the source supports aggregation, and a single record may represent multiple events.", "Type": "Int32", "Entity": null }, { "Name": "EventSubType", "Description": "Additional description of the event type, if applicable.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source. For example, this field will be used to store the original Windows logon type. This value is used to derive EventSubType, which should have only one of the values documented for each schema.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source. This value is used to derive EventResultDetails, which should have only one of the values documented for each schema.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device. This value is used to derive EventSeverity.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event, depending on the schema.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription name on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "TargetFileCreationTime", "Description": "The time at which the target file was created.", "Type": "DateTime", "Entity": null }, { "Name": "TargetFileDirectory", "Description": "The target file folder or location.", "Type": "String", "Entity": null }, { "Name": "TargetFileExtension", "Description": "The target file extension.", "Type": "String", "Entity": null }, { "Name": "TargetFileMimeType", "Description": "The Mime or Media type of the target file.", "Type": "String", "Entity": null }, { "Name": "TargetFileMD5", "Description": "The MD5 hash of the target file.", "Type": "String", "Entity": null }, { "Name": "TargetFileSHA1", "Description": "The SHA-1 hash of the target file.", "Type": "String", "Entity": null }, { "Name": "TargetFileSHA256", "Description": "The SHA-256 hash of the target file.", "Type": "String", "Entity": null }, { "Name": "TargetFileSHA512", "Description": "The SHA-512 hash of the source file.", "Type": "String", "Entity": null }, { "Name": "TargetFileSize", "Description": "The size of the target file in bytes.", "Type": "Int64", "Entity": null }, { "Name": "SrcFileCreationTime", "Description": "The time at which the source file was created.", "Type": "DateTime", "Entity": null }, { "Name": "SrcFileDirectory", "Description": "The source file folder or location.", "Type": "String", "Entity": null }, { "Name": "SrcFileExtension", "Description": "The source file extension.", "Type": "String", "Entity": null }, { "Name": "SrcFileMimeType", "Description": "The Mime or Media type of the source file.", "Type": "String", "Entity": null }, { "Name": "SrcFileMD5", "Description": "The MD5 hash of the source file.", "Type": "String", "Entity": null }, { "Name": "SrcFileSHA1", "Description": "The SHA-1 hash of the source file.", "Type": "String", "Entity": null }, { "Name": "SrcFileSHA256", "Description": "The SHA-256 hash of the source file.", "Type": "String", "Entity": null }, { "Name": "SrcFileSHA512", "Description": "The SHA-512 hash of the source file.", "Type": "String", "Entity": null }, { "Name": "SrcFileSize", "Description": "The size of the source file in bytes.", "Type": "Int64", "Entity": null }, { "Name": "ActorUserAadId", "Description": "The Azure Active Directory ID of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserSid", "Description": "The Windows user ID (SIDs) of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorScope", "Description": "The scope, such as Azure AD tenant, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorScopeId", "Description": "The scope ID, such as Azure AD Directory ID, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of the ID stored in the ActorUserId field.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "Specifies the type of the user name stored in the ActorUsername field.", "Type": "String", "Entity": null }, { "Name": "ActorSessionId", "Description": "The unique ID of the login session of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of actor.", "Type": "String", "Entity": null }, { "Name": "ActorOriginalUserType", "Description": "The original actor user type as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ActingProcessCommandLine", "Description": "The command line used to run the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessName", "Description": "The name of the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessId", "Description": "The process ID (PID) of the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessGuid", "Description": "A generated unique identifier (GUID) of the acting process.", "Type": "String", "Entity": null }, { "Name": "HttpUserAgent", "Description": "When the operation is initiated using HTTP or HTTPS, the HTTP user agent header.", "Type": "String", "Entity": null }, { "Name": "NetworkApplicationProtocol", "Description": "When the operation is initiated by a remote system, the application layer protocol used by the connection or session.", "Type": "String", "Entity": null }, { "Name": "SrcOriginalRiskLevel", "Description": "The risk level associated with the source. As reported by the reporting device or enriched.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "When the operation is initiated by a remote system, the port number from which the connection was initiated.", "Type": "Int32", "Entity": null }, { "Name": "SrcRiskLevel", "Description": "The risk level associated with the source.", "Type": "Int32", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of SrcDomain.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The source device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScopeId", "Description": "The cloud platform scope ID the device belongs to.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScope", "Description": "The cloud platform scope the device belongs to.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of SrcDvcId.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "TargetAppName", "Description": "The name of the destination application.", "Type": "String", "Entity": null }, { "Name": "TargetAppId", "Description": "The ID of the destination application, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetAppType", "Description": "The type of the destination application.", "Type": "String", "Entity": null }, { "Name": "TargetOriginalAppType", "Description": "The target application type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetUrl", "Description": "When the operation is initiated using HTTP or HTTPS, the URL used.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule by associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the file activity.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in the file activity.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the identified threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatFilePath", "Description": "A file path for which a threat was identified. The field ThreatField contains the name of the field ThreatFilePath represents.", "Type": "String", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified. The value is either SrcFilePath or DstFilePath.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "EventSchema", "Description": "The schema the event is normalized to. Each schema documents its schema name.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TargetFileEntityKey", "Description": "The entity key associated with the target file.", "Type": "String", "Entity": null }, { "Name": "SrcFileEntityKey", "Description": "The entity key associated with the source file.", "Type": "String", "Entity": null }, { "Name": "ActorUserEntityKey", "Description": "The entity key associated with the actor user.", "Type": "String", "Entity": null }, { "Name": "SrcProcessEntityKey", "Description": "The entity key associated with the source process.", "Type": "String", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "ActingApplicationEntityKey", "Description": "The entity key associated with the acting application.", "Type": "String", "Entity": null }, { "Name": "TargetApplicationEntityKey", "Description": "The entity key associated with the target application.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "ActorUserAdditionalIds", "Description": "Additional identifiers associated with the actor user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimNetworkSessionLogs", "TableSource": "sentinel", "Description": "The Microsoft Sentinel network session normalization schema represents an IP network activity, such as network connections and network sessions. Such events are reported, for example, by operating systems, routers, firewalls, and intrusion prevention systems.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventCount", "Description": "This value is used when the source supports aggregation, and a single record may represent multiple events.", "Type": "Int32", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "The action taken on the network session.", "Type": "String", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event. Example: 00:1B:44:11:3A:B7.", "Type": "String", "Entity": null }, { "Name": "Dvc", "Description": "A unique identifier of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event. The zone is defined by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured. This field is typically relevant to network related activity which is captured by an intermediate or tap device.", "Type": "String", "Entity": null }, { "Name": "DvcSubscriptionId", "Description": "The cloud platform subscription ID the device belongs to. DvcSubscriptionId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device. This value is used to derive EventSeverity.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source. For example, this field will be used to store the original Windows logon type. This value is used to derive EventSubType, which should have only one of the values documented for each schema.", "Type": "String", "Entity": null }, { "Name": "NetworkApplicationProtocol", "Description": "The application layer protocol used by the connection or session.", "Type": "String", "Entity": null }, { "Name": "NetworkProtocolVersion", "Description": "The version of NetworkProtocol.", "Type": "String", "Entity": null }, { "Name": "NetworkDirection", "Description": "The direction of the connection or session.", "Type": "String", "Entity": null }, { "Name": "NetworkIcmpCode", "Description": "For an ICMP message, the ICMP message type numeric value as described in RFC 2780 for IPv4 network connections, or in RFC 4443 for IPv6 network connections.", "Type": "Int32", "Entity": null }, { "Name": "NetworkIcmpType", "Description": "For an ICMP message, the ICMP message type text representation, as described in RFC 2780 for IPv4 network connections, or in RFC 4443 for IPv6 network connections.", "Type": "String", "Entity": null }, { "Name": "NetworkConnectionHistory", "Description": "TCP flags and other potential IP header information.", "Type": "String", "Entity": null }, { "Name": "DstBytes", "Description": "The number of bytes sent from the destination to the source for the connection or session. If the event is aggregated, DstBytes is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "SrcBytes", "Description": "The number of bytes sent from the source to the destination for the connection or session. If the event is aggregated, SrcBytes is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "NetworkBytes", "Description": "Number of bytes sent in both directions. If both BytesReceived and BytesSent exist, BytesTotal should equal their sum. If the event is aggregated, NetworkBytes is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "DstPackets", "Description": "The number of packets sent from the destination to the source for the connection or session. The meaning of a packet is defined by the reporting device. If the event is aggregated, DstPackets is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "SrcPackets", "Description": "The number of packets sent from the source to the destination for the connection or session. The meaning of a packet is defined by the reporting device. If the event is aggregated, SrcPackets is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "NetworkPackets", "Description": "The number of packets sent in both directions. If both PacketsReceived and PacketsSent exist, BytesTotal should equal their sum. The meaning of a packet is defined by the reporting device. If the event is aggregated, NetworkPackets is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "NetworkSessionId", "Description": "The session identifier as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstZone", "Description": "The network zone of the destination, as defined by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstInterfaceName", "Description": "The network interface used for the connection or session by the destination device.", "Type": "String", "Entity": null }, { "Name": "DstInterfaceGuid", "Description": "The GUID of the network interface used on the destination device.", "Type": "String", "Entity": null }, { "Name": "DstMacAddr", "Description": "The MAC address of the network interface used for the connection or session by the destination device.", "Type": "String", "Entity": null }, { "Name": "DstVlanId", "Description": "The VLAN ID related to the destination device.", "Type": "String", "Entity": null }, { "Name": "DstSubscriptionId", "Description": "The cloud platform subscription ID the destination device belongs to. DstSubscriptionId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DstGeoCountry", "Description": "The country associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoRegion", "Description": "The region, or state, within a country associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoCity", "Description": "The city associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the destination IP address.", "Type": "Double", "Entity": null }, { "Name": "DstGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the destination IP address.", "Type": "Double", "Entity": null }, { "Name": "DstUserId", "Description": "A machine-readable, alphanumeric, unique representation of the destination user.", "Type": "String", "Entity": null }, { "Name": "DstUserIdType", "Description": "The type of the ID stored in the DstUserId field.", "Type": "String", "Entity": null }, { "Name": "DstUsername", "Description": "The destination username, including domain information when available. Use the simple form only if domain information isn't available.", "Type": "String", "Entity": null }, { "Name": "DstUsernameType", "Description": "Specifies the type of the username stored in the DstUsername field.", "Type": "String", "Entity": null }, { "Name": "DstUserType", "Description": "The type of destination user.", "Type": "String", "Entity": null }, { "Name": "DstOriginalUserType", "Description": "The original destination user type, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "DstAppName", "Description": "The name of the destination application.", "Type": "String", "Entity": null }, { "Name": "DstAppId", "Description": "The ID of the destination application, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstAppType", "Description": "The type of the destination application.", "Type": "String", "Entity": null }, { "Name": "SrcZone", "Description": "The network zone of the source, as defined by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcInterfaceName", "Description": "The network interface used for the connection or session by the source device.", "Type": "String", "Entity": null }, { "Name": "SrcInterfaceGuid", "Description": "The GUID of the network interface used on the source device.", "Type": "String", "Entity": null }, { "Name": "SrcMacAddr", "Description": "The MAC address of the network interface from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "SrcVlanId", "Description": "The VLAN ID related to the source device.", "Type": "String", "Entity": null }, { "Name": "SrcSubscriptionId", "Description": "The cloud platform subscription ID the source device belongs to. SrcSubscriptionId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcAppName", "Description": "The name of the source application.", "Type": "String", "Entity": null }, { "Name": "SrcAppId", "Description": "The ID of the source application, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcAppType", "Description": "The type of the source application.", "Type": "String", "Entity": null }, { "Name": "DstNatIpAddr", "Description": "The DstNatIpAddr represents either of: The original address of the destination device if network address translation was used or the IP address used by the intermediary device for communication with the source.", "Type": "String", "Entity": null }, { "Name": "DstNatPortNumber", "Description": "If reported by an intermediary NAT device, the port used by the NAT device for communication with the source.", "Type": "Int32", "Entity": null }, { "Name": "SrcNatIpAddr", "Description": "The SrcNatIpAddr represents either of: The original address of the source device if network address translation was used or the IP address used by the intermediary device for communication with the destination.", "Type": "String", "Entity": null }, { "Name": "SrcNatPortNumber", "Description": "If reported by an intermediary NAT device, the port used by the NAT device for communication with the destination.", "Type": "Int32", "Entity": null }, { "Name": "DvcInboundInterface", "Description": "If reported by an intermediary device, the network interface used by the NAT device for the connection to the source device.", "Type": "String", "Entity": null }, { "Name": "DvcOutboundInterface", "Description": "If reported by an intermediary device, the network interface used by the NAT device for the connection to the destination device.", "Type": "String", "Entity": null }, { "Name": "NetworkRuleName", "Description": "The name or ID of the rule by which DvcAction was decided upon.", "Type": "String", "Entity": null }, { "Name": "NetworkRuleNumber", "Description": "The number of the rule by which DvcAction was decided upon.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the network session.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in the network session.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the session. The level is a number between 0 to 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "The operation reported by the record.", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Additional description of the event type, if applicable.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason or details for the result reported in the EventResult field.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain. Possible values include 'Windows' and 'FQDN'.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The IP port from which the connection originated. Might not be relevant for a session comprising multiple connections.", "Type": "Int32", "Entity": null }, { "Name": "DstIpAddr", "Description": "The IP address of the connection or session destination.", "Type": "String", "Entity": null }, { "Name": "NetworkProtocol", "Description": "The IP protocol used by the connection or session as listed in IANA protocol assignment, which is typically TCP, UDP, or ICMP.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "SrcHostname", "Description": "The source device hostname, excluding domain information. If no device name is available, may store the relevant IP address.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of SrcDomain.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The source device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of SrcDvcId.", "Type": "String", "Entity": null }, { "Name": "ThreatIpAddr", "Description": "An IP address for which a threat was identified. The field ThreatField contains the name of the field ThreatIpAddr represents.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcUserId", "Description": "A machine-readable, alphanumeric, unique representation of the source user.", "Type": "String", "Entity": null }, { "Name": "SrcUserIdType", "Description": "The type of the ID stored in the SrcUserId field.", "Type": "String", "Entity": null }, { "Name": "SrcUsername", "Description": "The source username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcUsernameType", "Description": "Specifies the type of the username stored in the SrcUsername field.", "Type": "String", "Entity": null }, { "Name": "SrcUserType", "Description": "The type of the source user.", "Type": "String", "Entity": null }, { "Name": "SrcOriginalUserType", "Description": "The original destination user type, if provided by the by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstPortNumber", "Description": "The destination IP port.", "Type": "Int32", "Entity": null }, { "Name": "DstHostname", "Description": "The destination device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "DstDomain", "Description": "The domain of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstDomainType", "Description": "The type of DstDomain.", "Type": "String", "Entity": null }, { "Name": "DstFQDN", "Description": "The destination device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "DstDvcId", "Description": "The ID of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstDvcIdType", "Description": "The type of DstDvcId.", "Type": "String", "Entity": null }, { "Name": "DstDeviceType", "Description": "The type of the destination device.", "Type": "String", "Entity": null }, { "Name": "TcpFlagsAck", "Description": "The TCP ACK flag reported. The acknowledgment flag is used to acknowledge the successful receipt of a packet. As we can see from the diagram above, the receiver sends an ACK as well as a SYN in the second step of the three way handshake process to tell the sender that it received its initial packet.", "Type": "Boolean", "Entity": null }, { "Name": "TcpFlagsFin", "Description": "The TCP FIN flag reported. The finished flag means there is no more data from the sender. Therefore, it is used in the last packet sent from the sender.", "Type": "Boolean", "Entity": null }, { "Name": "TcpFlagsPsh", "Description": "The TCP PSH flag reported. The push flag is somewhat similar to the URG flag and tells the receiver to process these packets as they are received instead of buffering them.", "Type": "Boolean", "Entity": null }, { "Name": "TcpFlagsRst", "Description": "The TCP RST flag reported. The reset flag gets sent from the receiver to the sender when a packet is sent to a particular host that was not expecting it.", "Type": "Boolean", "Entity": null }, { "Name": "TcpFlagsUrg", "Description": "The TCP URG flag reported. The urgent flag is used to notify the receiver to process the urgent packets before processing all other packets. The receiver will be notified when all known urgent data has been received. See RFC 6093 for more details.", "Type": "Boolean", "Entity": null }, { "Name": "TcpFlagsSyn", "Description": "The TCP SYN flag reported. The synchronisation flag is used as a first step in establishing a three way handshake between two hosts. Only the first packet from both the sender and receiver should have this flag set.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified. The value is either SrcIpAddr, DstIpAddr, Domain, or DnsResponseName.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "NetworkDuration", "Description": "The amount of time, in milliseconds, for the completion of the network session or connection.", "Type": "Int32", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device. For example: Primary Domain Controller.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source. This value is used to derive EventResultDetails, which should have only one of the values documented for each schema.", "Type": "String", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstDescription", "Description": "A descriptive text associated with the destination.", "Type": "String", "Entity": null }, { "Name": "SrcDescription", "Description": "A descriptive text associated with the source.", "Type": "String", "Entity": null }, { "Name": "DstSystemEntityKey", "Description": "The entity key associated with the destination system.", "Type": "String", "Entity": null }, { "Name": "DstUserEntityKey", "Description": "The entity key associated with the destination user.", "Type": "String", "Entity": null }, { "Name": "DstApplicationEntityKey", "Description": "The entity key associated with the destination application.", "Type": "String", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "SrcUserEntityKey", "Description": "The entity key associated with the source user.", "Type": "String", "Entity": null }, { "Name": "SrcApplicationEntityKey", "Description": "The entity key associated with the source application.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "SrcUserAdditionalIds", "Description": "Additional identifiers associated with the source user.", "Type": "Object", "Entity": null }, { "Name": "DstUserAdditionalIds", "Description": "Additional identifiers associated with the destination user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimProcessEventLogs", "TableSource": "sentinel", "Description": "The Microsoft Sentinel process events normalized table stores events using the Process Event ASIM normalized schema associated with creation or termination of a process. Such events are reported by operating systems and security systems, such as EDR (End Point Detection and Response) systems.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record.", "Type": "Int32", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventType", "Description": "Describes the operation reported by the record", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Describes a subdivision of the operation reported in the EventType field.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason or details for the result reported in the EventResult field.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain. Possible values include \"Windows\" and \"FQDN\".", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "For reporting security systems, the action taken by the system.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "A machine-readable, alphanumeric, unique representation of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of the ID stored in the ActorUserId field.", "Type": "String", "Entity": null }, { "Name": "ActorScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorScope", "Description": "The scope, such as Azure AD tenant, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The Actor's username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "The type of the Actor's username specified in ActionUsername field", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActorOriginalUserType", "Description": "The user type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ActorSessionId", "Description": "The unique ID of the sign-in session of the Actor.", "Type": "String", "Entity": null }, { "Name": "TargetUserId", "Description": "A machine-readable, alphanumeric, unique representation of the actor.", "Type": "String", "Entity": null }, { "Name": "TargetUserIdType", "Description": "The type of the ID stored in the TargetUserId field.", "Type": "String", "Entity": null }, { "Name": "TargetScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which TargetUserId and TargetUsername are defined.", "Type": "String", "Entity": null }, { "Name": "TargetScope", "Description": "The scope, such as Azure AD tenant, in which TargetUserId and TargetUsername are defined.", "Type": "String", "Entity": null }, { "Name": "TargetUsername", "Description": "The Target actor's username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "TargetUsernameType", "Description": "The type of the Target actor's username specified in TargetUsername field", "Type": "String", "Entity": null }, { "Name": "TargetUserType", "Description": "The type of the Target actor.", "Type": "String", "Entity": null }, { "Name": "TargetOriginalUserType", "Description": "The user type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "TargetUserSessionId", "Description": "The unique ID of the sign-in session of the Target actor.", "Type": "String", "Entity": null }, { "Name": "TargetUserSessionGuid", "Description": "The unique guid of the sign-in session of the Target actor.", "Type": "String", "Entity": null }, { "Name": "ActingProcessCommandLine", "Description": "The command line used to run the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessName", "Description": "The name of the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFileCompany", "Description": "The company that created the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFileDescription", "Description": "The description embedded in the version information of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFileProduct", "Description": "The product name from the version information in the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFileVersion", "Description": "The product version from the version information of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFileInternalName", "Description": "The product internal file name from the version information of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFileOriginalName", "Description": "The product original file name from the version information of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFilename", "Description": "The product file name from the version information of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessIsHidden", "Description": "An indication of whether the acting process is in hidden mode.", "Type": "Boolean", "Entity": null }, { "Name": "ActingProcessInjectedAddress", "Description": "The memory address in which the responsible acting process is stored.", "Type": "String", "Entity": null }, { "Name": "ActingProcessId", "Description": "The process ID of the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessGuid", "Description": "A GUID of the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessIntegrityLevel", "Description": "Integrity Level for acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessMD5", "Description": "The MD5 hash of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessSHA1", "Description": "The SHA-1 hash of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessSHA256", "Description": "The SHA-256 hash of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessSHA512", "Description": "The SHA-512 hash of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessIMPHASH", "Description": "The Import Hash of all the library DLLs that are used by the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessCreationTime", "Description": "The date and time when the acting process was started.", "Type": "DateTime", "Entity": null }, { "Name": "ActingProcessTokenElevation", "Description": "A token indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessFileSize", "Description": "The size of the file in bytes that ran the acting process.", "Type": "Int64", "Entity": null }, { "Name": "ParentProcessName", "Description": "The name of the parent process", "Type": "String", "Entity": null }, { "Name": "ParentProcessFileCompany", "Description": "The company that created the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessFileDescription", "Description": "The description from the version information of the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessFileProduct", "Description": "The product name from the version information in the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessFileVersion", "Description": "The product version from the version information of the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessIsHidden", "Description": "An indication of whether the parent process is in hidden mode.", "Type": "Boolean", "Entity": null }, { "Name": "ParentProcessInjectedAddress", "Description": "The memory address in which the responsible parent process is stored.", "Type": "String", "Entity": null }, { "Name": "ParentProcessId", "Description": "The process ID (PID) of the parent process", "Type": "String", "Entity": null }, { "Name": "ParentProcessGuid", "Description": "A GUID of the parent process.", "Type": "String", "Entity": null }, { "Name": "ParentProcessIntegrityLevel", "Description": "Integrity Level for parent process.", "Type": "String", "Entity": null }, { "Name": "ParentProcessMD5", "Description": "The MD5 hash of the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessSHA1", "Description": "The SHA-1 hash of the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessSHA256", "Description": "The SHA-256 hash of the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessSHA512", "Description": "The SHA-512 hash of the parent process image file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessIMPHASH", "Description": "The Import Hash of all the library DLLs that are used by the parent process.", "Type": "String", "Entity": null }, { "Name": "ParentProcessCreationTime", "Description": "The date and time when the parent process was started.", "Type": "DateTime", "Entity": null }, { "Name": "ParentProcessTokenElevation", "Description": "A token indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the parent process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessCommandLine", "Description": "The command line used to run the target process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessName", "Description": "The name of the target process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFileCompany", "Description": "The company that created the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFileDescription", "Description": "The description from the version information of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFileProduct", "Description": "The product name from the version information in the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFileVersion", "Description": "The product version from the version information of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFileInternalName", "Description": "The product internal file name from the version information of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFileOriginalName", "Description": "The product original file name from the version information of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFilename", "Description": "The product file name from the version information of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessIsHidden", "Description": "An indication of whether the target process is in hidden mode.", "Type": "Boolean", "Entity": null }, { "Name": "TargetProcessInjectedAddress", "Description": "The memory address in which the responsible target process is stored.", "Type": "String", "Entity": null }, { "Name": "TargetProcessId", "Description": "The process ID of the target process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessGuid", "Description": "A GUID of the target process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessIntegrityLevel", "Description": "Integrity Level for target process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessMD5", "Description": "The MD5 hash of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessSHA1", "Description": "The SHA-1 hash of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessSHA256", "Description": "The SHA-256 hash of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessSHA512", "Description": "The SHA-512 hash of the target process image file.", "Type": "String", "Entity": null }, { "Name": "TargetProcessIMPHASH", "Description": "The Import Hash of all the library DLLs that are used by the target process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessCreationTime", "Description": "The date and time when the target process was started.", "Type": "DateTime", "Entity": null }, { "Name": "TargetProcessTokenElevation", "Description": "A token indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the target process.", "Type": "String", "Entity": null }, { "Name": "TargetProcessFileSize", "Description": "Size of the file in bytes that ran the process responsible for the event.", "Type": "Int64", "Entity": null }, { "Name": "TargetProcessCurrentDirectory", "Description": "The current directory in which the target process is executed.", "Type": "String", "Entity": null }, { "Name": "TargetProcessStatusCode", "Description": "The exit code returned by the target process when terminated.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule by associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the activity.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in activity.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the identified threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ActorUserEntityKey", "Description": "The entity key associated with the actor user.", "Type": "String", "Entity": null }, { "Name": "ActingProcessEntityKey", "Description": "The entity key associated with the acting process.", "Type": "String", "Entity": null }, { "Name": "ParentProcessEntityKey", "Description": "The entity key associated with the parent process.", "Type": "String", "Entity": null }, { "Name": "TargetUserEntityKey", "Description": "The entity key associated with the target user.", "Type": "String", "Entity": null }, { "Name": "TargetProcessEntityKey", "Description": "The entity key associated with the target process.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "ActorUserAdditionalIds", "Description": "Additional identifiers associated with the actor user.", "Type": "Object", "Entity": null }, { "Name": "TargetUserAdditionalIds", "Description": "Additional identifiers associated with the target user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimRegistryEventLogs", "TableSource": "sentinel", "Description": "The ASim Registry Event schema represents Windows activity of creating, modifying, or deleting Windows Registry entities. Registry events are specific to Windows systems, but are reported by different systems that monitor Windows, such as EDR (End Point Detection and Response) systems, Sysmon, or Windows itself.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "Describes the operation reported by the record.", "Type": "String", "Entity": null }, { "Name": "RegistryKey", "Description": "Registry key that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValue", "Description": "The registry value associated with the operation.", "Type": "String", "Entity": null }, { "Name": "RegistryValueType", "Description": "Data type, such as binary or string, of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueData", "Description": "Data of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryPreviousKey", "Description": "For operations that modify the registry, the original registry key, normalized to standard root key naming.", "Type": "String", "Entity": null }, { "Name": "RegistryPreviousValue", "Description": "For operations that modify the registry, the original value type, normalized to the standard form.", "Type": "String", "Entity": null }, { "Name": "RegistryPreviousValueType", "Description": "For operations that modify the registry, the original value type.", "Type": "String", "Entity": null }, { "Name": "RegistryPreviousValueData", "Description": "The original registry data, for operations that modify the registry.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "A unique ID of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of the ID stored in the ActorUserId field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason or details for the result reported in the EventResult field.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "For reporting security systems, the action taken by the system.", "Type": "String", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record.", "Type": "Int32", "Entity": null }, { "Name": "EventSubType", "Description": "Describes a subdivision of the operation reported in the EventType field.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": ".", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription name on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "ActorUserAadId", "Description": "The Azure Active Directory ID of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserSid", "Description": "The Windows user ID (SIDs) of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorScope", "Description": "The scope, such as Azure AD tenant, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The user name of the user who initiated the event.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "Specifies the type of the user name stored in the ActorUsername field.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActorOriginalUserType", "Description": "The original actor user type, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "ActorSessionId", "Description": "The unique ID of the login session of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActingProcessName", "Description": "The file name of the acting process image file.", "Type": "String", "Entity": null }, { "Name": "ActingProcessId", "Description": "The process ID of the acting process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessCommandLine", "Description": "The command line used to run the process.", "Type": "String", "Entity": null }, { "Name": "ActingProcessGuid", "Description": "A generated unique identifier of the acting process.", "Type": "String", "Entity": null }, { "Name": "ParentProcessName", "Description": "The name of the parent process", "Type": "String", "Entity": null }, { "Name": "ParentProcessId", "Description": "The process ID (PID) of the parent process", "Type": "String", "Entity": null }, { "Name": "ParentProcessCommandLine", "Description": "The command line used to run the process.", "Type": "String", "Entity": null }, { "Name": "ParentProcessGuid", "Description": "A generated unique identifier of the parent process.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule by associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the activity.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in activity.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the identified threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "EventSchema", "Description": "The name of the schema.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time when the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time when the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "ActorUserEntityKey", "Description": "The entity key associated with the actor user.", "Type": "String", "Entity": null }, { "Name": "ActingProcessEntityKey", "Description": "The entity key associated with the acting process.", "Type": "String", "Entity": null }, { "Name": "ParentProcessEntityKey", "Description": "The entity key associated with the parent process.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "ActorUserAdditionalIds", "Description": "Additional identifiers associated with the actor user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimUserManagementActivityLogs", "TableSource": "sentinel", "Description": "The ASim User Management schema represents user management activities, such as creating a user or a group, changing user attribute, or adding a user to a group. Such events are reported, for example, by operating systems, directory services, identity management systems, and any other system reporting on its local user management activity.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "Describes the operation reported by the record.", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The Actor's username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "Specifies the type of the user name stored in the ActorUsername field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason or details for the result reported in the EventResult field.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "For reporting security systems, the action taken by the system.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The Source IP port from which the connection originated.", "Type": "Int32", "Entity": null }, { "Name": "SrcHostname", "Description": "The source device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "SrcMacAddr", "Description": "The MAC address of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of SrcDomain.", "Type": "String", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events described by the record.", "Type": "Int32", "Entity": null }, { "Name": "EventSubType", "Description": "Describes a subdivision of the operation reported in the EventType field.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "DvcDescription", "Description": "A descriptive text associated with the device.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcZone", "Description": "The network on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOs", "Description": "The operating system running on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOsVersion", "Description": "The version of the operating system on the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DvcInterface", "Description": "The network interface on which data was captured.", "Type": "String", "Entity": null }, { "Name": "DvcScopeId", "Description": "The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DvcScope", "Description": "The cloud platform scope the device belongs to. DvcScope map to a subscription name on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "A machine-readable, alphanumeric, unique representation of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserAadId", "Description": "The Azure Active Directory ID of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserSid", "Description": "The Windows user ID (SIDs) of the actor.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of the ID stored in the ActorUserId field.", "Type": "String", "Entity": null }, { "Name": "ActorScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorScope", "Description": "The scope, such as Azure AD tenant, in which ActorUserId and ActorUsername are defined.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of the Actor.", "Type": "String", "Entity": null }, { "Name": "ActorOriginalUserType", "Description": "The original actor user type, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "ActorSessionId", "Description": "The unique ID of the sign-in session of the Actor.", "Type": "String", "Entity": null }, { "Name": "TargetUserId", "Description": "A machine-readable, alphanumeric, unique representation of the target user.", "Type": "String", "Entity": null }, { "Name": "TargetUserUid", "Description": "The Unix or Linux user ID of the user.", "Type": "String", "Entity": null }, { "Name": "TargetUserIdType", "Description": "The type of the ID stored in the TargetUserId field.", "Type": "String", "Entity": null }, { "Name": "TargetUserScopeId", "Description": "The scope ID, such as Azure AD tenant ID, in which TargetUserId and TargetUsername are defined.", "Type": "String", "Entity": null }, { "Name": "TargetUserScope", "Description": "The scope, such as Azure AD tenant name, in which TargetUserId and TargetUsername are defined.", "Type": "String", "Entity": null }, { "Name": "TargetUsername", "Description": "The target username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "TargetUsernameType", "Description": "Specifies the type of the username stored in the TargetUsername field.", "Type": "String", "Entity": null }, { "Name": "TargetUserType", "Description": "The type of target user.", "Type": "String", "Entity": null }, { "Name": "TargetUserSessionId", "Description": "The unique ID of the sign-in session of the user.", "Type": "String", "Entity": null }, { "Name": "TargetOriginalUserType", "Description": "The original destination user type, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "GroupId", "Description": "Identifier for the team or group that the message was sent to", "Type": "String", "Entity": null }, { "Name": "GroupIdType", "Description": "The type of the ID stored in the GroupId field.", "Type": "String", "Entity": null }, { "Name": "GroupName", "Description": "Name of the team or group that the message was sent to", "Type": "String", "Entity": null }, { "Name": "GroupNameType", "Description": "Specifies the type of the group name stored in the GroupName field.", "Type": "String", "Entity": null }, { "Name": "GroupType", "Description": "The type of the group, for activities involving a group.", "Type": "String", "Entity": null }, { "Name": "GroupOriginalType", "Description": "The original group type, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The source device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcDescription", "Description": "A descriptive text associated with the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the source device as reported in the record.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of SrcDvcId.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScopeId", "Description": "The cloud platform scope ID the source device belongs to. SrcDvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScope", "Description": "The cloud platform scope the source device belongs to. SrcDvcScope map to a subscription name on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address..", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcRiskLevel", "Description": "The risk level associated with the identified Source.", "Type": "Int32", "Entity": null }, { "Name": "SrcOriginalRiskLevel", "Description": "The risk level associaeted with the identified Source as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ActingAppId", "Description": "The ID of the application used by the actor to perform the activity, including a process, browser, or service.", "Type": "String", "Entity": null }, { "Name": "ActingAppName", "Description": "The name of the application used by the actor to perform the activity, including a process, browser, or service.", "Type": "String", "Entity": null }, { "Name": "ActingAppType", "Description": "The type of acting application.", "Type": "String", "Entity": null }, { "Name": "ActingOriginalAppType", "Description": "The acting application type as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "HttpUserAgent", "Description": "When authentication is performed over HTTP or HTTPS, this field's value is the user_agent HTTP header provided by the acting application when performing the authentication.", "Type": "String", "Entity": null }, { "Name": "PreviousPropertyValue", "Description": "The previous value that was stored in the specified property.", "Type": "String", "Entity": null }, { "Name": "NewPropertyValue", "Description": "The new value stored in the specified property.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule by associated with the inspection results.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule associated with the inspection results.", "Type": "Int32", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the activity.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in activity.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the identified threat. The level should be a number between 0 and 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "EventSchema", "Description": "The name of the schema", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time when the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time when the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "TargetUserEntityKey", "Description": "The entity key associated with the target user.", "Type": "String", "Entity": null }, { "Name": "ActorUserEntityKey", "Description": "The entity key associated with the actor user.", "Type": "String", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "ActingApplicationEntityKey", "Description": "The entity key associated with the acting application.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "ActorUserAdditionalIds", "Description": "Additional identifiers associated with the actor user.", "Type": "Object", "Entity": null }, { "Name": "TargetUserAdditionalIds", "Description": "Additional identifiers associated with the target user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ASimWebSessionLogs", "TableSource": "sentinel", "Description": "The Advanced Security Information Model (ASIM) Web Session normalization schema - describe an IP network activity. For example, IP network activities are reported by web servers, web proxies, and web security gateways.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) reflecting the time in which the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "Dvc", "Description": "A unique identifier of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP Address of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The hostname of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomain", "Description": "The domain of the device reporting the event.", "Type": "String", "Entity": null }, { "Name": "DvcDomainType", "Description": "The type of DvcDomain. Possible values include 'Windows' and 'FQDN'.", "Type": "String", "Entity": null }, { "Name": "DvcFQDN", "Description": "The hostname of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcId", "Description": "The unique ID of the device on which the event occurred or which reported the event.", "Type": "String", "Entity": null }, { "Name": "DvcIdType", "Description": "The type of DvcId.", "Type": "String", "Entity": null }, { "Name": "DvcAction", "Description": "The action taken on the web session.", "Type": "String", "Entity": null }, { "Name": "DvcOriginalAction", "Description": "The original DvcAction as provided by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "This value is used when the source supports aggregation, and a single record may represent multiple events.", "Type": "Int32", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field.", "Type": "DateTime", "Entity": null }, { "Name": "EventType", "Description": "The operation reported by the record.", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Additional description of the event type, if applicable.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "The HTTP status code.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "A unique ID of the original record, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original event type or ID, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSubType", "Description": "The original event subtype or ID, if provided by the source. For example, this field will be used to store the original Windows logon type. This value is used to derive EventSubType, which should have only one of the values documented for each schema.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "The original result details provided by the source. This value is used to derive EventResultDetails, which should have only one of the values documented for each schema.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity of the event. Valid values are: Informational, Low, Medium, or High.", "Type": "String", "Entity": null }, { "Name": "EventOriginalSeverity", "Description": "The original severity as provided by the reporting device. This value is used to derive EventSeverity.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "The version of the schema.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A URL provided in the event for a resource that provides more information about the event.", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "DstAppName", "Description": "The name of the destination application.", "Type": "String", "Entity": null }, { "Name": "DstAppId", "Description": "The ID of the destination application, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstAppType", "Description": "The type of the destination application.", "Type": "String", "Entity": null }, { "Name": "DstIpAddr", "Description": "The IP address of the connection or session destination.", "Type": "String", "Entity": null }, { "Name": "DstPortNumber", "Description": "The destination IP port.", "Type": "Int32", "Entity": null }, { "Name": "DstHostname", "Description": "The destination device hostname, excluding domain information.", "Type": "String", "Entity": null }, { "Name": "DstDomain", "Description": "The domain of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstDomainType", "Description": "The type of DstDomain.", "Type": "String", "Entity": null }, { "Name": "DstFQDN", "Description": "The destination device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "DstDvcId", "Description": "The ID of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstDvcIdType", "Description": "The type of DstDvcId.", "Type": "String", "Entity": null }, { "Name": "DstDeviceType", "Description": "The type of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstGeoCountry", "Description": "The country associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoRegion", "Description": "The region, or state, within a country associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoCity", "Description": "The city associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the destination IP address.", "Type": "Double", "Entity": null }, { "Name": "DstGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the destination IP address.", "Type": "Double", "Entity": null }, { "Name": "DstUserId", "Description": "A machine-readable, alphanumeric, unique representation of the destination user.", "Type": "String", "Entity": null }, { "Name": "DstUserIdType", "Description": "The type of the ID stored in the DstUserId field.", "Type": "String", "Entity": null }, { "Name": "DstUsername", "Description": "The destination username, including domain information when available. Use the simple form only if domain information isn't available.", "Type": "String", "Entity": null }, { "Name": "DstUsernameType", "Description": "Specifies the type of the username stored in the DstUsername field.", "Type": "String", "Entity": null }, { "Name": "DstUserType", "Description": "The type of destination user.", "Type": "String", "Entity": null }, { "Name": "DstOriginalUserType", "Description": "The original destination user type, if provided by the source.", "Type": "String", "Entity": null }, { "Name": "NetworkApplicationProtocol", "Description": "The application layer protocol used by the connection or session.", "Type": "String", "Entity": null }, { "Name": "NetworkProtocol", "Description": "The IP protocol used by the connection or session as listed in IANA protocol assignment, which is typically TCP, UDP, or ICMP.", "Type": "String", "Entity": null }, { "Name": "NetworkProtocolVersion", "Description": "The version of NetworkProtocol.", "Type": "String", "Entity": null }, { "Name": "NetworkDirection", "Description": "The direction of the connection or session.", "Type": "String", "Entity": null }, { "Name": "NetworkDuration", "Description": "The amount of time, in milliseconds, for the completion of the web session or connection.", "Type": "Int32", "Entity": null }, { "Name": "NetworkIcmpType", "Description": "For an ICMP message, the ICMP message type text representation, as described in RFC 2780 for IPv4 network connections, or in RFC 4443 for IPv6 network connections.", "Type": "String", "Entity": null }, { "Name": "NetworkIcmpCode", "Description": "For an ICMP message, the ICMP message type numeric value as described in RFC 2780 for IPv4 network connections, or in RFC 4443 for IPv6 network connections.", "Type": "Int32", "Entity": null }, { "Name": "NetworkConnectionHistory", "Description": "TCP flags and other potential IP header information.", "Type": "String", "Entity": null }, { "Name": "DstBytes", "Description": "The number of bytes sent from the destination to the source for the connection or session. If the event is aggregated, DstBytes is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "SrcBytes", "Description": "The number of bytes sent from the source to the destination for the connection or session. If the event is aggregated, SrcBytes is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "NetworkBytes", "Description": "Number of bytes sent in both directions. If both BytesReceived and BytesSent exist, BytesTotal should equal their sum. If the event is aggregated, NetworkBytes is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "DstPackets", "Description": "The number of packets sent from the destination to the source for the connection or session. The meaning of a packet is defined by the reporting device. If the event is aggregated, DstPackets is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "SrcPackets", "Description": "The number of packets sent from the source to the destination for the connection or session. The meaning of a packet is defined by the reporting device. If the event is aggregated, SrcPackets is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "NetworkPackets", "Description": "The number of packets sent in both directions. If both PacketsReceived and PacketsSent exist, BytesTotal should equal their sum. The meaning of a packet is defined by the reporting device. If the event is aggregated, NetworkPackets is the sum over all aggregated sessions.", "Type": "Int64", "Entity": null }, { "Name": "NetworkSessionId", "Description": "The session identifier as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatOriginalRiskLevel", "Description": "The risk level as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIpAddr", "Description": "An IP address for which a threat was identified. The field ThreatField contains the name of the field ThreatIpAddr represents.", "Type": "String", "Entity": null }, { "Name": "ThreatField", "Description": "The field for which a threat was identified. The value is either SrcIpAddr, DstIpAddr, Domain, or DnsResponseName.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The confidence level of the threat identified, normalized to a value between 0 and a 100.", "Type": "Int32", "Entity": null }, { "Name": "ThreatOriginalConfidence", "Description": "The original confidence level of the threat identified, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "ThreatIsActive", "Description": "True ID the threat identified is considered an active threat.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatFirstReportedTime", "Description": "The first time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "ThreatLastReportedTime", "Description": "The last time the IP address or domain were identified as a threat.", "Type": "DateTime", "Entity": null }, { "Name": "DstNatIpAddr", "Description": "The DstNatIpAddr represents either of: The original address of the destination device if network address translation was used or the IP address used by the intermediary device for communication with the source.", "Type": "String", "Entity": null }, { "Name": "DstNatPortNumber", "Description": "If reported by an intermediary NAT device, the port used by the NAT device for communication with the source.", "Type": "Int32", "Entity": null }, { "Name": "SrcNatIpAddr", "Description": "The SrcNatIpAddr represents either of: The original address of the source device if network address translation was used or the IP address used by the intermediary device for communication with the destination.", "Type": "String", "Entity": null }, { "Name": "SrcNatPortNumber", "Description": "If reported by an intermediary NAT device, the port used by the NAT device for communication with the destination.", "Type": "Int32", "Entity": null }, { "Name": "SrcAppName", "Description": "The name of the source application.", "Type": "String", "Entity": null }, { "Name": "SrcAppId", "Description": "The ID of the source application, as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcAppType", "Description": "The type of the source application.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The IP port from which the connection originated. Might not be relevant for a session comprising multiple connections.", "Type": "Int32", "Entity": null }, { "Name": "SrcHostname", "Description": "The source device hostname, excluding domain information. If no device name is available, may store the relevant IP address.", "Type": "String", "Entity": null }, { "Name": "SrcDomain", "Description": "The domain of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDomainType", "Description": "The type of SrcDomain.", "Type": "String", "Entity": null }, { "Name": "SrcFQDN", "Description": "The source device hostname, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The ID of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of SrcDvcId.", "Type": "String", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcUserId", "Description": "A machine-readable, alphanumeric, unique representation of the source user.", "Type": "String", "Entity": null }, { "Name": "SrcUserIdType", "Description": "The type of the ID stored in the SrcUserId field.", "Type": "String", "Entity": null }, { "Name": "SrcUsername", "Description": "The source username, including domain information when available.", "Type": "String", "Entity": null }, { "Name": "SrcUsernameType", "Description": "Specifies the type of the username stored in the SrcUsername field.", "Type": "String", "Entity": null }, { "Name": "SrcUserType", "Description": "The type of the source user.", "Type": "String", "Entity": null }, { "Name": "SrcOriginalUserType", "Description": "The original destination user type, if provided by the by the reporting device.", "Type": "String", "Entity": null }, { "Name": "Url", "Description": "Full Url from email", "Type": "String", "Entity": null }, { "Name": "UrlCategory", "Description": "The defined grouping of a URL or the domain part of the URL.", "Type": "String", "Entity": null }, { "Name": "UrlOriginal", "Description": "The original value of the URL, when the URL was modified by the reporting device and both values are provided.", "Type": "String", "Entity": null }, { "Name": "HttpVersion", "Description": "The HTTP Request Version.", "Type": "String", "Entity": null }, { "Name": "HttpRequestMethod", "Description": "The HTTP Method.", "Type": "String", "Entity": null }, { "Name": "HttpContentType", "Description": "The HTTP Response content type header.", "Type": "String", "Entity": null }, { "Name": "HttpContentFormat", "Description": "The content format part of the HttpContentType.", "Type": "String", "Entity": null }, { "Name": "HttpReferrer", "Description": "The HTTP referrer header.", "Type": "String", "Entity": null }, { "Name": "HttpUserAgent", "Description": "The HTTP user agent header.", "Type": "String", "Entity": null }, { "Name": "HttpRequestXff", "Description": "The HTTP X-Forwarded-For header.", "Type": "String", "Entity": null }, { "Name": "HttpRequestTime", "Description": "The amount of time, in milliseconds, it took to send the request to the server.", "Type": "Int32", "Entity": null }, { "Name": "HttpResponseTime", "Description": "The amount of time, in milliseconds, it took to receive a response in the server.", "Type": "Int32", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FileMD5", "Description": "For HTTP uploads, the MD5 hash of the uploaded file.", "Type": "String", "Entity": null }, { "Name": "FileSHA1", "Description": "For HTTP uploads, the SHA1 hash of the uploaded file.", "Type": "String", "Entity": null }, { "Name": "FileSHA256", "Description": "For HTTP uploads, the SHA256 hash of the uploaded file.", "Type": "String", "Entity": null }, { "Name": "FileSHA512", "Description": "For HTTP uploads, the SHA512 hash of the uploaded file.", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int32", "Entity": null }, { "Name": "FileContentType", "Description": "For HTTP uploads, the content type of the uploaded file.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name or ID of the rule by which DvcAction was decided upon. Example: AnyAnyDrop.", "Type": "String", "Entity": null }, { "Name": "RuleNumber", "Description": "The number of the rule by which DvcAction was decided upon. Example: 23.", "Type": "Int32", "Entity": null }, { "Name": "Rule", "Description": "Either NetworkRuleName or NetworkRuleNumber.", "Type": "String", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of the threat or malware identified in the web session.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of the threat or malware identified in the web session.", "Type": "String", "Entity": null }, { "Name": "ThreatRiskLevel", "Description": "The risk level associated with the session. The level is a number between 0 to 100.", "Type": "Int32", "Entity": null }, { "Name": "HttpHost", "Description": "The virtual web server the HTTP request has targeted.", "Type": "String", "Entity": null }, { "Name": "EventOwner", "Description": "The owner of the event, which is usually the department or subsidiary in which it was generated.", "Type": "String", "Entity": null }, { "Name": "SrcProcessName", "Description": "The name of the source process.", "Type": "String", "Entity": null }, { "Name": "SrcProcessId", "Description": "The process ID (PID) of the source process.", "Type": "String", "Entity": null }, { "Name": "SrcProcessGuid", "Description": "A generated unique identifier (GUID) of the source process.", "Type": "String", "Entity": null }, { "Name": "SrcUserScope", "Description": "The scope, such as Azure AD tenant, in which SrcUserId and SrcUsername are defined.", "Type": "String", "Entity": null }, { "Name": "SrcUserScopeId", "Description": "The ID of the scope, such as Azure AD tenant, in which SrcUserId and SrcUsername are defined.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScopeId", "Description": "The cloud platform scope ID the source device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcDvcScope", "Description": "The cloud platform scope the source device belongs to. DvcScope maps to a subscription on Azure and to an account on AWS.", "Type": "String", "Entity": null }, { "Name": "DstDvcScopeId", "Description": "The cloud platform scope ID the destination device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS.", "Type": "String", "Entity": null }, { "Name": "DstDvcScope", "Description": "The cloud platform scope the destination device belongs to. DvcScope maps to a subscription on Azure and to an account on AWS.", "Type": "String", "Entity": null }, { "Name": "SrcMacAddr", "Description": "The MAC address of the network interface from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "DstMacAddr", "Description": "The MAC address of the network interface used for the connection or session by the destination device.", "Type": "String", "Entity": null }, { "Name": "DstSystemEntityKey", "Description": "The entity key associated with the destination system.", "Type": "String", "Entity": null }, { "Name": "DstUserEntityKey", "Description": "The entity key associated with the destination user.", "Type": "String", "Entity": null }, { "Name": "DstApplicationEntityKey", "Description": "The entity key associated with the destination application.", "Type": "String", "Entity": null }, { "Name": "SrcSystemEntityKey", "Description": "The entity key associated with the source system.", "Type": "String", "Entity": null }, { "Name": "SrcUserEntityKey", "Description": "The entity key associated with the source user.", "Type": "String", "Entity": null }, { "Name": "SrcApplicationEntityKey", "Description": "The entity key associated with the source application.", "Type": "String", "Entity": null }, { "Name": "DvcEntityKey", "Description": "The entity key associated with the device.", "Type": "String", "Entity": null }, { "Name": "SrcUserAdditionalIds", "Description": "Additional identifiers associated with the source user.", "Type": "Object", "Entity": null }, { "Name": "DstUserAdditionalIds", "Description": "Additional identifiers associated with the destination user.", "Type": "Object", "Entity": null }, { "Name": "AdditionalEntities", "Description": "Additional entities associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSALBAccessLogs", "TableSource": "sentinel", "Description": "This connector allows you to ingest AWS Elastic Load Balancer (ALB, NLB and GLB) logs into Microsoft Sentinel. These logs contain detailed records for requests handled by your load balancers, including client IPs, latencies, request paths, and status codes. These logs are useful for monitoring traffic patterns, investigating anomalies, and ensuring security compliance.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time when the load balancer received the request.", "Type": "DateTime", "Entity": null }, { "Name": "ALBType", "Description": "The type of request (e.g., http or https).", "Type": "String", "Entity": null }, { "Name": "Alb", "Description": "The ARN of the Application Load Balancer.", "Type": "String", "Entity": null }, { "Name": "ClientIp", "Description": "The IP address of the client.", "Type": "String", "Entity": null }, { "Name": "ClientPort", "Description": "The port number of the client.", "Type": "Int32", "Entity": null }, { "Name": "TargetIp", "Description": "The IP address of the target that processed the request.", "Type": "String", "Entity": null }, { "Name": "TargetPort", "Description": "The port number of the target that processed the request.", "Type": "Int32", "Entity": null }, { "Name": "RequestProcessingTime", "Description": "The total time taken by the load balancer to receive the request from the client.", "Type": "String", "Entity": null }, { "Name": "TargetProcessingTime", "Description": "The total time taken by the target to process the request.", "Type": "String", "Entity": null }, { "Name": "ResponseProcessingTime", "Description": "The total time taken by the load balancer to send the response to the client.", "Type": "String", "Entity": null }, { "Name": "ElbStatusCode", "Description": "The status code sent from the load balancer to the client.", "Type": "Int32", "Entity": null }, { "Name": "TargetStatusCode", "Description": "The status code received from the target.", "Type": "String", "Entity": null }, { "Name": "ReceivedBytes", "Description": "The size of the request, in bytes, received from the client.", "Type": "Int64", "Entity": null }, { "Name": "SentBytes", "Description": "The size of the response, in bytes, sent to the client.", "Type": "Int64", "Entity": null }, { "Name": "RequestRaw", "Description": "The complete request line from the client.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "SslCipher", "Description": "The SSL cipher used for the SSL connection (if any).", "Type": "String", "Entity": null }, { "Name": "SslProtocol", "Description": "The SSL protocol used for the SSL connection (if any).", "Type": "String", "Entity": null }, { "Name": "TargetGroupArn", "Description": "The ARN of the target group that handled the request.", "Type": "String", "Entity": null }, { "Name": "TraceId", "Description": "The trace identifier for the request, useful for debugging.", "Type": "String", "Entity": null }, { "Name": "DomainName", "Description": "Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack", "Type": "String", "Entity": null }, { "Name": "ChosenCertArn", "Description": "The ARN of the certificate presented to the client.", "Type": "String", "Entity": null }, { "Name": "MatchedRulePriority", "Description": "The priority value of the rule that matched the request.", "Type": "String", "Entity": null }, { "Name": "RequestCreationTime", "Description": "The timestamp when the load balancer generated the request to the target.", "Type": "String", "Entity": null }, { "Name": "ActionsExecuted", "Description": "The actions taken when processing the request (e.g., forward, fixed-response, redirect).", "Type": "String", "Entity": null }, { "Name": "RedirectUrl", "Description": "The URL of the redirect target, if a redirect action was taken.", "Type": "String", "Entity": null }, { "Name": "LambdaErrorReason", "Description": "The reason code for a failed Lambda function, if applicable.", "Type": "String", "Entity": null }, { "Name": "TargetPortList", "Description": "A list of IP:port pairs of the targets that handled the request.", "Type": "String", "Entity": null }, { "Name": "TargetStatusCodeList", "Description": "A list of status codes returned by the targets.", "Type": "String", "Entity": null }, { "Name": "Classification", "Description": "Classification of the request (e.g., success or error).", "Type": "String", "Entity": null }, { "Name": "ClassificationReason", "Description": "The reason why a request was classified in a certain way.", "Type": "String", "Entity": null }, { "Name": "ConnTraceId", "Description": "The connection trace ID that uniquely identifies the connection.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSCloudTrail", "TableSource": "sentinel", "Description": "CloudTrail logs, which ingested from Sentinel's connector, holds all your data and management events of your Amazon Wev Services account.", "Schema": [ { "Name": "TimeGenerated", "Description": "The timestamp (UTC). An event's time stamp comes from the local host that provides the service API endpoint on which the API call was made.", "Type": "DateTime", "Entity": null }, { "Name": "AwsEventId", "Description": "GUID generated by CloudTrail to uniquely identify each event. You can use this value to identify a single event.", "Type": "String", "Entity": null }, { "Name": "EventVersion", "Description": "The version of the log event format.", "Type": "String", "Entity": null }, { "Name": "EventSource", "Description": "The service that the request was made to. This name is typically a short form of the service name without spaces plus .amazonaws.com.", "Type": "String", "Entity": null }, { "Name": "EventTypeName", "Description": "Identifies the type of event that generated the event record. This can be the one of the following values: AwsApiCall, AwsServiceEvent, AwsConsoleAction , AwsConsoleSignIn.", "Type": "String", "Entity": null }, { "Name": "EventName", "Description": "The requested action, which is one of the actions in the API for that service.", "Type": "String", "Entity": null }, { "Name": "UserIdentityType", "Description": "The type of the identity. The following values are possible: Root, IAMUser, AssumedRole, FederatedUser, Directory, AWSAccount, AWSService, Unknown.", "Type": "String", "Entity": null }, { "Name": "UserIdentityPrincipalid", "Description": "A unique identifier for the entity that made the call.", "Type": "String", "Entity": null }, { "Name": "UserIdentityArn", "Description": "The Amazon Resource Name (ARN) of the principal that made the call.", "Type": "String", "Entity": null }, { "Name": "UserIdentityAccountId", "Description": "The account that owns the entity that granted permissions for the request.", "Type": "String", "Entity": null }, { "Name": "UserIdentityInvokedBy", "Description": "The name of the AWS service that made the request.", "Type": "String", "Entity": null }, { "Name": "UserIdentityAccessKeyId", "Description": "The access key ID that was used to sign the request.", "Type": "String", "Entity": null }, { "Name": "UserIdentityUserName", "Description": "The name of the identity that made the call.", "Type": "String", "Entity": null }, { "Name": "SessionMfaAuthenticated", "Description": "The value is true if the root user or IAM user whose credentials were used for the request also was authenticated with an MFA device; otherwise, false.", "Type": "Boolean", "Entity": null }, { "Name": "SessionCreationDate", "Description": "The date and time when the temporary security credentials were issued.", "Type": "DateTime", "Entity": null }, { "Name": "SessionIssuerType", "Description": "The source of the temporary security credentials, such as Root, IAMUser, or Role.", "Type": "String", "Entity": null }, { "Name": "SessionIssuerPrincipalId", "Description": "The internal ID of the entity that was used to get credentials.", "Type": "String", "Entity": null }, { "Name": "SessionIssuerArn", "Description": "The ARN of the source (account, IAM user, or role) that was used to get temporary security credentials.", "Type": "String", "Entity": null }, { "Name": "SessionIssuerAccountId", "Description": "The account that owns the entity that was used to get credentials.", "Type": "String", "Entity": null }, { "Name": "SessionIssuerUserName", "Description": "The friendly name of the user or role that issued the session.", "Type": "String", "Entity": null }, { "Name": "AWSRegion", "Description": "The AWS region that the request was made to.", "Type": "String", "Entity": null }, { "Name": "SourceIpAddress", "Description": "IP address where the attacker communication originated from and was blocked by automatic attack disruption", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "ErrorCode", "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Type": "String", "Entity": null }, { "Name": "ErrorMessage", "Description": "The error description when available. This message includes messages for authorization failures. CloudTrail captures the message logged by the service in its exception handling.", "Type": "String", "Entity": null }, { "Name": "RequestParameters", "Description": "The parameters, if any, that were sent with the request. These parameters are documented in the API reference documentation for the appropriate AWS service.", "Type": "String", "Entity": null }, { "Name": "ResponseElements", "Description": "The response element for actions that make changes (create, update, or delete actions). If an action does not change state (for example, a request to get or list objects), this element is omitted.", "Type": "String", "Entity": null }, { "Name": "AdditionalEventData", "Description": "Additional data about the event that was not part of the request or response.", "Type": "String", "Entity": null }, { "Name": "AwsRequestId", "Description": "deprecated, please use AwsRequestId_ instead.", "Type": "String", "Entity": null }, { "Name": "AwsRequestId_", "Description": "The value that identifies the request. The service being called generates this value.", "Type": "String", "Entity": null }, { "Name": "Resources", "Description": "A list of resources accessed in the event.", "Type": "String", "Entity": null }, { "Name": "APIVersion", "Description": "Identifies the API version associated with the AwsApiCall eventType value.", "Type": "String", "Entity": null }, { "Name": "ReadOnly", "Description": "Identifies whether this operation is a read-only operation.", "Type": "Boolean", "Entity": null }, { "Name": "RecipientAccountId", "Description": "Represents the account ID that received this event. The recipientAccountID may be different from the CloudTrail userIdentity Element accountId. This can occur in cross-account resource access.", "Type": "String", "Entity": null }, { "Name": "ServiceEventDetails", "Description": "Identifies the service event, including what triggered the event and the result.", "Type": "String", "Entity": null }, { "Name": "SharedEventId", "Description": "GUID generated by CloudTrail to uniquely identify CloudTrail events from the same AWS action that is sent to different AWS accounts.", "Type": "String", "Entity": null }, { "Name": "VpcEndpointId", "Description": "Identifies the VPC endpoint in which requests were made from a VPC to another AWS service.", "Type": "String", "Entity": null }, { "Name": "ManagementEvent", "Description": "A Boolean value that identifies whether the event is a management event.", "Type": "Boolean", "Entity": null }, { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "Constant value: AWSCloudTrail.", "Type": "String", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "EC2RoleDelivery", "Description": "The friendly name of the user or role that issued the session.", "Type": "String", "Entity": null }, { "Name": "TlsVersion", "Description": "Optional. Part of tlsDetails. The TLS version of a request.", "Type": "String", "Entity": null }, { "Name": "CipherSuite", "Description": "Optional. Part of tlsDetails. The cipher suite (combination of security algorithms used) of a request.", "Type": "String", "Entity": null }, { "Name": "ClientProvidedHostHeader", "Description": "Optional. Part of tlsDetails. The client-provided host name used in the service API call, which is typically the FQDN of the service endpoint.", "Type": "String", "Entity": null }, { "Name": "IpProtocol", "Description": "The IP protocol is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The IP protocol name or number. The valid values are tcp, udp, icmp, or a protocol number.", "Type": "String", "Entity": null }, { "Name": "SourcePort", "Description": "Port where the attacker communication originated from", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "String", "Entity": null }, { "Name": "CidrIp", "Description": "The CIDR IP is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The IPv4 CIDR range.", "Type": "String", "Entity": null }, { "Name": "UserIdentityUserId", "Description": "Unique internal AWS identifier of the IAM entity (user, role, or federated identity) that performed the action.", "Type": "String", "Entity": null }, { "Name": "UserIdentityStoreArn", "Description": "ARN of the identity store (e.g., IAM Identity Center/SSO directory) from which the user identity originates.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSCloudWatch", "TableSource": "sentinel", "Description": "The CloudWatch Logs provide performance and billing data from the AWS CloudWatch service which helps the user better understand and operate the AWS system and application.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "ExtractedTime", "Description": "The timestamp (UTC) of when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the event was generated and equals to 'ExtractedTime' when included in message. If timestamp is missing, it’s set to the ingestion time.", "Type": "DateTime", "Entity": null }, { "Name": "Message", "Description": "The data contained within logs from CloudWatch.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSEKSLogs", "TableSource": "sentinel", "Description": "AWS EKS audit logs, which ingested from Sentinel's connector, contain detailed information about API server requests, authentication decisions, and cluster activities from Amazon Elastic Kubernetes Service. These logs provide comprehensive security monitoring and compliance tracking for Kubernetes clusters.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the EKS audit event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AwsAccountId", "Description": "The AWS account ID where the EKS cluster is located.", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The AWS region where the EKS cluster is located.", "Type": "String", "Entity": null }, { "Name": "ClusterName", "Description": "The name of the EKS cluster that generated the audit event.", "Type": "String", "Entity": null }, { "Name": "Verb", "Description": "The Kubernetes API verb (action) performed (e.g., get, create, update, delete).", "Type": "String", "Entity": null }, { "Name": "User", "Description": "The user or service account that performed the action.", "Type": "String", "Entity": null }, { "Name": "SourceIPs", "Description": "Array of source IP addresses from where the request originated.", "Type": "Object", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "ObjectRef", "Description": "Reference to the Kubernetes object that was accessed (namespace/resource/name).", "Type": "String", "Entity": null }, { "Name": "ResponseCode", "Description": "The HTTP response status code of the API request.", "Type": "Int32", "Entity": null }, { "Name": "Stage", "Description": "The stage of request processing when the audit event was generated (e.g., RequestReceived, ResponseComplete).", "Type": "String", "Entity": null }, { "Name": "AuthDecision", "Description": "The authorization decision made by the Kubernetes RBAC system (e.g., allow, forbid).", "Type": "String", "Entity": null }, { "Name": "RawEvent", "Description": "The complete raw EKS audit event data containing additional context and metadata.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSELBFlowLogs", "TableSource": "sentinel", "Description": "This connector allows you to ingest AWS Elastic Load Balancer (ALB, NLB and GLB) logs into Microsoft Sentinel. These logs contain detailed records for requests handled by your load balancers, including client IPs, latencies, request paths, and status codes. These logs are useful for monitoring traffic patterns, investigating anomalies, and ensuring security compliance.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log was collected or ingested.", "Type": "DateTime", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "InterfaceId", "Description": "The ID of the network interface for which the traffic is recorded.", "Type": "String", "Entity": null }, { "Name": "SourceAddress", "Description": "The source IP address of the traffic.", "Type": "String", "Entity": null }, { "Name": "DestinationAddress", "Description": "The destination IP address of the traffic.", "Type": "String", "Entity": null }, { "Name": "SourcePort", "Description": "Port where the attacker communication originated from", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "Packets", "Description": "The number of packets transferred during the flow.", "Type": "String", "Entity": null }, { "Name": "Bytes", "Description": "The number of bytes transferred during the flow.", "Type": "String", "Entity": null }, { "Name": "SStartTime", "Description": "The start time of the flow in Unix seconds.", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "LogStatus", "Description": "Indicates the logging status (e.g., OK, NODATA, SKIPDATA).", "Type": "String", "Entity": null }, { "Name": "LogType", "Description": "Type of the log (e.g., VPCFlowLog, TransitGatewayFlowLog).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSGuardDuty", "TableSource": "sentinel", "Description": "Guard Duty Findings, which ingested from Sentinel's connector, represents a potential security issue detected within your network. GuardDuty generates a finding whenever it detects unexpected and potentially malicious activity in your AWS environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was generated, The last time this finding was updated with new activity matching the pattern that prompted GuardDuty to generate this finding.", "Type": "DateTime", "Entity": null }, { "Name": "SchemaVersion", "Description": "The Guard Duty finding version.", "Type": "String", "Entity": null }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The AWS region in which the finding was generated.", "Type": "String", "Entity": null }, { "Name": "Partition", "Description": "The AWS partition in which the finding was generated.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "Arn", "Description": "Amazon resource name of the finding.", "Type": "String", "Entity": null }, { "Name": "ActivityType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "ResourceDetails", "Description": "Gives details on the AWS resource that was targeted by the trigger activity. The information available varies based on resource type and action typ.", "Type": "Object", "Entity": null }, { "Name": "ServiceDetails", "Description": "Gives details on the AWS service that was related to the finding, including Action, Actor/Target, Evidence, Anomalous behavior and Additional information.", "Type": "Object", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "Int32", "Entity": null }, { "Name": "TimeCreated", "Description": "The time and date when this finding was first created. If this value differs from Updated at (TimeGenerated), it indicates that the activity has occurred multiple times and is an ongoing issue.", "Type": "DateTime", "Entity": null }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSNLBAccessLogs", "TableSource": "sentinel", "Description": "This connector allows you to ingest AWS Elastic Load Balancer (ALB, NLB and GLB) logs into Microsoft Sentinel. These logs contain detailed records for requests handled by your load balancers, including client IPs, latencies, request paths, and status codes. These logs are useful for monitoring traffic patterns, investigating anomalies, and ensuring security compliance.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp when the log entry was generated.", "Type": "DateTime", "Entity": null }, { "Name": "NLBType", "Description": "Type of Network Load Balancer (e.g., 'gateway', 'application').", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "Nlb", "Description": "Identifier or name of the Network Load Balancer.", "Type": "String", "Entity": null }, { "Name": "Listener", "Description": "Listener configuration used for the connection (protocol and port).", "Type": "String", "Entity": null }, { "Name": "ClientIPPort", "Description": "IP address and port of the client initiating the request.", "Type": "String", "Entity": null }, { "Name": "TargetIPPort", "Description": "IP address and port of the target receiving the request.", "Type": "String", "Entity": null }, { "Name": "ConnectionTime", "Description": "Duration of the connection in milliseconds.", "Type": "String", "Entity": null }, { "Name": "TlsHandshakeTime", "Description": "Time taken to complete the TLS handshake in milliseconds.", "Type": "String", "Entity": null }, { "Name": "ReceivedBytes", "Description": "Number of bytes received from the client.", "Type": "String", "Entity": null }, { "Name": "SentBytes", "Description": "Number of bytes sent to the client.", "Type": "String", "Entity": null }, { "Name": "IncomingTLSAlert", "Description": "Details of any incoming TLS alert message.", "Type": "String", "Entity": null }, { "Name": "ChosenCertArn", "Description": "ARN of the TLS certificate selected during the handshake.", "Type": "String", "Entity": null }, { "Name": "ChosenCertSerial", "Description": "Serial number of the TLS certificate used in the connection.", "Type": "String", "Entity": null }, { "Name": "TLSCipher", "Description": "Cipher suite used for the TLS connection.", "Type": "String", "Entity": null }, { "Name": "TLSProtocolVersion", "Description": "Version of the TLS protocol used (e.g., TLS 1.2, TLS 1.3).", "Type": "String", "Entity": null }, { "Name": "TLSNamedGroup", "Description": "Elliptic curve or Diffie-Hellman group used in the handshake.", "Type": "String", "Entity": null }, { "Name": "DomainName", "Description": "Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack", "Type": "String", "Entity": null }, { "Name": "ALPNFEProtocol", "Description": "Application-layer protocol negotiated on the frontend (e.g., HTTP/1.1, h2).", "Type": "String", "Entity": null }, { "Name": "ALPNBEProtocol", "Description": "Application-layer protocol negotiated on the backend.", "Type": "String", "Entity": null }, { "Name": "ALPNClientPrefList", "Description": "List of application protocols preferred by the client during ALPN.", "Type": "String", "Entity": null }, { "Name": "TLSConnectionCreationTime", "Description": "Time taken to establish the complete TLS connection, including handshake.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSNetworkFirewallAlert", "TableSource": "sentinel", "Description": "The AWS Platform Firewall Alert logs , ingested from Sentinel's connector, enabling real-time analysis and correlation with other security data sources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log entry was created in AWS Network Firewall.", "Type": "DateTime", "Entity": null }, { "Name": "FirewallName", "Description": "The name of the AWS Network Firewall instance generating the log.", "Type": "String", "Entity": null }, { "Name": "AvailabilityZone", "Description": "The AWS Availability Zone where the firewall instance is located.", "Type": "String", "Entity": null }, { "Name": "TxId", "Description": "The transaction ID associated with the specific network flow.", "Type": "String", "Entity": null }, { "Name": "EventTimestamp", "Description": "The epoch timestamp of when the event occurred.", "Type": "DateTime", "Entity": null }, { "Name": "AppProto", "Description": "The application layer protocol detected.", "Type": "String", "Entity": null }, { "Name": "SrcIp", "Description": "The source port from which the packet originated.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "The source port from which the packet originated.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "The type of event recorded (e.g., alert, flow, drop, pass).", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "SignatureId", "Description": "The unique identifier of the Suricata rule that matched the event.", "Type": "String", "Entity": null }, { "Name": "Rev", "Description": "The revision number of the matched Suricata rule.", "Type": "String", "Entity": null }, { "Name": "Signature", "Description": "The name or description of the Suricata rule that triggered the alert.", "Type": "String", "Entity": null }, { "Name": "AlertAction", "Description": "The action taken when an alert was triggered (e.g., allowed, dropped, rejected).", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "FlowId", "Description": "A unique identifier for the network flow related to this event.", "Type": "String", "Entity": null }, { "Name": "DestIp", "Description": "The destination IP address of the packet.", "Type": "String", "Entity": null }, { "Name": "Proto", "Description": "The protocol used (e.g., TCP, UDP, ICMP).", "Type": "String", "Entity": null }, { "Name": "VerdictAction", "Description": "The final decision made by the firewall (e.g., pass, drop, alert).", "Type": "String", "Entity": null }, { "Name": "Sni", "Description": "The Server Name Indication (SNI) from TLS traffic.", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "DestPort", "Description": "The destination port to which the packet was sent.", "Type": "String", "Entity": null }, { "Name": "PktSrc", "Description": "The source of the packet (e.g., internal, external, firewall rule).", "Type": "String", "Entity": null }, { "Name": "Direction", "Description": "The direction of the traffic (e.g., inbound, outbound).", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSNetworkFirewallFlow", "TableSource": "sentinel", "Description": "The AWS Platform Firewall Flow logs, ingested from Sentinel's connector, enabling real-time analysis and correlation with other security data sources like Detection alerts, firewall events network traffic logs, and more.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log entry was created in AWS Network Firewall.", "Type": "DateTime", "Entity": null }, { "Name": "FirewallName", "Description": "The name of the AWS Network Firewall instance generating the log.", "Type": "String", "Entity": null }, { "Name": "AvailabilityZone", "Description": "The AWS Availability Zone where the firewall instance is located.", "Type": "String", "Entity": null }, { "Name": "EventTimestamp", "Description": "The epoch timestamp of when the event occurred.", "Type": "String", "Entity": null }, { "Name": "TCPFlags", "Description": "The TCP flags observed in the packet", "Type": "String", "Entity": null }, { "Name": "Syn", "Description": "Indicates whether the SYN flag is set in the TCP packet (true/false).", "Type": "Boolean", "Entity": null }, { "Name": "Fin", "Description": "Indicates whether the FIN flag is set in the TCP packet (true/false).", "Type": "Boolean", "Entity": null }, { "Name": "Psh", "Description": "Indicates whether the PSH flag is set in the TCP packet (true/false).", "Type": "Boolean", "Entity": null }, { "Name": "Ack", "Description": "Indicates whether the ACK flag is set in the TCP packet (true/false).", "Type": "Boolean", "Entity": null }, { "Name": "Ecn", "Description": "Indicates whether the ECN flag is set in the TCP packet (true/false).", "Type": "Boolean", "Entity": null }, { "Name": "Rst", "Description": "Indicates whether the RST flag is set in the TCP packet (true/false).", "Type": "Boolean", "Entity": null }, { "Name": "AppProto", "Description": "The application layer protocol detected (e.g., HTTP, HTTPS, DNS).", "Type": "String", "Entity": null }, { "Name": "SrcIp", "Description": "The source IP address of the packet that triggered the event.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "The source port from which the packet originated.", "Type": "String", "Entity": null }, { "Name": "NetFlowPkts", "Description": "The number of packets in the network flow.", "Type": "String", "Entity": null }, { "Name": "NetFlowBytes", "Description": "The total number of bytes transferred in the network flow.", "Type": "String", "Entity": null }, { "Name": "NetFlowStart", "Description": "The timestamp when the network flow started.", "Type": "DateTime", "Entity": null }, { "Name": "NetFlowEnd", "Description": "The timestamp when the network flow ended.", "Type": "DateTime", "Entity": null }, { "Name": "NetFlowAge", "Description": "The duration of the network flow in seconds.", "Type": "String", "Entity": null }, { "Name": "NetFlowMinttl", "Description": "The minimum Time-to-Live (TTL) observed in the network flow.", "Type": "String", "Entity": null }, { "Name": "NetFlowMaxttl", "Description": "The maximum Time-to-Live (TTL) observed in the network flow.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "The type of event recorded (e.g., flow, alert, drop, pass).", "Type": "String", "Entity": null }, { "Name": "FlowId", "Description": "A unique identifier for the network flow related to this event.", "Type": "String", "Entity": null }, { "Name": "DestIp", "Description": "The destination IP address of the packet.", "Type": "String", "Entity": null }, { "Name": "Proto", "Description": "The protocol used (e.g., TCP, UDP, ICMP).", "Type": "String", "Entity": null }, { "Name": "DestPort", "Description": "The destination port to which the packet was sent.", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSNetworkFirewallTls", "TableSource": "sentinel", "Description": "The AWS Platform Firewall TLS logs, ingested from Sentinel's connector, enabling real-time analysis and correlation with other security data sources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log entry was created in AWS Network Firewall.", "Type": "DateTime", "Entity": null }, { "Name": "FirewallName", "Description": "The name of the AWS Network Firewall instance generating the log.", "Type": "String", "Entity": null }, { "Name": "AvailabilityZone", "Description": "The AWS Availability Zone where the firewall instance is located.", "Type": "String", "Entity": null }, { "Name": "EventTimestamp", "Description": "The epoch timestamp of when the event occurred.", "Type": "DateTime", "Entity": null }, { "Name": "SrcIp", "Description": "The source IP address of the packet that triggered the event.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "The source port from which the packet originated.", "Type": "String", "Entity": null }, { "Name": "DestIp", "Description": "The destination IP address of the packet.", "Type": "String", "Entity": null }, { "Name": "DestPort", "Description": "The destination port to which the packet was sent.", "Type": "String", "Entity": null }, { "Name": "Sni", "Description": "The Server Name Indication (SNI) from TLS traffic.", "Type": "String", "Entity": null }, { "Name": "LeafCertificateFingerprint", "Description": "The SHA-256 fingerprint of the leaf certificate observed in the TLS handshake.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "ErrorMessage", "Description": "Any error message associated with the event, if applicable.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSRoute53Resolver", "TableSource": "sentinel", "Description": "This connector enables ingestion of AWS Route 53 DNS logs into Microsoft Sentinel for enhanced visibility and threat detection. It supports DNS Resolver query logs ingested directly from AWS S3 buckets, while Public DNS query logs and Route 53 audit logs can be ingested using Microsoft Sentinel's AWS CloudWatch and CloudTrail connectors. Comprehensive instructions are provided to guide you through the setup of each log type. Leverage this connector to monitor DNS activity, detect potential threats, and improve your security posture in cloud environments.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "LogType", "Description": "Indicates the type of DNS log (e.g. ResolverQueryLogs).", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "AWS region where the log was generated.", "Type": "String", "Entity": null }, { "Name": "VpcId", "Description": "The ID of the VPC where the DNS query originated.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the DNS query was received by Route 53 Resolver.", "Type": "DateTime", "Entity": null }, { "Name": "QueryName", "Description": "The domain name that was queried.", "Type": "String", "Entity": null }, { "Name": "QueryType", "Description": "Type of the query", "Type": "String", "Entity": null }, { "Name": "QueryClass", "Description": "The DNS query class. Usually IN (Internet).", "Type": "String", "Entity": null }, { "Name": "Rcode", "Description": "Textual DNS response code (e.g. NOERROR, NXDOMAIN).", "Type": "String", "Entity": null }, { "Name": "Answers", "Description": "Array of DNS response records, including resolved IP addresses and other query-related information.", "Type": "Object", "Entity": null }, { "Name": "SrcAddr", "Description": "The source IP address of the instance that made the query.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "The source port on the instance that made the query.", "Type": "String", "Entity": null }, { "Name": "Transport", "Description": "The protocol used to send the query (e.g. UDP, TCP, TLS).", "Type": "String", "Entity": null }, { "Name": "SrcIds", "Description": "Identifiers related to the source instance where the DNS query originated from or passed through.", "Type": "Object", "Entity": null }, { "Name": "FirewallRuleAction", "Description": "Rule action from the matching firewall rule.", "Type": "String", "Entity": null }, { "Name": "FirewallRuleGroupId", "Description": "ID of the firewall rule group that applied to the query.", "Type": "String", "Entity": null }, { "Name": "FirewallDomainListId", "Description": "ID of the domain list that matched the query domain.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSS3ServerAccess", "TableSource": "sentinel", "Description": "This stack integrates Microsoft Sentinel by creating an IAM role with minimal permissions for accessing S3 server access logs stored in a specified S3 bucket and sending log events to an SQS queue.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the AWS Server Access log was received by the S3 bucket, in UTC.", "Type": "DateTime", "Entity": null }, { "Name": "BucketOwner", "Description": "The canonical user ID of the owner of the source bucket (another form of AWS account ID).", "Type": "String", "Entity": null }, { "Name": "Bucket", "Description": "The name of the S3 bucket against which the request was processed.", "Type": "String", "Entity": null }, { "Name": "RemoteIp", "Description": "The apparent IP address of the requester (may be obscured by proxies or firewalls).", "Type": "String", "Entity": null }, { "Name": "Requester", "Description": "The canonical user ID, IAM user, or assumed role making the request, or '-' for unauthenticated.", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "String", "Entity": null }, { "Name": "Key", "Description": "The object key (name) involved in the request.", "Type": "String", "Entity": null }, { "Name": "RequestUri", "Description": "Uniform resource identifier (URI) of the request", "Type": "String", "Entity": null }, { "Name": "HttpStatus", "Description": "The HTTP status code returned in the response.", "Type": "Int32", "Entity": null }, { "Name": "ErrorCode", "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Type": "String", "Entity": null }, { "Name": "BytesSent", "Description": "Number of response bytes sent, excluding HTTP overhead, or 0.", "Type": "Int32", "Entity": null }, { "Name": "ObjectSize", "Description": "Size of the object in bytes", "Type": "Int32", "Entity": null }, { "Name": "TotalTime", "Description": "The total time in milliseconds the request was in flight (from receipt to last response byte sent).", "Type": "Int32", "Entity": null }, { "Name": "TurnAroundTime", "Description": "The time in milliseconds S3 spent processing the request (from last request byte to first response byte).", "Type": "String", "Entity": null }, { "Name": "Referer", "Description": "The value of the HTTP Referer header (linking page URL), if present.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "VersionId", "Description": "The version ID of the object involved in the request, or '-' if not applicable.", "Type": "String", "Entity": null }, { "Name": "HostId", "Description": "Amazon S3 extended request ID (x-amz-id-2).", "Type": "String", "Entity": null }, { "Name": "SignatureVersion", "Description": "The signature version (SigV2 or SigV4) used to authenticate the request, or '-' for unauthenticated.", "Type": "String", "Entity": null }, { "Name": "CipherSuite", "Description": "The TLS cipher suite negotiated for HTTPS, or '-' for HTTP.", "Type": "String", "Entity": null }, { "Name": "AuthenticationType", "Description": "The authentication type used: AuthHeader, QueryString, or '-' for unauthenticated requests.", "Type": "String", "Entity": null }, { "Name": "HostHeader", "Description": "The endpoint (host header) used to connect to S3 (e.g., s3.us-west-2.amazonaws.com).", "Type": "String", "Entity": null }, { "Name": "TLSVersion", "Description": "The TLS version used by the client (e.g., TLSv1.2), or '-' if TLS wasn't used.", "Type": "String", "Entity": null }, { "Name": "AccessPointARN", "Description": "The Amazon Resource Name (ARN) of the S3 access point used for the request, or '-' if not used.", "Type": "String", "Entity": null }, { "Name": "ACLRequired", "Description": "Indicates if an ACL was required for the request: 'Yes' if required, '-' otherwise.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSSecurityHubFindings", "TableSource": "sentinel", "Description": "AWS Security Hub Findings, which are collected in AWS S3 buckets, into Microsoft Sentinel. AWS Security Hub Finding is a detailed record of a security check or security-related detection, which can originate from various sources like enabled controls, integrations with other AWS services, third-party products, or custom integrations.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AwsRegion", "Description": "The AWS region where the event occurred.", "Type": "String", "Entity": null }, { "Name": "AwsAccountId", "Description": "The AWS account ID associated with the event.", "Type": "String", "Entity": null }, { "Name": "ComplianceStatus", "Description": "The compliance status of the resource (e.g., COMPLIANT, NON_COMPLIANT).", "Type": "String", "Entity": null }, { "Name": "ComplianceStatusReasons", "Description": "The reasons for the compliance status.", "Type": "Object", "Entity": null }, { "Name": "ComplianceSecurityControlId", "Description": "The ID of the security control related to compliance.", "Type": "String", "Entity": null }, { "Name": "ComplianceSecurityControlParameters", "Description": "Parameters associated with the security control.", "Type": "Object", "Entity": null }, { "Name": "ComplianceRelatedRequirements", "Description": "The related compliance requirements.", "Type": "Object", "Entity": null }, { "Name": "ComplianceAssociatedStandards", "Description": "The compliance standards associated with the resource.", "Type": "Object", "Entity": null }, { "Name": "AwsSecurityFindingTitle", "Description": "The title of the AWS security finding.", "Type": "String", "Entity": null }, { "Name": "AwsSecurityFindingId", "Description": "The unique identifier for the AWS security finding.", "Type": "String", "Entity": null }, { "Name": "AwsSecurityFindingDescription", "Description": "A detailed description of the AWS security finding.", "Type": "String", "Entity": null }, { "Name": "AwsSecurityFindingTypes", "Description": "The types or categories of the AWS security finding.", "Type": "Object", "Entity": null }, { "Name": "AwsSecurityFindingCreatedAt", "Description": "The timestamp when the security finding was created.", "Type": "DateTime", "Entity": null }, { "Name": "AwsSecurityFindingFirstObservedAt", "Description": "The timestamp when the security finding was first observed.", "Type": "DateTime", "Entity": null }, { "Name": "AwsSecurityFindingUpdatedAt", "Description": "The timestamp when the security finding was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "AwsSecurityFindingLastObservedAt", "Description": "The timestamp when the security finding was last observed.", "Type": "DateTime", "Entity": null }, { "Name": "AwsSecurityFindingProcessedAt", "Description": "The timestamp when the security finding was processed.", "Type": "DateTime", "Entity": null }, { "Name": "AwsSecurityFindingGeneratorId", "Description": "The ID of the generator that created the security finding.", "Type": "String", "Entity": null }, { "Name": "AwsSecurityFindingProductArn", "Description": "The Amazon Resource Name (ARN) of the product that generated the finding.", "Type": "String", "Entity": null }, { "Name": "AwsSecurityFindingProductName", "Description": "The name of the product that generated the finding.", "Type": "String", "Entity": null }, { "Name": "AwsSecurityFindingProductFields", "Description": "Additional fields provided by the product that generated the finding.", "Type": "Object", "Entity": null }, { "Name": "AwsSecurityFindingSeverity", "Description": "The severity level of the security finding.", "Type": "Object", "Entity": null }, { "Name": "Remediation", "Description": "Details about how to remediate the security finding.", "Type": "Object", "Entity": null }, { "Name": "SchemaVersion", "Description": "The version of the schema used for the finding.", "Type": "String", "Entity": null }, { "Name": "Resources", "Description": "The resources associated with the security finding.", "Type": "Object", "Entity": null }, { "Name": "RecordState", "Description": "The state of the record (e.g., ACTIVE, ARCHIVED).", "Type": "String", "Entity": null }, { "Name": "WorkflowState", "Description": "The workflow state of the finding (e.g., NEW, RESOLVED).", "Type": "String", "Entity": null }, { "Name": "RawData", "Description": "The raw data associated with the finding.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSVPCFlow", "TableSource": "sentinel", "Description": "VPC Flow Logs, which ingested from Sentinel's connector, enables you to capture IP traffic going to and from your AWS VPC network interfaces.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was generated. This value will be the same as 'start' input field or the data arrival time to Azure Monitor in case the 'start' input field is empty or missing.", "Type": "DateTime", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "Int32", "Entity": null }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "InterfaceId", "Description": "The ID of the network interface for which the traffic is recorded.", "Type": "String", "Entity": null }, { "Name": "SrcAddr", "Description": "The source address for incoming traffic.", "Type": "String", "Entity": null }, { "Name": "DstAddr", "Description": "The destination address for outgoing traffic.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "The source port of the traffic.", "Type": "Int32", "Entity": null }, { "Name": "DstPort", "Description": "The destination port of the traffic.", "Type": "Int32", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "Int32", "Entity": null }, { "Name": "Packets", "Description": "The number of packets transferred during the flow.", "Type": "Int32", "Entity": null }, { "Name": "Bytes", "Description": "The number of bytes transferred during the flow.", "Type": "Int64", "Entity": null }, { "Name": "End", "Description": "The time when the last packet of the flow was received within the aggregation interval.", "Type": "DateTime", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "LogStatus", "Description": "The logging status of the flow log.", "Type": "String", "Entity": null }, { "Name": "VpcId", "Description": "The ID of the VPC.", "Type": "String", "Entity": null }, { "Name": "SubnetId", "Description": "The ID of the subnet.", "Type": "String", "Entity": null }, { "Name": "InstanceId", "Description": "The ID of the instance that's associated with network interface for which the traffic is recorded.", "Type": "String", "Entity": null }, { "Name": "TcpFlags", "Description": "The bitmask value for the following TCP flags.", "Type": "Int32", "Entity": null }, { "Name": "TrafficType", "Description": "The type of traffic. The possible values are: IPv4, IPv6, and EFA. For more information search for 'Elastic Fabric Adapter (EFA)'.", "Type": "String", "Entity": null }, { "Name": "PktSrcAddr", "Description": "The packet-level (original) source IP address of the traffic.", "Type": "String", "Entity": null }, { "Name": "PktDstAddr", "Description": "The packet-level (original) destination IP address for the traffic.", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The Region that contains the network interface for which traffic is recorded.", "Type": "String", "Entity": null }, { "Name": "AzId", "Description": "The ID of the Availability Zone.", "Type": "String", "Entity": null }, { "Name": "SublocationType", "Description": "The type of sublocation that is returned in the sublocationId field.", "Type": "String", "Entity": null }, { "Name": "SublocationId", "Description": "The ID of the sublocation that contains the network interface for which traffic is recorded.", "Type": "String", "Entity": null }, { "Name": "PktSrcAwsService", "Description": "The name of the subset of IP address ranges for the PktSrcAddr field, if the source IP address is for an AWS service.", "Type": "String", "Entity": null }, { "Name": "PktDstAwsService", "Description": "The name of the subset of IP address ranges for the PktDstAddr field, if the destination IP address is for an AWS service.", "Type": "String", "Entity": null }, { "Name": "FlowDirection", "Description": "The direction of the flow with respect to the interface where traffic is captured.", "Type": "String", "Entity": null }, { "Name": "TrafficPath", "Description": "The path that egress traffic takes to the destination.", "Type": "String", "Entity": null }, { "Name": "Start", "Description": "The remote ip of the request.", "Type": "DateTime", "Entity": null }, { "Name": "EcsClusterArn", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsClusterName", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsContainerInstanceArn", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsContainerInstanceId", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsContainerId", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsSecondContainerId", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsServiceName", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsTaskDefinitionArn", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsTaskArn", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "EcsTaskId", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AWSWAF", "TableSource": "sentinel", "Description": "AWS WAF logs, collected in AWS S3 buckets, to Microsoft Sentinel. AWS WAF logs are detailed records of traffic that web access control lists (ACLs) analyze, which are essential for maintaining the security and performance of web applications.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "Args", "Description": "The query string parameters of the request.", "Type": "String", "Entity": null }, { "Name": "CaptchaResponse", "Description": "Status of the CAPTCHA action for the request.", "Type": "Object", "Entity": null }, { "Name": "ChallengeResponse", "Description": "Status of the security challenge for the request.", "Type": "Object", "Entity": null }, { "Name": "ClientIp", "Description": "IP address of the client making the request.", "Type": "String", "Entity": null }, { "Name": "Country", "Description": "Country/Region where the account user is located", "Type": "String", "Entity": null }, { "Name": "ExcludedRules", "Description": "Rules excluded from evaluation in the rule group.", "Type": "Object", "Entity": null }, { "Name": "FormatVersion", "Description": "Version of the AWS WAF log format.", "Type": "String", "Entity": null }, { "Name": "Headers", "Description": "Headers included in the HTTP request.", "Type": "Object", "Entity": null }, { "Name": "HttpMethod", "Description": "The HTTP method (GET, POST, etc.) of the request.", "Type": "String", "Entity": null }, { "Name": "HttpRequest", "Description": "Metadata about the HTTP request.", "Type": "Object", "Entity": null }, { "Name": "HttpSourceId", "Description": "ID of the associated resource (e.g., CloudFront distribution, Load Balancer).", "Type": "String", "Entity": null }, { "Name": "HttpSourceName", "Description": "Source of the request (e.g., CF, APIGW, ALB).", "Type": "String", "Entity": null }, { "Name": "HttpVersion", "Description": "HTTP version used in the request.", "Type": "String", "Entity": null }, { "Name": "Ja3Fingerprint", "Description": "JA3 fingerprint of the TLS Client Hello.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Labels applied to the request by rules.", "Type": "Object", "Entity": null }, { "Name": "NonTerminatingMatchingRules", "Description": "List of rules that matched but didn't terminate the request.", "Type": "Object", "Entity": null }, { "Name": "OversizeFields", "Description": "Fields in the request that exceeded AWS WAF inspection limits.", "Type": "Object", "Entity": null }, { "Name": "RateBasedRuleList", "Description": "List of rate-based rules applied to the request.", "Type": "Object", "Entity": null }, { "Name": "RequestHeadersInserted", "Description": "Headers inserted for custom request handling.", "Type": "Object", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "ResponseCodeSent", "Description": "HTTP response code sent to the client.", "Type": "Int32", "Entity": null }, { "Name": "RuleGroupId", "Description": "ID of the rule group that matched.", "Type": "String", "Entity": null }, { "Name": "RuleGroupList", "Description": "List of rule groups that acted on the request.", "Type": "Object", "Entity": null }, { "Name": "TerminatingRule", "Description": "The rule that terminated the request. If this is present, it contains action, ruleId, ruleMatchDetails, and any additional information provided for each rule varies according factors such as the rule configuration, rule match type, and details of the match.", "Type": "Object", "Entity": null }, { "Name": "TerminatingRuleId", "Description": "ID of the network rule that matched.", "Type": "String", "Entity": null }, { "Name": "TerminatingRuleMatchDetails", "Description": "Details of the rule that terminated the request.", "Type": "Object", "Entity": null }, { "Name": "TerminatingRuleType", "Description": "Type of rule that terminated the request.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp when the log was processed.", "Type": "DateTime", "Entity": null }, { "Name": "Uri", "Description": "The URI of the request.", "Type": "String", "Entity": null }, { "Name": "WebAclId", "Description": "The GUID of the web ACL applied to the request.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AgentsInfo", "TableSource": "defender", "Description": "AgentsInfo table in the advanced hunting schema contains information about AI agents and their associated entities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time the event was recorded by the MDE agent on the endpoint.", "Type": "DateTime", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "Platform", "Description": "The platform that provided the information about the agents; possible values: Copilot Studio", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "SourceAgentId", "Description": "The platform-native identifier for this agent, scoped by OriginatingStore.", "Type": "String", "Entity": null }, { "Name": "EntraAgentID", "Description": "The agent's unique enterprise application object identifier in Microsoft Entra ID. This is the authoritative identity used for role-based access control (RBAC), lifecycle management, auditing, and Microsoft Graph operations.", "Type": "String", "Entity": null }, { "Name": "EntraBlueprintID", "Description": "Entra identity for Blueprint agents. The service principal ID assigned to the Blueprint template from which agent instances are derived.", "Type": "String", "Entity": null }, { "Name": "ToolsAuthenticationType", "Description": "Structured summary of agent identity, authentication, and authorization model.", "Type": "Object", "Entity": null }, { "Name": "Permissions", "Description": "Contains an array of permission objects; each permission object includes PermissionName, TargetAppId, TargetAppDisplayName, PermissionType, PrivilegeLevel, UsageStatus", "Type": "Object", "Entity": null }, { "Name": "PublishedStatus", "Description": "The agent's publications status; possible values: Draft, Published.", "Type": "String", "Entity": null }, { "Name": "LifecycleStatus", "Description": "The agent's current operational state in the tenant; possible values: Active, Blocked, Uninstalled, Deleted.", "Type": "String", "Entity": null }, { "Name": "Availability", "Description": "The deployment scope of the agent (that is, whether deployed to all users, specific groups, or individual users).", "Type": "String", "Entity": null }, { "Name": "CreatedDateTime", "Description": "Date and time when the account user was created", "Type": "DateTime", "Entity": null }, { "Name": "LastPublishedDateTime", "Description": "Date and time when the agent was last published or deployed.", "Type": "DateTime", "Entity": null }, { "Name": "LastUpdatedDateTime", "Description": "Date and time when the agent's metadata was last modified.", "Type": "DateTime", "Entity": null }, { "Name": "Owners", "Description": "Primary owners of the agent.", "Type": "Object", "Entity": null }, { "Name": "SharedWith", "Description": "The users and security groups the agent has been shared with.", "Type": "Object", "Entity": null }, { "Name": "InstanceCount", "Description": "Number of agent instances created from the same Microsoft Entra ID agent identity blueprint.", "Type": "Int32", "Entity": null }, { "Name": "Instructions", "Description": "The agent's system prompt or instructions that define its behavior.", "Type": "String", "Entity": null }, { "Name": "Model", "Description": "Model name or number of the product from the vendor or manufacturer; only available if device discovery finds enough information about this attribute", "Type": "String", "Entity": null }, { "Name": "Channels", "Description": "The channels or surfaces where the agent can operate, such as Microsoft 365 applications or APIs.", "Type": "Object", "Entity": null }, { "Name": "Capabilities", "Description": "The intents, actions, skills, and orchestrations of the agent.", "Type": "Object", "Entity": null }, { "Name": "DeclaredDataSources", "Description": "The data repositories and knowledge sources the agent can access.", "Type": "Object", "Entity": null }, { "Name": "DeclaredTools", "Description": "Functional tools the agent can invoke at runtime.", "Type": "Object", "Entity": null }, { "Name": "McpServers", "Description": "The Model Context Protocol (MCP) servers connected to the agent, including server URLs and credential configuration.", "Type": "Object", "Entity": null }, { "Name": "Skills", "Description": "Skills attached to the agent.", "Type": "Object", "Entity": null }, { "Name": "ConnectedAgents", "Description": "List of other agents connected to the agent for multi-agent orchestration.", "Type": "Object", "Entity": null }, { "Name": "Memory", "Description": "The agent's declarative memory store configuration.", "Type": "Object", "Entity": null }, { "Name": "Triggers", "Description": "List of the agent's triggers.", "Type": "Object", "Entity": null }, { "Name": "Guardrails", "Description": "Guardrails attached to the agent and their coverage.", "Type": "Object", "Entity": null }, { "Name": "Endpoints", "Description": "List of agent runtime endpoints, including URL, transport type, and external connectivity flag.", "Type": "Object", "Entity": null }, { "Name": "ObservabilityID", "Description": "Unique identifier used to correlate the agent with its usage and activity data in Agents for Microsoft 365.", "Type": "Object", "Entity": null }, { "Name": "RawAgentInfo", "Description": "Contents of the raw JSON that describes the agent and contains configuration details, as received from the provider", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "SecurityForAi", "TableSectionName": null }, { "Name": "AggregatedSecurityAlert", "TableSource": "sentinel", "Description": "Alerts that were generated by security products and were aggregated from a partner.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the alert was generated.", "Type": "DateTime", "Entity": null }, { "Name": "DisplayName", "Description": "Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.", "Type": "String", "Entity": null }, { "Name": "AlertName", "Description": "The name of the alert.", "Type": "String", "Entity": null }, { "Name": "AlertSeverity", "Description": "The sevirity of the alert.", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "ProviderName", "Description": "The name of the provider that generated the alert.", "Type": "String", "Entity": null }, { "Name": "VendorName", "Description": "The name of the vendor owning the provider that generated the alert.", "Type": "String", "Entity": null }, { "Name": "VendorOriginalId", "Description": "An ID assigned to the alert by the vendor, to help track down the alert in the original system.", "Type": "String", "Entity": null }, { "Name": "SystemAlertId", "Description": "An ID assigned to the alert by Sentinel.", "Type": "String", "Entity": null }, { "Name": "AlertType", "Description": "The type name of the alert.", "Type": "String", "Entity": null }, { "Name": "ConfidenceLevel", "Description": "List of confidence levels of any spam or phishing verdicts. For spam, this column shows the spam confidence level (SCL), indicating if the email was skipped (-1), found to be not spam (0,1), found to be spam with moderate confidence (5,6), or found to be spam with high confidence (9). For phishing, this column displays whether the confidence level is \"High\" or \"Low\".", "Type": "String", "Entity": null }, { "Name": "ConfidenceScore", "Description": "The level of confidence that the alert is not a false-positive. This property allows for more fined grained representation, represented by a number between 0 and 1 (inclusive).", "Type": "Double", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "ProcessingEndTime", "Description": "The time the alert was received for processing.", "Type": "DateTime", "Entity": null }, { "Name": "RemediationSteps", "Description": "Action items to take to remediate the alert.", "Type": "String", "Entity": null }, { "Name": "ExtendedProperties", "Description": "Additional data about the alert.", "Type": "String", "Entity": null }, { "Name": "Entities", "Description": "A list of entities related to the alert. This list can hold a mixture of entities of different types.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "The Log Analytics source system. Will always be 'Detection'.", "Type": "String", "Entity": null }, { "Name": "ExtendedLinks", "Description": "A set of link objects the can provide additional data on the alert.", "Type": "String", "Entity": null }, { "Name": "ProductName", "Description": "The name of the product that generated the alert.", "Type": "String", "Entity": null }, { "Name": "ProductComponentName", "Description": "The name of a component inside the product which generated the alert.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "CompromisedEntity", "Description": "Display name of the main entity being reported on.", "Type": "String", "Entity": null }, { "Name": "Tactics", "Description": "A list of adversary MITRE ATT&CK tactics involved in this security issue.", "Type": "String", "Entity": null }, { "Name": "Techniques", "Description": "A list of adversary MITRE ATT&CK techniques involved in this security issue.", "Type": "String", "Entity": null }, { "Name": "SubTechniques", "Description": "A list of adversary MITRE ATT&CK sub techniques involved in this security issue.", "Type": "String", "Entity": null }, { "Name": "PartnerId", "Description": "An ID assigned to the partner who sent the alert.", "Type": "String", "Entity": null }, { "Name": "PartnerDisplayName", "Description": "Name of the partner who sent the alert.", "Type": "String", "Entity": null }, { "Name": "PartnerMetadata", "Description": "Metadata about the partner who sent the alert.", "Type": "String", "Entity": null }, { "Name": "AggregatedSecurityAlertRuleIds", "Description": "IDs assigned to the aggregated security data sharing rules by Sentinel.", "Type": "String", "Entity": null }, { "Name": "AggregatedSecurityAlertRuleNames", "Description": "The names of the aggregated security data sharing rules.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "Alert", "TableSource": "sentinel", "Description": "The Alert table contains legacy information that is only logged in older versions of log search alerts. The official method to query all alerts, regardless of version or alert type, is by using Azure Resource Graph (ARG) to query Alerts metadata.", "Schema": [ { "Name": "TimeGenerated", "Description": "Date and time the record was created.", "Type": "DateTime", "Entity": null }, { "Name": "AlertSeverity", "Description": "Severity level of the alert.", "Type": "String", "Entity": null }, { "Name": "SourceDisplayName", "Description": "Display name of the monitoring object that generated the alert.", "Type": "String", "Entity": null }, { "Name": "AlertName", "Description": "Name of the alert.", "Type": "String", "Entity": null }, { "Name": "AlertDescription", "Description": "Detailed description of the alert.", "Type": "String", "Entity": null }, { "Name": "AlertState", "Description": "Latest resolution state of the alert.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "QueryExecutionStartTime", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "QueryExecutionEndTime", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "Query", "Description": "String used to run the query", "Type": "String", "Entity": null }, { "Name": "RemediationJobId", "Description": "", "Type": "String", "Entity": null }, { "Name": "RemediationRunbookName", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertRuleId", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertRuleInstanceId", "Description": "", "Type": "String", "Entity": null }, { "Name": "ThresholdOperator", "Description": "", "Type": "String", "Entity": null }, { "Name": "ThresholdValue", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "LinkToSearchResults", "Description": "", "Type": "String", "Entity": null }, { "Name": "ServiceDeskConnectionName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ServiceDeskId", "Description": "", "Type": "String", "Entity": null }, { "Name": "ServiceDeskWorkItemLink", "Description": "", "Type": "String", "Entity": null }, { "Name": "ServiceDeskWorkItemType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceType", "Description": "Type of cloud resource", "Type": "String", "Entity": null }, { "Name": "ResourceValue", "Description": "", "Type": "String", "Entity": null }, { "Name": "RootObjectName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ObjectDisplayName", "Description": "", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertPriority", "Description": "Priority level of the alert.", "Type": "String", "Entity": null }, { "Name": "SourceFullName", "Description": "Full name of the monitoring object that generated the alert.", "Type": "String", "Entity": null }, { "Name": "AlertId", "Description": "Unique identifier for the alert", "Type": "String", "Entity": null }, { "Name": "RepeatCount", "Description": "Number of times the same alert was generated for the same monitored object since being resolved.", "Type": "Int32", "Entity": null }, { "Name": "ResolvedBy", "Description": "Name of the user who resolved the alert. Empty if the alert has not yet been resolved.", "Type": "String", "Entity": null }, { "Name": "LastModifiedBy", "Description": "Name of the user who last modified the alert.", "Type": "String", "Entity": null }, { "Name": "TimeRaised", "Description": "Date and time that the alert was generated.", "Type": "DateTime", "Entity": null }, { "Name": "TimeResolved", "Description": "Date and time that the alert was resolved. Empty if the alert has not yet been resolved.", "Type": "DateTime", "Entity": null }, { "Name": "TimeLastModified", "Description": "Date and time that the alert was last changed.", "Type": "DateTime", "Entity": null }, { "Name": "AlertContext", "Description": "Details of the data item that caused the alert to be generated in XML format.", "Type": "String", "Entity": null }, { "Name": "TicketId", "Description": "Ticket ID for the alert if the System Center Operations Manager environment is integrated with a process for assigning tickets for alerts. Empty of no ticket ID is assigned.", "Type": "String", "Entity": null }, { "Name": "Custom1", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom2", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom3", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom4", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom5", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom6", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom7", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom8", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom9", "Description": "", "Type": "String", "Entity": null }, { "Name": "Custom10", "Description": "", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "Name of the management group for System Center Operations Manager agents.", "Type": "String", "Entity": null }, { "Name": "PriorityNumber", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "HostName", "Description": "", "Type": "String", "Entity": null }, { "Name": "StateType", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertTypeDescription", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertTypeNumber", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "AlertError", "Description": "", "Type": "String", "Entity": null }, { "Name": "StatusDescription", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertStatus", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "TriggerId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Url", "Description": "Full Url from email", "Type": "String", "Entity": null }, { "Name": "ValueDescription", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertValue", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "Comments", "Description": "", "Type": "String", "Entity": null }, { "Name": "TemplateId", "Description": "", "Type": "String", "Entity": null }, { "Name": "FlagsDescription", "Description": "", "Type": "String", "Entity": null }, { "Name": "Flags", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "ValueFlagsDescription", "Description": "", "Type": "String", "Entity": null }, { "Name": "ValueFlags", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "Expression", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "Anomalies", "TableSource": "sentinel", "Description": "This table contains anomalies generated by the active Anomaly analytics rules in Azure Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "WorkspaceId", "Description": "The ID of the Sentinel workspace.", "Type": "String", "Entity": null }, { "Name": "VendorName", "Description": "The name of the vendor that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the anomaly was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AnomalyTemplateId", "Description": "The ID of the Anomaly template that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "AnomalyTemplateName", "Description": "The name of the Anomaly template that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "AnomalyTemplateVersion", "Description": "The version of the Anomaly template that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "RuleId", "Description": "The ID of the Anomaly analytics rule that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "RuleStatus", "Description": "The status (Flighting/Production) of the Anomaly analytics rule that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name of the Anomaly analytics rule that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "RuleConfigVersion", "Description": "The configuration version of the Anomaly analytics rule that generated this anomaly.", "Type": "String", "Entity": null }, { "Name": "Score", "Description": "The score of the anomaly.", "Type": "Double", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "ExtendedLinks", "Description": "List of links pointing to the data that generated the anomaly.", "Type": "Object", "Entity": null }, { "Name": "Tactics", "Description": "List of MITRE ATT&CK tactics (strings) corresponding to the anomaly.", "Type": "String", "Entity": null }, { "Name": "Techniques", "Description": "List MITRE ATT&CK techniques (strings) corresponding to the anomaly.", "Type": "String", "Entity": null }, { "Name": "UserName", "Description": "The username for which the anomaly was generated.", "Type": "String", "Entity": null }, { "Name": "UserPrincipalName", "Description": "The UPN of the user for which the anomaly was generated.", "Type": "String", "Entity": null }, { "Name": "SourceIpAddress", "Description": "IP address where the attacker communication originated from and was blocked by automatic attack disruption", "Type": "String", "Entity": null }, { "Name": "SourceLocation", "Description": "Location where the email triggered zero-hour auto purge (ZAP)", "Type": "Object", "Entity": null }, { "Name": "SourceDevice", "Description": "The source device for which the anomaly was generated.", "Type": "String", "Entity": null }, { "Name": "DestinationIpAddress", "Description": "The destination ip address for which the anomaly was generated.", "Type": "String", "Entity": null }, { "Name": "DestinationLocation", "Description": "Info about the destination location for which the anomaly was generated as JSON.", "Type": "Object", "Entity": null }, { "Name": "DestinationDevice", "Description": "The destination device for which the anomaly was generated.", "Type": "String", "Entity": null }, { "Name": "ActivityInsights", "Description": "Insights about the activites corresponding to the generated anomaly as JSON.", "Type": "Object", "Entity": null }, { "Name": "DeviceInsights", "Description": "Insights about the devices corresponding to the generated anomaly as JSON.", "Type": "Object", "Entity": null }, { "Name": "UserInsights", "Description": "Insights about the users corresponding to the generated anomaly as JSON.", "Type": "Object", "Entity": null }, { "Name": "AnomalyReasons", "Description": "The detailed explanation of the generated anomaly as JSON.", "Type": "Object", "Entity": null }, { "Name": "Entities", "Description": "JSON object containing all entities involved in the generated anomaly.", "Type": "Object", "Entity": null }, { "Name": "ExtendedProperties", "Description": "JSON object with additional data on the anomaly as key-value pairs.", "Type": "Object", "Entity": null }, { "Name": "AnomalyDetails", "Description": "JSON object containing general information about the rule and algorithm that generated the anomaly as well as explanations for the anomaly.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "AppCenterError", "TableSource": "sentinel", "Description": "", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SchemaType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ErrorId", "Description": "", "Type": "String", "Entity": null }, { "Name": "ErrorGroupId", "Description": "", "Type": "String", "Entity": null }, { "Name": "UserString", "Description": "", "Type": "String", "Entity": null }, { "Name": "Oem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Model", "Description": "Model name or number of the product from the vendor or manufacturer; only available if device discovery finds enough information about this attribute", "Type": "String", "Entity": null }, { "Name": "OsVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "JailBreak", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "ErrorType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ErrorClass", "Description": "", "Type": "String", "Entity": null }, { "Name": "ErrorMethod", "Description": "", "Type": "String", "Entity": null }, { "Name": "ErrorFile", "Description": "", "Type": "String", "Entity": null }, { "Name": "ErrorLine", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "ErrorReason", "Description": "", "Type": "String", "Entity": null }, { "Name": "ExceptionType", "Description": "", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Annotation", "Description": "", "Type": "String", "Entity": null }, { "Name": "CreatedAt", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SymbolicatedAt", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "LastErrorAt", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "AuditLogs", "TableSource": "sentinel", "Description": "Audit log for Azure Active Directory. Includes system activity information about user and group management managed applications and directory activities.", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time the record was created.", "Type": "DateTime", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "OperationVersion", "Description": "REST API version that's requested by the client.", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ResultType", "Description": "Result of the operation. Possible values: Success, Failure", "Type": "String", "Entity": null }, { "Name": "ResultSignature", "Description": "Property is not used and can be ignored.", "Type": "String", "Entity": null }, { "Name": "ResultDescription", "Description": "Additional description of the operation's result", "Type": "String", "Entity": null }, { "Name": "DurationMs", "Description": "Property is not used and can be ignored.", "Type": "Int64", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "Resource", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceProvider", "Description": "", "Type": "String", "Entity": null }, { "Name": "Identity", "Description": "Identity from the token that was presented when the request was made. The identity can be a user account system account or service principal.", "Type": "String", "Entity": null }, { "Name": "Level", "Description": "Message type. This is currently always Informational.", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "AdditionalDetails", "Description": "Indicates additional details on the activity.", "Type": "Object", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "InitiatedBy", "Description": "User or app initiated the activity.", "Type": "Object", "Entity": null }, { "Name": "LoggedByService", "Description": "Service that initiated the activity (For example: Self-service Password Management Core Directory B2C Invited Users Microsoft Identity Manager Privileged Identity Management.", "Type": "String", "Entity": null }, { "Name": "Result", "Description": "Result of the activity. Possible values are: success failure timeout unknownFutureValue.", "Type": "String", "Entity": null }, { "Name": "ResultReason", "Description": "Describes cause of failure or timeout results.", "Type": "String", "Entity": null }, { "Name": "TargetResources", "Description": "Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other", "Type": "Object", "Entity": null }, { "Name": "AADTenantId", "Description": "ID of the ADD tenant", "Type": "String", "Entity": null }, { "Name": "ActivityDisplayName", "Description": "Activity name or the operation name. Examples include Create User and Add member to group. For full list see Azure AD activity list.", "Type": "String", "Entity": null }, { "Name": "ActivityDateTime", "Description": "Date and time the activity was performed in UTC.", "Type": "DateTime", "Entity": null }, { "Name": "AADOperationType", "Description": "Type of the operation. Possible values are Add Update Delete and Other.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "BehaviorAnalytics", "TableSource": "sentinel", "Description": "This table stores the enriched events for Sentinel UEBA, providing behavior analytics over raw data.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceRecordId", "Description": "The unique Id of the source raw event.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Time when the raw event was generated (UTC).", "Type": "DateTime", "Entity": null }, { "Name": "TimeProcessed", "Description": "Time when enrichment processing occurred (UTC).", "Type": "DateTime", "Entity": null }, { "Name": "ActivityType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "UserName", "Description": "User name of the account.", "Type": "String", "Entity": null }, { "Name": "UserPrincipalName", "Description": "User principal name of the account.", "Type": "String", "Entity": null }, { "Name": "EventSource", "Description": "Data source for this event.", "Type": "String", "Entity": null }, { "Name": "SourceIPAddress", "Description": "The source IP address.", "Type": "String", "Entity": null }, { "Name": "SourceIPLocation", "Description": "The source Geo location based on the IP address.", "Type": "String", "Entity": null }, { "Name": "SourceDevice", "Description": "The hostname of the source device.", "Type": "String", "Entity": null }, { "Name": "DestinationIPAddress", "Description": "IP address of the device running the server application that processed the recorded action", "Type": "String", "Entity": null }, { "Name": "DestinationIPLocation", "Description": "The destination Geo location based on the IP address.", "Type": "String", "Entity": null }, { "Name": "DestinationDevice", "Description": "The hostname of the destination device.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The name of the user initiating the action that generated the event.", "Type": "String", "Entity": null }, { "Name": "ActorPrincipalName", "Description": "The principal name of the user initiating the action that generated the event.", "Type": "String", "Entity": null }, { "Name": "TargetName", "Description": "The name of the target user in the action that generated the event.", "Type": "String", "Entity": null }, { "Name": "TargetPrincipalName", "Description": "The name of the target user in the action that generated the event.", "Type": "String", "Entity": null }, { "Name": "Device", "Description": "The name of the device on which the event occurred or which reported the event, depending on the schema.", "Type": "String", "Entity": null }, { "Name": "UsersInsights", "Description": "Users metadata and insights.", "Type": "Object", "Entity": null }, { "Name": "DevicesInsights", "Description": "Devices metadata and insights.", "Type": "Object", "Entity": null }, { "Name": "ActivityInsights", "Description": "Activity and behavioral insights.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "The entity provider source system.", "Type": "String", "Entity": null }, { "Name": "NativeTableName", "Description": "The original table from which the record was fetched.", "Type": "String", "Entity": null }, { "Name": "InvestigationPriority", "Description": "Investigation priority score indicating the relative urgency to inspect the recorded activity as well as the user account responsible for the activity", "Type": "Int32", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CommonSecurityLog", "TableSource": "sentinel", "Description": "This table is for collecting events in the Common Event Format, that are most often sent from different security appliances such as Check Point, Palo Alto and more.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Event collection time in UTC.", "Type": "DateTime", "Entity": null }, { "Name": "DeviceVendor", "Description": "String that together with device product and version definitions, uniquely identifies the type of sending device.", "Type": "String", "Entity": null }, { "Name": "DeviceProduct", "Description": "String that together with device product and version definitions, uniquely identifies the type of sending device.", "Type": "String", "Entity": null }, { "Name": "DeviceVersion", "Description": "String that together with device product and version definitions, uniquely identifies the type of sending device.", "Type": "String", "Entity": null }, { "Name": "DeviceEventClassID", "Description": "String or integer that serves as a unique identifier per event type.", "Type": "String", "Entity": null }, { "Name": "Activity", "Description": "Sensor activity", "Type": "String", "Entity": null }, { "Name": "LogSeverity", "Description": "A string or integer that describes the importance of the event. Valid string values: Unknown , Low, Medium, High, Very-High Valid integer values are: 0-3 = Low, 4-6 = Medium, 7-8 = High, 9-10 = Very-High.", "Type": "String", "Entity": null }, { "Name": "OriginalLogSeverity", "Description": "A non-mapped version of LogSeverity. For example: Warning/Critical/Info insted of the normilized Low/Medium/High in the LogSeverity Field", "Type": "String", "Entity": null }, { "Name": "AdditionalExtensions", "Description": "A placeholder for additional fields. Fields are logged as key-value pairs.", "Type": "String", "Entity": null }, { "Name": "DeviceAction", "Description": "The action mentioned in the event.", "Type": "String", "Entity": null }, { "Name": "ApplicationProtocol", "Description": "The protocol used in the application, such as HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "A count associated with the event, showing how many times the same event was observed.", "Type": "Int32", "Entity": null }, { "Name": "DestinationDnsDomain", "Description": "The DNS part of the fully-qualified domain name (FQDN).", "Type": "String", "Entity": null }, { "Name": "DestinationServiceName", "Description": "The service that is targeted by the event. For example: sshd.", "Type": "String", "Entity": null }, { "Name": "DestinationTranslatedAddress", "Description": "Identifies the translated destination referred to by the event in an IP network, as an IPv4 IP address.", "Type": "String", "Entity": null }, { "Name": "DestinationTranslatedPort", "Description": "Port after translation, such as a firewall Valid port numbers: 0 - 65535.", "Type": "Int32", "Entity": null }, { "Name": "CommunicationDirection", "Description": "Any information about the direction the observed communication has taken. Valid values: 0 = Inbound, 1 = Outbound.", "Type": "String", "Entity": null }, { "Name": "DeviceDnsDomain", "Description": "The DNS domain part of the full qualified domain name (FQDN).", "Type": "String", "Entity": null }, { "Name": "DeviceExternalID", "Description": "A name that uniquely identifies the device generating the event.", "Type": "String", "Entity": null }, { "Name": "DeviceFacility", "Description": "The facility generating the event. For example: auth or local1.", "Type": "String", "Entity": null }, { "Name": "DeviceInboundInterface", "Description": "The interface on which the packet or data entered the device. For example: ethernet1/2.", "Type": "String", "Entity": null }, { "Name": "DeviceNtDomain", "Description": "The Windows domain of the device address.", "Type": "String", "Entity": null }, { "Name": "DeviceOutboundInterface", "Description": "Interface on which the packet or data left the device.", "Type": "String", "Entity": null }, { "Name": "DevicePayloadId", "Description": "Unique identifier for the payload associated with the event.", "Type": "String", "Entity": null }, { "Name": "ProcessName", "Description": "The name of the process", "Type": "String", "Entity": null }, { "Name": "DeviceTranslatedAddress", "Description": "Identifies the translated device address that the event refers to, in an IP network. The format is an Ipv4 address.", "Type": "String", "Entity": null }, { "Name": "DestinationHostName", "Description": "The destination that the event refers to in an IP network. The format should be an FQDN associated with the destination node, when a node is available. For example: host.domain.com or host.", "Type": "String", "Entity": null }, { "Name": "DestinationMACAddress", "Description": "The destination MAC address (FQDN).", "Type": "String", "Entity": null }, { "Name": "DestinationNTDomain", "Description": "The Windows domain name of the destination address.", "Type": "String", "Entity": null }, { "Name": "DestinationProcessId", "Description": "The ID of the destination process associated with the event.", "Type": "Int32", "Entity": null }, { "Name": "DestinationUserPrivileges", "Description": "Defines the destination use's privileges. Valid values: Admninistrator, User, Guest.", "Type": "String", "Entity": null }, { "Name": "DestinationProcessName", "Description": "The name of the event’s destination process, such as telnetd or sshd.", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "Int32", "Entity": null }, { "Name": "DestinationIP", "Description": "The destination IpV4 address that the event refers to in an IP network.", "Type": "String", "Entity": null }, { "Name": "DeviceTimeZone", "Description": "Timezone of the device generating the event.", "Type": "String", "Entity": null }, { "Name": "DestinationUserID", "Description": "Identifies the destination user by ID. For example: in Unix, the root user is generally associated with the user ID 0.", "Type": "String", "Entity": null }, { "Name": "DestinationUserName", "Description": "Identifies the destination user by name.", "Type": "String", "Entity": null }, { "Name": "DeviceAddress", "Description": "The IPv4 address of the device generating the event.", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": null }, { "Name": "DeviceMacAddress", "Description": "The MAC address of the device generating the event.", "Type": "String", "Entity": null }, { "Name": "ProcessID", "Description": "Defines the ID of the process on the device generating the event.", "Type": "Int32", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "ExternalID", "Description": "Soon to be a deprecated field. Will be replaced by ExtID.", "Type": "Int32", "Entity": null }, { "Name": "ExtID", "Description": "An ID used by the originating device (will replace legacy ExternalID). Typically, these values have increasing values that are each associated with an event.", "Type": "String", "Entity": null }, { "Name": "FileCreateTime", "Description": "Time when the file was created.", "Type": "String", "Entity": null }, { "Name": "FileHash", "Description": "Hash of a file.", "Type": "String", "Entity": null }, { "Name": "FileID", "Description": "An ID associated with a file, such as the inode.", "Type": "String", "Entity": null }, { "Name": "FileModificationTime", "Description": "Time when the file was last modified.", "Type": "String", "Entity": null }, { "Name": "FilePath", "Description": "Full path to the file, including the filename. For example: C:\\ProgramFiles\\WindowsNT\\Accessories\\wordpad.exe or /usr/bin/zip.", "Type": "String", "Entity": null }, { "Name": "FilePermission", "Description": "The file's permissions. For example: '2,1,1'.", "Type": "String", "Entity": null }, { "Name": "FileType", "Description": "File extension type", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int32", "Entity": null }, { "Name": "ReceivedBytes", "Description": "Number of bytes transferred inbound.", "Type": "Int64", "Entity": null }, { "Name": "Message", "Description": "A message that gives more details about the event.", "Type": "String", "Entity": null }, { "Name": "OldFileCreateTime", "Description": "Time when the old file was created.", "Type": "String", "Entity": null }, { "Name": "OldFileHash", "Description": "Hash of the old file.", "Type": "String", "Entity": null }, { "Name": "OldFileID", "Description": "And ID associated with the old file, such as the inode.", "Type": "String", "Entity": null }, { "Name": "OldFileModificationTime", "Description": "Time when the old file was last modified.", "Type": "String", "Entity": null }, { "Name": "OldFileName", "Description": "Name of the old file.", "Type": "String", "Entity": null }, { "Name": "OldFilePath", "Description": "Full path to the old file, including the filename. For example: C:\\ProgramFiles\\WindowsNT\\Accessories\\wordpad.exe or /usr/bin/zip.", "Type": "String", "Entity": null }, { "Name": "OldFilePermission", "Description": "Permissions of the old file. For example: '2,1,1'.", "Type": "String", "Entity": null }, { "Name": "OldFileSize", "Description": "The size of the old file in bytes.", "Type": "Int32", "Entity": null }, { "Name": "OldFileType", "Description": "File type of the old file, such as a pipe, socket, and so on.", "Type": "String", "Entity": null }, { "Name": "SentBytes", "Description": "Number of bytes transferred outbound.", "Type": "Int64", "Entity": null }, { "Name": "EventOutcome", "Description": "Displays the outcome, usually as ‘success’ or ‘failure’.", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "Reason", "Description": "The reason an audit event was generated. For example 'bad password' or 'unknown user'. This could also be an error or return code. Example: '0x1234'.", "Type": "String", "Entity": null }, { "Name": "RequestURL", "Description": "The URL accessed for an HTTP request, including the protocol. For example: http://www/secure.com.", "Type": "String", "Entity": null }, { "Name": "RequestClientApplication", "Description": "The user agent associated with the request.", "Type": "String", "Entity": null }, { "Name": "RequestContext", "Description": "Describes the content from which the request originated, such as the HTTP Referrer.", "Type": "String", "Entity": null }, { "Name": "RequestCookies", "Description": "Cookies associated with the request.", "Type": "String", "Entity": null }, { "Name": "RequestMethod", "Description": "HTTP method of the request", "Type": "String", "Entity": null }, { "Name": "ReceiptTime", "Description": "The time at which the event related to the activity was received. Different then the 'Timegenerated' field, which is when the event was recieved in the log collector machine.", "Type": "String", "Entity": null }, { "Name": "SourceHostName", "Description": "Identifies the source that event refers to in an IP network. Format should be a fully qualified domain name (DQDN) associated with the source node, when a node is available. For example: host or host.domain.com.", "Type": "String", "Entity": null }, { "Name": "SourceMACAddress", "Description": "Source MAC address.", "Type": "String", "Entity": null }, { "Name": "SourceNTDomain", "Description": "The Windows domain name for the source address.", "Type": "String", "Entity": null }, { "Name": "SourceDnsDomain", "Description": "The DNS domain part of the complete FQDN.", "Type": "String", "Entity": null }, { "Name": "SourceServiceName", "Description": "The service responsible for generating the event.", "Type": "String", "Entity": null }, { "Name": "SourceTranslatedAddress", "Description": "Identifies the translated source that the event refers to in an IP network.", "Type": "String", "Entity": null }, { "Name": "SourceTranslatedPort", "Description": "Source port after translation, such as a firewall. Valid port numbers are 0 - 65535.", "Type": "Int32", "Entity": null }, { "Name": "SourceProcessId", "Description": "The ID of the source process associated with the event.", "Type": "Int32", "Entity": null }, { "Name": "SourceUserPrivileges", "Description": "The source user's privileges. Valid values include: Administrator, User, Guest.", "Type": "String", "Entity": null }, { "Name": "SourceProcessName", "Description": "The name of the event's source process.", "Type": "String", "Entity": null }, { "Name": "SourcePort", "Description": "Port where the attacker communication originated from", "Type": "Int32", "Entity": null }, { "Name": "SourceIP", "Description": "The source that an event refers to in an IP network, as an IPv4 address.", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "SourceUserID", "Description": "Identifies the source user by ID.", "Type": "String", "Entity": null }, { "Name": "SourceUserName", "Description": "The user name of the account conducting the malicious activity", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "Event type. Value values include: 0: base event, 1: aggregated, 2: correlation event, 3: action event. Note: This event can be omitted for base events.", "Type": "Int32", "Entity": null }, { "Name": "DeviceEventCategory", "Description": "Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. Example: '/Monitor/Disk/Read'.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address1", "Description": "One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address1Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address2", "Description": "One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address2Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address3", "Description": "One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address3Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address4", "Description": "One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomIPv6Address4Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomFloatingPoint1", "Description": "One of four floating point fields available to map fields that do not apply to any other in this dictionary.", "Type": "Double", "Entity": null }, { "Name": "DeviceCustomFloatingPoint1Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomFloatingPoint2", "Description": "One of four floating point fields available to map fields that do not apply to any other in this dictionary.", "Type": "Double", "Entity": null }, { "Name": "DeviceCustomFloatingPoint2Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomFloatingPoint3", "Description": "One of four floating point fields available to map fields that do not apply to any other in this dictionary.", "Type": "Double", "Entity": null }, { "Name": "DeviceCustomFloatingPoint3Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomFloatingPoint4", "Description": "One of four floating point fields available to map fields that do not apply to any other in this dictionary.", "Type": "Double", "Entity": null }, { "Name": "DeviceCustomFloatingPoint4Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomNumber1", "Description": "Soon to be a deprecated field. Will be replaced by FieldDeviceCustomNumber1.", "Type": "Int32", "Entity": null }, { "Name": "FieldDeviceCustomNumber1", "Description": "One of three number fields available to map fields that do not apply to any other in this dictionary (will replace legacy DeviceCustomNumber1). Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "Int64", "Entity": null }, { "Name": "DeviceCustomNumber1Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomNumber2", "Description": "Soon to be a deprecated field. Will be replaced by FieldDeviceCustomNumber2.", "Type": "Int32", "Entity": null }, { "Name": "FieldDeviceCustomNumber2", "Description": "One of three number fields available to map fields that do not apply to any other in this dictionary (will replace legacy DeviceCustomNumber2). Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "Int64", "Entity": null }, { "Name": "DeviceCustomNumber2Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomNumber3", "Description": "Soon to be a deprecated field. Will be replaced by FieldDeviceCustomNumber3.", "Type": "Int32", "Entity": null }, { "Name": "FieldDeviceCustomNumber3", "Description": "One of three number fields available to map fields that do not apply to any other in this dictionary (will replace legacy DeviceCustomNumber3). Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "Int64", "Entity": null }, { "Name": "DeviceCustomNumber3Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString1", "Description": "One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString1Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString2", "Description": "One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString2Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString3", "Description": "One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString3Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString4", "Description": "One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString4Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString5", "Description": "One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString5Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString6", "Description": "One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomString6Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomDate1", "Description": "One of two timestamp fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomDate1Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomDate2", "Description": "One of two timestamp fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.", "Type": "String", "Entity": null }, { "Name": "DeviceCustomDate2Label", "Description": "All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.", "Type": "String", "Entity": null }, { "Name": "FlexDate1", "Description": "A timestamp field available to map a timestamp that does not apply to any other defined timestamp field in this dictionary. Use all flex fields sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.", "Type": "String", "Entity": null }, { "Name": "FlexDate1Label", "Description": "The label field is a string and describes the purpose of the flex field.", "Type": "String", "Entity": null }, { "Name": "FlexNumber1", "Description": "Number fields available to map Int data that does not apply to any other field in this dictionary.", "Type": "Int32", "Entity": null }, { "Name": "FlexNumber1Label", "Description": "The label that describes the value in FlexNumber1", "Type": "String", "Entity": null }, { "Name": "FlexNumber2", "Description": "Number fields available to map Int data that does not apply to any other field in this dictionary.", "Type": "Int32", "Entity": null }, { "Name": "FlexNumber2Label", "Description": "The label that describes the value in FlexNumber2", "Type": "String", "Entity": null }, { "Name": "FlexString1", "Description": "One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.", "Type": "String", "Entity": null }, { "Name": "FlexString1Label", "Description": "The label field is a string and describes the purpose of the flex field.", "Type": "String", "Entity": null }, { "Name": "FlexString2", "Description": "One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.", "Type": "String", "Entity": null }, { "Name": "FlexString2Label", "Description": "The label field is a string and describes the purpose of the flex field.", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": null }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "String", "Entity": null }, { "Name": "MaliciousIP", "Description": "If one of the IP in the message was correlate with the current TI feed we have it will show up here.", "Type": "String", "Entity": null }, { "Name": "ThreatSeverity", "Description": "The threat severity of the MaliciousIP according to our TI feed at the time of the record ingestion.", "Type": "Int32", "Entity": null }, { "Name": "IndicatorThreatType", "Description": "The threat type of the MaliciousIP according to our TI feed.", "Type": "String", "Entity": null }, { "Name": "ThreatDescription", "Description": "The threat description of the MaliciousIP according to our TI feed.", "Type": "String", "Entity": null }, { "Name": "ThreatConfidence", "Description": "The threat confidence of the MaliciousIP according to our TI feed.", "Type": "String", "Entity": null }, { "Name": "ReportReferenceLink", "Description": "Link to the report of the TI feed.", "Type": "String", "Entity": null }, { "Name": "MaliciousIPLongitude", "Description": "The Longitude of the MaliciousIP according to the GEO information at the time of the record ingestion.", "Type": "Double", "Entity": null }, { "Name": "MaliciousIPLatitude", "Description": "The Latitude of the MaliciousIP according to the GEO information at the time of the record ingestion.", "Type": "Double", "Entity": null }, { "Name": "MaliciousIPCountry", "Description": "The country of the MaliciousIP according to the GEO information at the time of the record ingestion.", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "Host, from Syslog.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "Hard coded- 'OpsManager'.", "Type": "String", "Entity": null }, { "Name": "SimplifiedDeviceAction", "Description": "A mapped version of DeviceAction, such as Denied > Deny.", "Type": "String", "Entity": null }, { "Name": "CollectorHostName", "Description": "The hostname of the collector machine running the agent.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CommunicationComplianceActivity", "TableSource": "sentinel", "Description": "Office communication compliance audit logs. Used for monitoring policy compliance violation.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in UTC when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of user that performed the operation.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. Possible types includes: Admin, System, Application, Service Principal and Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The Microsoft service name.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor service name.", "Type": "String", "Entity": null }, { "Name": "IsPolicyHit", "Description": "Indication if the there is a hit on a defined policy.", "Type": "Boolean", "Entity": null }, { "Name": "SRPolicyId", "Description": "Policy Id.", "Type": "String", "Entity": null }, { "Name": "SRPolicyName", "Description": "Policy name.", "Type": "String", "Entity": null }, { "Name": "SRRuleMatchDetails", "Description": "Policy matches.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ComputerGroup", "TableSource": "sentinel", "Description": "Computer groups that can be used to scope log queries to a set of computers. Includes the computers in each group.", "Schema": [ { "Name": "SourceSystem", "Description": "OpsManager for all records of this type.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time the computer group was created or updated.", "Type": "DateTime", "Entity": null }, { "Name": "Computer", "Description": "Name of the member computer.", "Type": "String", "Entity": null }, { "Name": "Group", "Description": "Name of the group.", "Type": "String", "Entity": null }, { "Name": "GroupId", "Description": "Identifier for the team or group that the message was sent to", "Type": "String", "Entity": null }, { "Name": "GroupSourceName", "Description": "Name of the source that the group was collected from. For Active Directory this is the domain name.", "Type": "String", "Entity": null }, { "Name": "GroupSource", "Description": "Source that group was collected from. Possible values are ActiveDirectory WSUSWSUSClientTargeting.", "Type": "String", "Entity": null }, { "Name": "GroupFullName", "Description": "Full path to the group including the source and source name.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "ConfidentialWatchlist", "TableSource": "sentinel", "Description": "Azure Sentinel confidential Watchlist contains imported data from CSV files that can be used to join or filter as an alert/incident condition.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AzureTenantId", "Description": "The AAD tenant ID to which this Watchlist table belongs.", "Type": "String", "Entity": null }, { "Name": "WatchlistId", "Description": "The Resource Manager Watchlist resource name.", "Type": "String", "Entity": null }, { "Name": "WatchlistItemId", "Description": "The Watchlist item unique ID.", "Type": "String", "Entity": null }, { "Name": "WatchlistName", "Description": "The display name of Watchlist.", "Type": "String", "Entity": null }, { "Name": "WatchlistAlias", "Description": "The unique string referring to the Watchlist.", "Type": "String", "Entity": null }, { "Name": "Source", "Description": "The registry path or other location used to determine the current device setting", "Type": "String", "Entity": null }, { "Name": "Provider", "Description": "The input provider of the Watchlist.", "Type": "String", "Entity": null }, { "Name": "CreatedBy", "Description": "Identity of the user account who created the profile", "Type": "Object", "Entity": null }, { "Name": "UpdatedBy", "Description": "The JSON object with the user who last updated the Watchlist or Watchlist item, including: Object ID, email and name.", "Type": "Object", "Entity": null }, { "Name": "CreatedTimeUTC", "Description": "The time (UTC) when the Watchlist or Watchlist item was first created.", "Type": "DateTime", "Entity": null }, { "Name": "LastUpdatedTimeUTC", "Description": "The time (UTC) when Watchlist or Watchlist item was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "Notes", "Description": "The notes provided by user.", "Type": "String", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "String", "Entity": null }, { "Name": "DefaultDuration", "Description": "The JSON object describing the default duration to live that each item of a Watchlist should inherit on creation. The default duration has this format : P(n)Y(n)M(n)DT(n)H(n)M(n)S, where P, Y, M, DT, H, M and S are invariant. For example, P3Y6M4DT12H30M9S represents a duration of three years, six months, four days, twelve hours, thirty minutes, and nine seconds.", "Type": "String", "Entity": null }, { "Name": "TimeToLive", "Description": "The time to live for a Watchlist record, expressed as a date and time of day (e.g. 2020-08-20T17:00:00.9618037Z). Its original value is inherited from Watchlist’s default duration. If TimeToLive passes, the record is considered deleted. A record's duration can be extended at any time by updating the TimeToLive value.", "Type": "DateTime", "Entity": null }, { "Name": "WatchlistItem", "Description": "The JSON object with key-value pairs from the input Watchlist source.", "Type": "Object", "Entity": null }, { "Name": "EntityMapping", "Description": "The JSON object with Azure Sentinel entity mapping to input columns.", "Type": "Object", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "SearchKey", "Description": "The SearchKey is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field to join in other event tables by IP address.", "Type": "String", "Entity": null }, { "Name": "WatchlistCategory", "Description": "The Watchlist category provided by user.", "Type": "String", "Entity": null }, { "Name": "_DTTimestamp", "Description": "The time (UTC) when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "_DTItemId", "Description": "The Watchlist or Watchlist item unique ID. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:johndoe@contoso.com'. A Watchlist item has unique ID and belongs to a Watchlist. The containing Watchlist can identified using the 'WatchlistId'.", "Type": "String", "Entity": null }, { "Name": "_DTItemType", "Description": "Distinguish between a Watchlist and a Watchlist item. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:johndoe@contoso.com'. A Watchlist item type will belong to a Watchlist type and the containing Watchlist can identified using the 'WatchlistId'.", "Type": "String", "Entity": null }, { "Name": "_DTItemStatus", "Description": "Was the Watchlist or Watchlist item created, updated or deleted by user. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:johndoe@contoso.com'. If a Watchlist is added, the the status would be 'Created'. If the name of the Watchlist is updated from 'RiskyUsers' to 'RiskyEmployees' the status would be 'Updated'.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CopilotActivity", "TableSource": "sentinel", "Description": "Audit logs for Copilot and other AI workloads. Extensible for future AI audit types.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp of the audit event.", "Type": "DateTime", "Entity": null }, { "Name": "RecordId", "Description": "Unique identifier for the audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "Normalized record type name (e.g., CopilotInteraction, UpdateCopilotSettings).", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "User principal name or email address.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "Internal user key or GUID.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "Type of user (e.g., Regular, Admin, System).", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "Organization GUID.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "IP address of the client.", "Type": "String", "Entity": null }, { "Name": "ClientRegion", "Description": "Region of the client.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "AppHost", "Description": "Application that hosts copilot.", "Type": "String", "Entity": null }, { "Name": "AppIdentity", "Description": "Identity of the application hosting the copilot interaction.", "Type": "String", "Entity": null }, { "Name": "LLMEventData", "Description": "Parsed LLM event data (for copilot different RecordTypes).", "Type": "Object", "Entity": null }, { "Name": "AIModelName", "Description": "Name of the AI model used (for extensibility).", "Type": "String", "Entity": null }, { "Name": "AIModelVersion", "Description": "Version of the AI model used.", "Type": "String", "Entity": null }, { "Name": "LogVersion", "Description": "Version of the LLM log format.", "Type": "String", "Entity": null }, { "Name": "AgentName", "Description": "A friendly readable name of the agent.", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CrowdStrikeAlerts", "TableSource": "sentinel", "Description": "The CrowdStrikeAlerts table contains logs from the CrowdStrike Alerts API that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the alert was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "AggregateId", "Description": "Identifier for aggregated alerts from the same source.", "Type": "String", "Entity": null }, { "Name": "AssignedToName", "Description": "Name of the user assigned to handle the alert.", "Type": "String", "Entity": null }, { "Name": "AssignedToUid", "Description": "User ID of the assigned user.", "Type": "String", "Entity": null }, { "Name": "AssignedToUuid", "Description": "UUID of the assigned user.", "Type": "String", "Entity": null }, { "Name": "Cid", "Description": "Customer ID in the CrowdStrike platform.", "Type": "String", "Entity": null }, { "Name": "CompositeId", "Description": "Composite identifier combining multiple alert attributes.", "Type": "String", "Entity": null }, { "Name": "Confidence", "Description": "Confidence score of the alert (0-100).", "Type": "Int32", "Entity": null }, { "Name": "CrawledTimestamp", "Description": "Timestamp when the alert data was last crawled.", "Type": "DateTime", "Entity": null }, { "Name": "CreatedTimestamp", "Description": "Timestamp when the alert was first created.", "Type": "DateTime", "Entity": null }, { "Name": "DataDomains", "Description": "Domains associated with the alert.", "Type": "Object", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "DisplayName", "Description": "Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.", "Type": "String", "Entity": null }, { "Name": "EmailSent", "Description": "Indicates if an email notification was sent for this alert.", "Type": "Boolean", "Entity": null }, { "Name": "External", "Description": "Indicates if the alert originated from an external source.", "Type": "Boolean", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "Objective", "Description": "The attacker's presumed objective.", "Type": "String", "Entity": null }, { "Name": "PatternId", "Description": "Identifier for the detection pattern that triggered the alert.", "Type": "Int32", "Entity": null }, { "Name": "Platform", "Description": "The platform that provided the information about the agents; possible values: Copilot Studio", "Type": "String", "Entity": null }, { "Name": "Product", "Description": "CrowdStrike product that generated the alert.", "Type": "String", "Entity": null }, { "Name": "Scenario", "Description": "Security scenario that triggered the alert.", "Type": "String", "Entity": null }, { "Name": "SecondsToResolved", "Description": "Time in seconds from alert creation to resolution.", "Type": "Int32", "Entity": null }, { "Name": "SecondsToTriaged", "Description": "Time in seconds from alert creation to triage.", "Type": "Int32", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "Int32", "Entity": null }, { "Name": "SeverityName", "Description": "Text representation of the severity level.", "Type": "String", "Entity": null }, { "Name": "ShowInUi", "Description": "Indicates if the alert should be displayed in the user interface.", "Type": "Boolean", "Entity": null }, { "Name": "SourceProducts", "Description": "List of products that contributed to this alert.", "Type": "Object", "Entity": null }, { "Name": "SourceVendors", "Description": "List of vendors associated with the alert sources.", "Type": "Object", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Tactic", "Description": "MITRE ATT&CK tactic associated with the alert.", "Type": "String", "Entity": null }, { "Name": "TacticId", "Description": "Identifier of the MITRE ATT&CK tactic.", "Type": "String", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "Object", "Entity": null }, { "Name": "Technique", "Description": "MITRE ATT&CK technique associated with the alert.", "Type": "String", "Entity": null }, { "Name": "TechniqueId", "Description": "Identifier of the MITRE ATT&CK technique.", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "AlertType", "Description": "The type or category of the CrowdStrike alert.", "Type": "String", "Entity": null }, { "Name": "UpdatedTimestamp", "Description": "Time when the alert was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "AllegedFiletype", "Description": "The suspected file type of the malicious file associated with the alert.", "Type": "String", "Entity": null }, { "Name": "Categorization", "Description": "Categorization of the alert.", "Type": "String", "Entity": null }, { "Name": "ChildProcessIds", "Description": "List of child process IDs spawned by the detected process.", "Type": "Object", "Entity": null }, { "Name": "CloudIndicator", "Description": "Indicates if the alert involves cloud-based indicators.", "Type": "Boolean", "Entity": null }, { "Name": "Cmdline", "Description": "Command line used to execute the detected process.", "Type": "String", "Entity": null }, { "Name": "ContextTimestamp", "Description": "Timestamp providing additional context for the alert.", "Type": "String", "Entity": null }, { "Name": "CorrelationRuleCreateCase", "Description": "Indicates if the correlation rule is configured to create a case.", "Type": "Boolean", "Entity": null }, { "Name": "CorrelationRuleExecutionId", "Description": "Execution ID of the correlation rule that triggered the alert.", "Type": "String", "Entity": null }, { "Name": "CorrelationRuleId", "Description": "Identifier of the correlation rule that triggered the alert.", "Type": "String", "Entity": null }, { "Name": "CorrelationRuleUserId", "Description": "User ID associated with the correlation rule.", "Type": "String", "Entity": null }, { "Name": "CorrelationRuleUserUuid", "Description": "UUID of the user associated with the correlation rule.", "Type": "String", "Entity": null }, { "Name": "DetectionId", "Description": "Unique identifier for the detection associated with the alert.", "Type": "String", "Entity": null }, { "Name": "Device", "Description": "Information about the device where the alert was detected.", "Type": "Object", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "String", "Entity": null }, { "Name": "EnrichedEntities", "Description": "Enriched entity information associated with the alert.", "Type": "Object", "Entity": null }, { "Name": "EventCorrelationId", "Description": "Correlation ID linking related events.", "Type": "String", "Entity": null }, { "Name": "EventIds", "Description": "Event IDs associated with the alert.", "Type": "String", "Entity": null }, { "Name": "FalconHostLink", "Description": "Link to the alert details in the CrowdStrike Falcon console.", "Type": "String", "Entity": null }, { "Name": "Filename", "Description": "Name of the file associated with the alert.", "Type": "String", "Entity": null }, { "Name": "Filepath", "Description": "Full path to the file associated with the alert.", "Type": "String", "Entity": null }, { "Name": "GlobalPrevalence", "Description": "Number of instances of the entity observed by Microsoft globally", "Type": "String", "Entity": null }, { "Name": "GrandparentDetails", "Description": "Details about the grandparent process in the process tree.", "Type": "Object", "Entity": null }, { "Name": "HasTruncatedEntities", "Description": "Indicates if the alert entities have been truncated.", "Type": "Boolean", "Entity": null }, { "Name": "IndicatorId", "Description": "Identifier for the indicator of compromise that triggered the alert.", "Type": "String", "Entity": null }, { "Name": "IocContext", "Description": "Context information about the indicator of compromise.", "Type": "Object", "Entity": null }, { "Name": "IsClosed", "Description": "Indicates if the alert has been closed.", "Type": "Boolean", "Entity": null }, { "Name": "LeadId", "Description": "Identifier for the lead associated with the alert.", "Type": "String", "Entity": null }, { "Name": "LeadType", "Description": "Type of the lead associated with the alert.", "Type": "String", "Entity": null }, { "Name": "LocalAddressIp4", "Description": "IPv4 address of the local endpoint.", "Type": "String", "Entity": null }, { "Name": "LocalAddressIp6", "Description": "IPv6 address of the local endpoint.", "Type": "String", "Entity": null }, { "Name": "LocalPrevalence", "Description": "Local prevalence rating within the organization.", "Type": "String", "Entity": null }, { "Name": "LocalProcessId", "Description": "Local process ID on the system where the alert occurred.", "Type": "String", "Entity": null }, { "Name": "LogonDomain", "Description": "Domain used for user logon associated with the alert.", "Type": "String", "Entity": null }, { "Name": "Md5", "Description": "MD5 hash of the file associated with the alert.", "Type": "String", "Entity": null }, { "Name": "MitreAttack", "Description": "MITRE ATT&CK tactics and techniques associated with the alert.", "Type": "Object", "Entity": null }, { "Name": "OriginCid", "Description": "Customer ID of the originating tenant.", "Type": "String", "Entity": null }, { "Name": "OriginalCorrelationRulesEntitiesCount", "Description": "Original count of correlation rule entities.", "Type": "Int32", "Entity": null }, { "Name": "OriginalIndicatorEntitiesCount", "Description": "Original count of indicator entities.", "Type": "Int32", "Entity": null }, { "Name": "ParentDetails", "Description": "Details about the parent process in the process tree.", "Type": "Object", "Entity": null }, { "Name": "ParentProcessId", "Description": "The process ID (PID) of the parent process", "Type": "String", "Entity": null }, { "Name": "PatternDisposition", "Description": "Numerical identifier for the action taken by the detection pattern.", "Type": "Int32", "Entity": null }, { "Name": "PatternDispositionDescription", "Description": "Text description of the pattern disposition action.", "Type": "String", "Entity": null }, { "Name": "PatternDispositionDetails", "Description": "Detailed information about the pattern disposition.", "Type": "Object", "Entity": null }, { "Name": "PolyId", "Description": "Poly ID associated with the alert.", "Type": "String", "Entity": null }, { "Name": "PriorityDetails", "Description": "Priority details associated with the alert.", "Type": "Object", "Entity": null }, { "Name": "ProcessEndTime", "Description": "Timestamp when the detected process ended.", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessStartTime", "Description": "Timestamp when the detected process started.", "Type": "String", "Entity": null }, { "Name": "Score", "Description": "Score associated with the alert.", "Type": "Int32", "Entity": null }, { "Name": "Sha1", "Description": "SHA1 hash of the file associated with the alert.", "Type": "String", "Entity": null }, { "Name": "Sha256", "Description": "SHA256 hash of the file associated with the alert.", "Type": "String", "Entity": null }, { "Name": "SignalEndTimestamp", "Description": "Timestamp when the signal ended.", "Type": "String", "Entity": null }, { "Name": "SignalStartTimestamp", "Description": "Timestamp when the signal started.", "Type": "String", "Entity": null }, { "Name": "SignalUpdatedTimestamp", "Description": "Timestamp when the signal was last updated.", "Type": "String", "Entity": null }, { "Name": "SourceEndpointAddressIp4", "Description": "IPv4 address of the source endpoint.", "Type": "String", "Entity": null }, { "Name": "SourceEndpointAddressIp6", "Description": "IPv6 address of the source endpoint.", "Type": "String", "Entity": null }, { "Name": "SourceIps", "Description": "List of source IP addresses associated with the alert.", "Type": "Object", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "String", "Entity": null }, { "Name": "TemplateInstanceId", "Description": "Instance ID of the detection template used.", "Type": "Int32", "Entity": null }, { "Name": "ThreatgraphIndicators", "Description": "Threat graph indicators associated with the alert.", "Type": "Object", "Entity": null }, { "Name": "TriggeringProcessGraphId", "Description": "Graph ID of the process that triggered the alert.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "User ID associated with the alert.", "Type": "String", "Entity": null }, { "Name": "UserName", "Description": "Username associated with the alert.", "Type": "String", "Entity": null }, { "Name": "Users", "Description": "List of users associated with the alert.", "Type": "Object", "Entity": null }, { "Name": "VendorPatternId", "Description": "Vendor-specific pattern identifier.", "Type": "String", "Entity": null }, { "Name": "XdrEventId", "Description": "XDR event ID associated with the alert.", "Type": "String", "Entity": null }, { "Name": "CrowdStrikeDomain", "Description": "CrowdStrike host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CrowdStrikeAuditEvents", "TableSource": "sentinel", "Description": "The CrowdStrikeAuditEvents table contains audit and detection event logs from CrowdStrike that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (in UTC) when the log entry was generated.", "Type": "DateTime", "Entity": null }, { "Name": "EventType", "Description": "The type of event, used to filter logs.", "Type": "String", "Entity": null }, { "Name": "CustomerIdString", "Description": "The customer ID string.", "Type": "String", "Entity": null }, { "Name": "Nonce", "Description": "A unique nonce value.", "Type": "String", "Entity": null }, { "Name": "AgentIdString", "Description": "The agent ID string.", "Type": "String", "Entity": null }, { "Name": "ExternalApiType", "Description": "The external API type.", "Type": "String", "Entity": null }, { "Name": "PolicyId", "Description": "Unique identifier for the policy", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "SeverityName", "Description": "Text representation of the severity level.", "Type": "String", "Entity": null }, { "Name": "UserName", "Description": "Username who performed the action.", "Type": "String", "Entity": null }, { "Name": "Tactic", "Description": "MITRE ATT&CK tactic.", "Type": "String", "Entity": null }, { "Name": "Technique", "Description": "MITRE ATT&CK technique.", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "String", "Entity": null }, { "Name": "ComputerName", "Description": "Fully qualified domain name (FQDN) of the machine", "Type": "String", "Entity": null }, { "Name": "MD5String", "Description": "MD5 hash of the file.", "Type": "String", "Entity": null }, { "Name": "ParentProcessId", "Description": "The process ID (PID) of the parent process", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FilePath", "Description": "Full path to the file.", "Type": "String", "Entity": null }, { "Name": "CommandLine", "Description": "Command line used to execute the process.", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "RuleId", "Description": "Identifier of the recon rule.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "Name of the recon rule.", "Type": "String", "Entity": null }, { "Name": "SourceVendors", "Description": "Vendors associated with the detection source.", "Type": "String", "Entity": null }, { "Name": "SourceProducts", "Description": "Products associated with the detection source.", "Type": "String", "Entity": null }, { "Name": "DataDomains", "Description": "Data domains associated with the event.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "EventUuid", "Description": "Unique UUID for the event.", "Type": "String", "Entity": null }, { "Name": "Cid", "Description": "Customer ID in the CrowdStrike platform.", "Type": "String", "Entity": null }, { "Name": "Eid", "Description": "Event ID.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "User ID associated with the activity.", "Type": "String", "Entity": null }, { "Name": "UserIp", "Description": "IP address of the user making the API call.", "Type": "String", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "Name of the service (e.g., api_request).", "Type": "String", "Entity": null }, { "Name": "Success", "Description": "Whether the API call was successful.", "Type": "Boolean", "Entity": null }, { "Name": "ApiClientId", "Description": "API client ID used for the request.", "Type": "String", "Entity": null }, { "Name": "RequestAccept", "Description": "Accept header of the request.", "Type": "String", "Entity": null }, { "Name": "RequestMethod", "Description": "HTTP method of the request", "Type": "String", "Entity": null }, { "Name": "RequestPath", "Description": "Path of the API request.", "Type": "String", "Entity": null }, { "Name": "RequestContentType", "Description": "Content type of the request.", "Type": "String", "Entity": null }, { "Name": "StatusCode", "Description": "HTTP status code of the response.", "Type": "String", "Entity": null }, { "Name": "ElapsedTime", "Description": "Elapsed time of the request.", "Type": "String", "Entity": null }, { "Name": "ElapsedMicroseconds", "Description": "Elapsed time in microseconds.", "Type": "String", "Entity": null }, { "Name": "ReceivedTime", "Description": "Time the request was received.", "Type": "DateTime", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "RequestUriLength", "Description": "Length of the request URI.", "Type": "String", "Entity": null }, { "Name": "TraceId", "Description": "Trace ID for request tracing.", "Type": "String", "Entity": null }, { "Name": "Produces", "Description": "Content type produced by the API.", "Type": "String", "Entity": null }, { "Name": "Consumes", "Description": "Content type consumed by the API.", "Type": "String", "Entity": null }, { "Name": "Scopes", "Description": "Scopes in token claims", "Type": "String", "Entity": null }, { "Name": "Message", "Description": "Message associated with the audit event.", "Type": "String", "Entity": null }, { "Name": "Source", "Description": "The registry path or other location used to determine the current device setting", "Type": "String", "Entity": null }, { "Name": "SourceIp", "Description": "Source IP address.", "Type": "String", "Entity": null }, { "Name": "AuditKeyValues", "Description": "JSON string containing audit key-value pairs.", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "Application ID.", "Type": "String", "Entity": null }, { "Name": "AuditEventType", "Description": "Event type from the audit attributes.", "Type": "String", "Entity": null }, { "Name": "Offset", "Description": "Stream offset value.", "Type": "String", "Entity": null }, { "Name": "Partition", "Description": "Stream partition.", "Type": "String", "Entity": null }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "PolicyStatement", "Description": "Description of the CSPM policy that was triggered.", "Type": "String", "Entity": null }, { "Name": "CloudProvider", "Description": "Cloud provider (e.g., aws, azure, gcp).", "Type": "String", "Entity": null }, { "Name": "CloudService", "Description": "Cloud service involved (e.g., EC2, S3).", "Type": "String", "Entity": null }, { "Name": "EventAction", "Description": "Action that triggered the IOA (e.g., TerminateInstances).", "Type": "String", "Entity": null }, { "Name": "EventSource", "Description": "Source of the event (e.g., aws.cloudtrail).", "Type": "String", "Entity": null }, { "Name": "UserSourceIp", "Description": "Source IP of the user.", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "Cloud region (e.g., us-west-2).", "Type": "String", "Entity": null }, { "Name": "ResourcesId", "Description": "Identifier of the cloud resource.", "Type": "String", "Entity": null }, { "Name": "ResourceIdType", "Description": "Type of the resource identifier (e.g., Instance Id).", "Type": "String", "Entity": null }, { "Name": "ResourcesName", "Description": "Name of the cloud resource.", "Type": "String", "Entity": null }, { "Name": "ResourceCreateTime", "Description": "Creation time of the resource.", "Type": "DateTime", "Entity": null }, { "Name": "CloudPlatform", "Description": "The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform", "Type": "String", "Entity": null }, { "Name": "Disposition", "Description": "Assessment result (e.g., Failed, Passed).", "Type": "String", "Entity": null }, { "Name": "ResourceUrl", "Description": "URL to the resource in the cloud console.", "Type": "String", "Entity": null }, { "Name": "Finding", "Description": "Details of the finding.", "Type": "String", "Entity": null }, { "Name": "ResourceAttributes", "Description": "JSON string containing resource attributes.", "Type": "String", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "String", "Entity": null }, { "Name": "ReportUrl", "Description": "URL to the CSPM assessment report.", "Type": "String", "Entity": null }, { "Name": "NotificationId", "Description": "Unique identifier for the recon notification.", "Type": "String", "Entity": null }, { "Name": "Highlights", "Description": "JSON string containing highlights of the notification.", "Type": "String", "Entity": null }, { "Name": "MatchedTimestamp", "Description": "Timestamp when the match was found.", "Type": "DateTime", "Entity": null }, { "Name": "RuleTopic", "Description": "Topic of the recon rule (e.g., Credential Exposure).", "Type": "String", "Entity": null }, { "Name": "RulePriority", "Description": "Priority of the recon rule.", "Type": "String", "Entity": null }, { "Name": "ItemId", "Description": "Identifier of the matched item.", "Type": "String", "Entity": null }, { "Name": "ItemType", "Description": "Type of the matched item.", "Type": "String", "Entity": null }, { "Name": "ItemPostedTimestamp", "Description": "Timestamp when the item was posted.", "Type": "DateTime", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "HostnameField", "Description": "Hostname of the target system.", "Type": "String", "Entity": null }, { "Name": "EndTimestamp", "Description": "Unix epoch timestamp when the session ended.", "Type": "DateTime", "Entity": null }, { "Name": "StartTimestamp", "Description": "Unix epoch timestamp when the session started.", "Type": "DateTime", "Entity": null }, { "Name": "UserUuid", "Description": "UUID of the user who owns the scheduled report.", "Type": "String", "Entity": null }, { "Name": "ExecutionId", "Description": "Execution identifier for the report run.", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "ReportName", "Description": "Name of the scheduled report.", "Type": "String", "Entity": null }, { "Name": "ReportType", "Description": "Type of reported event; Prevented/Blocked/PolicyUpdated", "Type": "String", "Entity": null }, { "Name": "ReportFileReference", "Description": "File reference path for downloading the report.", "Type": "String", "Entity": null }, { "Name": "StatusMessage", "Description": "Status message for the report execution.", "Type": "String", "Entity": null }, { "Name": "ProcessStartTime", "Description": "Timestamp when the detected process started.", "Type": "DateTime", "Entity": null }, { "Name": "ProcessEndTime", "Description": "Timestamp when the detected process ended.", "Type": "DateTime", "Entity": null }, { "Name": "Hostname", "Description": "Name of the host where the event occurred.", "Type": "String", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "SHA256String", "Description": "SHA256 hash of the detected file.", "Type": "String", "Entity": null }, { "Name": "SHA1String", "Description": "SHA1 hash of the detected file.", "Type": "String", "Entity": null }, { "Name": "LogonDomain", "Description": "Logon domain associated with the detection.", "Type": "String", "Entity": null }, { "Name": "FalconHostLink", "Description": "Link to the detection details in the CrowdStrike Falcon console.", "Type": "String", "Entity": null }, { "Name": "AgentId", "Description": "Unique identifier for the agent.", "Type": "String", "Entity": null }, { "Name": "CompositeId", "Description": "Composite identifier combining multiple detection attributes.", "Type": "String", "Entity": null }, { "Name": "LocalIp", "Description": "Local IP address of the host.", "Type": "String", "Entity": null }, { "Name": "MACAddress", "Description": "MAC address of the host.", "Type": "String", "Entity": null }, { "Name": "Objective", "Description": "Objective of the detection (e.g., Follow Through).", "Type": "String", "Entity": null }, { "Name": "PatternDispositionDescription", "Description": "Description of the pattern disposition action.", "Type": "String", "Entity": null }, { "Name": "PatternDispositionValue", "Description": "Numerical value of the pattern disposition.", "Type": "String", "Entity": null }, { "Name": "PatternDispositionFlags", "Description": "JSON string containing flags indicating various pattern disposition actions.", "Type": "String", "Entity": null }, { "Name": "ParentImageFileName", "Description": "Image file name of the parent process.", "Type": "String", "Entity": null }, { "Name": "ParentCommandLine", "Description": "Command line of the parent process.", "Type": "String", "Entity": null }, { "Name": "GrandParentImageFileName", "Description": "Image file name of the grandparent process.", "Type": "String", "Entity": null }, { "Name": "GrandParentCommandLine", "Description": "Command line of the grandparent process.", "Type": "String", "Entity": null }, { "Name": "HostGroups", "Description": "Host groups the system belongs to.", "Type": "String", "Entity": null }, { "Name": "PatternId", "Description": "Identifier for the detection pattern.", "Type": "String", "Entity": null }, { "Name": "AggregateId", "Description": "Aggregate identifier for related detections.", "Type": "String", "Entity": null }, { "Name": "ParentImageFilePath", "Description": "Full path to the parent process image file.", "Type": "String", "Entity": null }, { "Name": "GrandParentImageFilePath", "Description": "Full path to the grandparent process image file.", "Type": "String", "Entity": null }, { "Name": "LocalIpv6", "Description": "Local IPv6 address of the host.", "Type": "String", "Entity": null }, { "Name": "PlatformId", "Description": "Platform ID (e.g., 0=Windows, 1=Mac, 2=Linux).", "Type": "String", "Entity": null }, { "Name": "PlatformName", "Description": "Name of the platform (e.g., Windows, Linux, Mac).", "Type": "String", "Entity": null }, { "Name": "MitreAttack", "Description": "JSON string containing MITRE ATT&CK framework details.", "Type": "String", "Entity": null }, { "Name": "CloudIndicator", "Description": "Indicates if the detection involves cloud-based indicators.", "Type": "String", "Entity": null }, { "Name": "RiskScore", "Description": "The risk score of the identity as calculated by Microsoft Defender", "Type": "String", "Entity": null }, { "Name": "CustomerId", "Description": "Customer identifier in the CrowdStrike platform.", "Type": "String", "Entity": null }, { "Name": "Ipv", "Description": "IP version (ipv4 or ipv6).", "Type": "String", "Entity": null }, { "Name": "ConnectionDirection", "Description": "Direction of the network connection.", "Type": "String", "Entity": null }, { "Name": "Flags", "Description": "JSON string containing firewall rule flags (Audit, Log, Monitor).", "Type": "String", "Entity": null }, { "Name": "IcmpCode", "Description": "ICMP code if the protocol is ICMP.", "Type": "String", "Entity": null }, { "Name": "IcmpType", "Description": "ICMP type if the protocol is ICMP.", "Type": "String", "Entity": null }, { "Name": "ImageFileName", "Description": "Image file name of the process associated with the event.", "Type": "String", "Entity": null }, { "Name": "LocalAddress", "Description": "Local IP address involved in the firewall event.", "Type": "String", "Entity": null }, { "Name": "LocalPort", "Description": "TCP port on the local machine used during communication", "Type": "String", "Entity": null }, { "Name": "MatchCount", "Description": "Number of times the firewall rule was matched.", "Type": "String", "Entity": null }, { "Name": "MatchCountSinceLastReport", "Description": "Number of matches since the last report.", "Type": "String", "Entity": null }, { "Name": "NetworkProfile", "Description": "Network profile identifier.", "Type": "String", "Entity": null }, { "Name": "Pid", "Description": "Process ID associated with the firewall event.", "Type": "String", "Entity": null }, { "Name": "PolicyName", "Description": "Name of the policy", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "RemoteAddress", "Description": "Remote IP address involved in the firewall event.", "Type": "String", "Entity": null }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "String", "Entity": null }, { "Name": "RuleAction", "Description": "Action taken by the firewall rule.", "Type": "String", "Entity": null }, { "Name": "RuleDescription", "Description": "Description of the firewall rule.", "Type": "String", "Entity": null }, { "Name": "RuleFamilyId", "Description": "Family identifier of the firewall rule.", "Type": "String", "Entity": null }, { "Name": "RuleGroupName", "Description": "Name of the firewall rule group.", "Type": "String", "Entity": null }, { "Name": "TreeId", "Description": "Tree identifier for the process tree.", "Type": "String", "Entity": null }, { "Name": "Hash", "Description": "Credential hash observed spreading across hosts.", "Type": "String", "Entity": null }, { "Name": "SourceEndpointName", "Description": "Name of the source endpoint.", "Type": "String", "Entity": null }, { "Name": "SourceEndpointIp", "Description": "IP address of the source endpoint.", "Type": "String", "Entity": null }, { "Name": "DestinationEndpointName", "Description": "Name of the destination endpoint.", "Type": "String", "Entity": null }, { "Name": "DestinationEndpointIp", "Description": "IP address of the destination endpoint.", "Type": "String", "Entity": null }, { "Name": "AuthenticationProtocol", "Description": "Authentication protocol that the compromised user used to sign in; possible values: Undefined, NTLM, Kerberos", "Type": "String", "Entity": null }, { "Name": "SpreadCount", "Description": "Number of hosts the hash has been observed on.", "Type": "String", "Entity": null }, { "Name": "FirstSeen", "Description": "Timestamp of the first record associated with the entity", "Type": "DateTime", "Entity": null }, { "Name": "LastSeen", "Description": "Timestamp of the newest record associated with the entity", "Type": "DateTime", "Entity": null }, { "Name": "IncidentDescription", "Description": "Description of the hash spreading incident.", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "IncidentType", "Description": "Type of identity protection incident (e.g., GoldenTicketAlert).", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndpointName", "Description": "Name of the endpoint involved in the incident.", "Type": "String", "Entity": null }, { "Name": "EndpointIp", "Description": "IP address of the endpoint involved in the incident.", "Type": "String", "Entity": null }, { "Name": "NumbersOfAlerts", "Description": "Number of alerts associated with the incident.", "Type": "String", "Entity": null }, { "Name": "NumberOfCompromisedEntities", "Description": "Number of compromised entities in the incident.", "Type": "String", "Entity": null }, { "Name": "State", "Description": "State where the sign-in occurred, if available", "Type": "String", "Entity": null }, { "Name": "IdentityProtectionIncidentId", "Description": "Unique identifier for the identity protection incident.", "Type": "String", "Entity": null }, { "Name": "ContextTimeStamp", "Description": "Context timestamp of the IDP detection event (Unix epoch).", "Type": "DateTime", "Entity": null }, { "Name": "SourceAccountDomain", "Description": "Domain of the source account.", "Type": "String", "Entity": null }, { "Name": "SourceAccountName", "Description": "Name of the source account.", "Type": "String", "Entity": null }, { "Name": "SourceAccountUpn", "Description": "User principal name of the source account.", "Type": "String", "Entity": null }, { "Name": "SourceAccountObjectSid", "Description": "Object SID of the source account.", "Type": "String", "Entity": null }, { "Name": "CurrentPrivileges", "Description": "Current privilege level of the account.", "Type": "String", "Entity": null }, { "Name": "PreviousPrivileges", "Description": "Previous privilege level of the account.", "Type": "String", "Entity": null }, { "Name": "AddedPrivileges", "Description": "Privileges that were added to the account.", "Type": "String", "Entity": null }, { "Name": "IncidentStartTime", "Description": "Start time of the incident (Unix epoch).", "Type": "DateTime", "Entity": null }, { "Name": "IncidentEndTime", "Description": "End time of the incident (Unix epoch).", "Type": "DateTime", "Entity": null }, { "Name": "FineScore", "Description": "Fine score of the incident.", "Type": "String", "Entity": null }, { "Name": "LateralMovement", "Description": "Lateral movement indicator for the incident.", "Type": "String", "Entity": null }, { "Name": "IncidentId", "Description": "Unique identifier of the incident", "Type": "String", "Entity": null }, { "Name": "HostId", "Description": "Identifier of the host involved in the incident.", "Type": "String", "Entity": null }, { "Name": "SensorId", "Description": "Unique identifier for the CrowdStrike sensor on the mobile device.", "Type": "String", "Entity": null }, { "Name": "MobileDetectionId", "Description": "Unique identifier for the mobile detection.", "Type": "String", "Entity": null }, { "Name": "TacticId", "Description": "The MITRE ATT&CK tactic ID associated with the detection.", "Type": "String", "Entity": null }, { "Name": "TechniqueId", "Description": "The MITRE ATT&CK technique ID associated with the detection.", "Type": "String", "Entity": null }, { "Name": "TacticIds", "Description": "MITRE ATT&CK tactic IDs associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Tactics", "Description": "MITRE ATT&CK tactics associated with the detection.", "Type": "String", "Entity": null }, { "Name": "TechniqueIds", "Description": "MITRE ATT&CK technique IDs associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Techniques", "Description": "MITRE ATT&CK techniques associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Author", "Description": "Author of the detection rule.", "Type": "String", "Entity": null }, { "Name": "XdrType", "Description": "Type of XDR detection (e.g., xdr).", "Type": "String", "Entity": null }, { "Name": "SHA256Hashes", "Description": "SHA256 hashes associated with the detection.", "Type": "String", "Entity": null }, { "Name": "SensorIds", "Description": "Sensor IDs associated with the detection.", "Type": "String", "Entity": null }, { "Name": "CrowdStrikeDomain", "Description": "CrowdStrike host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CrowdStrikeCases", "TableSource": "sentinel", "Description": "The CrowdStrikeCases table contains logs from the CrowdStrike Cases API that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the host data was ingested.", "Type": "DateTime", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "Cid", "Description": "The unique customer account ID that the case belongs to.", "Type": "String", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "Int32", "Entity": null }, { "Name": "SeverityInfo", "Description": "Additional information about the severity of the case.", "Type": "Object", "Entity": null }, { "Name": "CreatedTimestamp", "Description": "The date and time the case was created.", "Type": "DateTime", "Entity": null }, { "Name": "UpdatedTimestamp", "Description": "The date and time the case was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "StartTimestamp", "Description": "The date and time the case was started.", "Type": "DateTime", "Entity": null }, { "Name": "EndTimestamp", "Description": "The date and time the case was ended.", "Type": "DateTime", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "Int32", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "Object", "Entity": null }, { "Name": "AssignedTo", "Description": "Details about the user who is currently assigned to the case.", "Type": "Object", "Entity": null }, { "Name": "CreatedBy", "Description": "Identity of the user account who created the profile", "Type": "Object", "Entity": null }, { "Name": "LastUpdatedBy", "Description": "Identity of the user account who last updated the profile", "Type": "Object", "Entity": null }, { "Name": "Consistency", "Description": "Background processing details associated with updates made to the case.", "Type": "Object", "Entity": null }, { "Name": "Evidence", "Description": "JSON dictionary of all alert evidence entities grouped by entity type", "Type": "Object", "Entity": null }, { "Name": "AnalysisResults", "Description": "The results of analyzing the case evidence (alerts, cloud_assets, events, files, hosts, users).", "Type": "Object", "Entity": null }, { "Name": "CrowdStrikeDomain", "Description": "CrowdStrike host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CrowdStrikeDetections", "TableSource": "sentinel", "Description": "The CrowdStrikeDetections table contains logs from the CrowdStrike Detections API that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the detection was ingested.", "Type": "DateTime", "Entity": null }, { "Name": "AdversaryIds", "Description": "List of adversary IDs associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "Behaviors", "Description": "List of behaviors detected that contributed to this detection.", "Type": "Object", "Entity": null }, { "Name": "BehaviorsProcessed", "Description": "List of behaviors that have been processed and analyzed.", "Type": "Object", "Entity": null }, { "Name": "CreatedTimestamp", "Description": "Timestamp when the detection was first created.", "Type": "DateTime", "Entity": null }, { "Name": "DateUpdated", "Description": "Date when the detection record was last updated.", "Type": "String", "Entity": null }, { "Name": "DetectionId", "Description": "Unique identifier for the detection.", "Type": "String", "Entity": null }, { "Name": "FirstBehavior", "Description": "Timestamp of the first behavior in the detection sequence.", "Type": "DateTime", "Entity": null }, { "Name": "HostInfo", "Description": "Information about the host where the detection occurred.", "Type": "Object", "Entity": null }, { "Name": "LastBehavior", "Description": "Timestamp of the most recent behavior in the detection.", "Type": "DateTime", "Entity": null }, { "Name": "MaxConfidence", "Description": "Maximum confidence score across all behaviors in the detection.", "Type": "Int32", "Entity": null }, { "Name": "MaxSeverity", "Description": "Maximum severity level across all behaviors in the detection.", "Type": "Int32", "Entity": null }, { "Name": "MaxSeverityDisplayName", "Description": "Text representation of the maximum severity level.", "Type": "String", "Entity": null }, { "Name": "OverwatchNotes", "Description": "Notes added by CrowdStrike Overwatch analysts.", "Type": "String", "Entity": null }, { "Name": "AgentScanId", "Description": "Identifier for the agent scan that detected this threat.", "Type": "String", "Entity": null }, { "Name": "UpdatedTimestamp", "Description": "Timestamp when the detection was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "EmailSent", "Description": "Indicates if an email notification was sent for this detection.", "Type": "Boolean", "Entity": null }, { "Name": "SecondsToResolved", "Description": "Time in seconds from detection creation to resolution.", "Type": "Int32", "Entity": null }, { "Name": "SecondsToTriaged", "Description": "Time in seconds from detection creation to triage.", "Type": "Int32", "Entity": null }, { "Name": "ShowInUi", "Description": "Indicates if the detection should be displayed in the user interface.", "Type": "Boolean", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "AllegedFiletype", "Description": "The suspected file type of the malicious file.", "Type": "String", "Entity": null }, { "Name": "ChildProcessIds", "Description": "List of child process IDs spawned by the detected process.", "Type": "Object", "Entity": null }, { "Name": "CloudIndicator", "Description": "Indicates if the detection involves cloud-based indicators.", "Type": "Boolean", "Entity": null }, { "Name": "Cmdline", "Description": "Command line used to execute the detected process.", "Type": "String", "Entity": null }, { "Name": "DetectionContext", "Description": "Additional context information about the detection.", "Type": "Object", "Entity": null }, { "Name": "Device", "Description": "Information about the device where the detection occurred.", "Type": "Object", "Entity": null }, { "Name": "FalconHostLink", "Description": "Link to the detection details in the CrowdStrike Falcon console.", "Type": "String", "Entity": null }, { "Name": "Filename", "Description": "Name of the file associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Filepath", "Description": "Full path to the file associated with the detection.", "Type": "String", "Entity": null }, { "Name": "GlobalPrevalence", "Description": "Number of instances of the entity observed by Microsoft globally", "Type": "String", "Entity": null }, { "Name": "GrandparentDetails", "Description": "Details about the grandparent process in the process tree.", "Type": "Object", "Entity": null }, { "Name": "Incident", "Description": "Associated incident information if the detection is part of an incident.", "Type": "Object", "Entity": null }, { "Name": "IndicatorId", "Description": "Identifier for the indicator of compromise (IOC) that triggered the detection.", "Type": "String", "Entity": null }, { "Name": "IocContext", "Description": "Context information about the indicator of compromise.", "Type": "Object", "Entity": null }, { "Name": "LocalPrevalence", "Description": "Local prevalence rating of the detected file within the organization.", "Type": "String", "Entity": null }, { "Name": "LocalProcessId", "Description": "Local process ID on the system where the detection occurred.", "Type": "String", "Entity": null }, { "Name": "LogonDomain", "Description": "Domain used for user logon associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Md5", "Description": "MD5 hash of the detected file.", "Type": "String", "Entity": null }, { "Name": "NetworkAccesses", "Description": "List of network connections made by the detected process.", "Type": "Object", "Entity": null }, { "Name": "OsName", "Description": "Operating system name where the detection occurred.", "Type": "String", "Entity": null }, { "Name": "ParentDetails", "Description": "Details about the parent process in the process tree.", "Type": "Object", "Entity": null }, { "Name": "ParentProcessId", "Description": "The process ID (PID) of the parent process", "Type": "String", "Entity": null }, { "Name": "PatternDisposition", "Description": "Numerical identifier for the action taken by the detection pattern.", "Type": "Int32", "Entity": null }, { "Name": "PatternDispositionDescription", "Description": "Text description of the pattern disposition action.", "Type": "String", "Entity": null }, { "Name": "PatternDispositionDetails", "Description": "Detailed information about the pattern disposition.", "Type": "Object", "Entity": null }, { "Name": "ProcessEndTime", "Description": "Timestamp when the detected process ended.", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessStartTime", "Description": "Timestamp when the detected process started.", "Type": "String", "Entity": null }, { "Name": "Quarantined", "Description": "Indicates if the detected file was quarantined.", "Type": "Boolean", "Entity": null }, { "Name": "QuarantinedFiles", "Description": "List of files that were quarantined as part of this detection.", "Type": "Object", "Entity": null }, { "Name": "ScanId", "Description": "Identifier for the scan that detected the threat.", "Type": "String", "Entity": null }, { "Name": "Sha256", "Description": "SHA256 hash of the detected file.", "Type": "String", "Entity": null }, { "Name": "Sha1", "Description": "SHA1 hash of the detected file.", "Type": "String", "Entity": null }, { "Name": "TemplateInstanceId", "Description": "Instance ID of the detection template used.", "Type": "Int32", "Entity": null }, { "Name": "TemplateInterfaceId", "Description": "Interface ID of the detection template.", "Type": "Int32", "Entity": null }, { "Name": "TemplateInterfaceName", "Description": "Name of the detection template interface.", "Type": "String", "Entity": null }, { "Name": "TreeId", "Description": "Identifier for the process tree associated with the detection.", "Type": "String", "Entity": null }, { "Name": "TreeRoot", "Description": "Root process identifier of the process tree.", "Type": "String", "Entity": null }, { "Name": "TriggeringProcessGraphId", "Description": "Graph ID of the process that triggered the detection.", "Type": "String", "Entity": null }, { "Name": "DetectionType", "Description": "Type or category of the detection.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "User ID associated with the detected process.", "Type": "String", "Entity": null }, { "Name": "UserName", "Description": "Username associated with the detected process.", "Type": "String", "Entity": null }, { "Name": "UserPrincipal", "Description": "User principal name (UPN) associated with the detected process.", "Type": "String", "Entity": null }, { "Name": "AssignedToName", "Description": "Name of the user assigned to investigate the detection.", "Type": "String", "Entity": null }, { "Name": "AssignedToUid", "Description": "User ID of the assigned investigator.", "Type": "String", "Entity": null }, { "Name": "AssignedToUuid", "Description": "UUID of the assigned investigator.", "Type": "String", "Entity": null }, { "Name": "Cid", "Description": "Customer ID in the CrowdStrike platform.", "Type": "String", "Entity": null }, { "Name": "CompositeId", "Description": "Composite identifier combining multiple detection attributes.", "Type": "String", "Entity": null }, { "Name": "Confidence", "Description": "Confidence score of the detection (0-100).", "Type": "Int32", "Entity": null }, { "Name": "CrawledTimestamp", "Description": "Timestamp when the detection data was last crawled.", "Type": "DateTime", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "Entities", "Description": "Entities associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "EntityValues", "Description": "Values of the entities associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "MitreAttack", "Description": "MITRE ATT&CK tactics and techniques associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "References", "Description": "References associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "SourceEventModel", "Description": "Source event model associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Tactics", "Description": "Tactics associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "TacticIds", "Description": "IDs of the tactics associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "Techniques", "Description": "Techniques associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "TechniqueIds", "Description": "IDs of the techniques associated with the detection.", "Type": "Object", "Entity": null }, { "Name": "XdrDetectionId", "Description": "XDR detection ID associated with the detection.", "Type": "String", "Entity": null }, { "Name": "AddedPrivileges", "Description": "Privileges added during the detection process.", "Type": "Object", "Entity": null }, { "Name": "AggregateId", "Description": "Aggregate ID associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Objective", "Description": "Objective associated with the detection.", "Type": "String", "Entity": null }, { "Name": "PolyId", "Description": "Poly ID associated with the detection.", "Type": "String", "Entity": null }, { "Name": "PreviousPrivileges", "Description": "Privileges previously held before the detection process.", "Type": "String", "Entity": null }, { "Name": "Privileges", "Description": "Current privileges associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Scenario", "Description": "Scenario associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "Int32", "Entity": null }, { "Name": "SeverityName", "Description": "Name of the severity level associated with the detection.", "Type": "String", "Entity": null }, { "Name": "SourceAccountDomain", "Description": "Source account domain associated with the detection.", "Type": "String", "Entity": null }, { "Name": "SourceAccountName", "Description": "Source account name associated with the detection.", "Type": "String", "Entity": null }, { "Name": "SourceAccountObjectGuid", "Description": "Source account object GUID associated with the detection.", "Type": "String", "Entity": null }, { "Name": "SourceAccountObjectSid", "Description": "Source account object SID associated with the detection.", "Type": "String", "Entity": null }, { "Name": "SourceAccountSamAccountName", "Description": "Source account SAM account name associated with the detection.", "Type": "String", "Entity": null }, { "Name": "SourceAccountUpn", "Description": "Source account UPN associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Tactic", "Description": "Tactic associated with the detection.", "Type": "String", "Entity": null }, { "Name": "Technique", "Description": "Technique associated with the detection.", "Type": "String", "Entity": null }, { "Name": "TacticId", "Description": "ID of the tactic associated with the detection.", "Type": "String", "Entity": null }, { "Name": "TechniqueId", "Description": "ID of the technique associated with the detection.", "Type": "String", "Entity": null }, { "Name": "TemplateInstanceIdText", "Description": "Instance ID of the detection template used (string representation).", "Type": "String", "Entity": null }, { "Name": "TemplateInterfaceIdText", "Description": "Interface ID of the detection template (string representation).", "Type": "String", "Entity": null }, { "Name": "CrowdStrikeDomain", "Description": "CrowdStrike host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CrowdStrikeHosts", "TableSource": "sentinel", "Description": "The CrowdStrikeHosts table contains logs from the CrowdStrike Hosts API that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the host data was ingested.", "Type": "DateTime", "Entity": null }, { "Name": "AgentLoadFlags", "Description": "Flags indicating the load status of the CrowdStrike agent.", "Type": "String", "Entity": null }, { "Name": "AgentLocalTime", "Description": "Local time of the system where the agent is installed.", "Type": "String", "Entity": null }, { "Name": "AgentVersion", "Description": "Version of the installed CrowdStrike agent.", "Type": "String", "Entity": null }, { "Name": "BaseImageVersion", "Description": "Version of the base operating system image.", "Type": "String", "Entity": null }, { "Name": "BiosManufacturer", "Description": "Manufacturer of the system BIOS.", "Type": "String", "Entity": null }, { "Name": "BiosVersion", "Description": "Version of the system BIOS.", "Type": "String", "Entity": null }, { "Name": "BuildNumber", "Description": "Operating system build number.", "Type": "String", "Entity": null }, { "Name": "ChassisType", "Description": "Type of system chassis (numerical identifier).", "Type": "String", "Entity": null }, { "Name": "ChassisTypeDesc", "Description": "Description of the system chassis type.", "Type": "String", "Entity": null }, { "Name": "Cid", "Description": "Cid the CrowdStrike platform.", "Type": "String", "Entity": null }, { "Name": "ConfigIdBase", "Description": "Base configuration ID for the CrowdStrike agent.", "Type": "String", "Entity": null }, { "Name": "ConfigIdBuild", "Description": "Build configuration ID for the CrowdStrike agent.", "Type": "String", "Entity": null }, { "Name": "ConfigIdPlatform", "Description": "Platform-specific configuration ID for the CrowdStrike agent.", "Type": "String", "Entity": null }, { "Name": "ConnectionIp", "Description": "IP address used by the host to connect to CrowdStrike cloud.", "Type": "String", "Entity": null }, { "Name": "ConnectionMacAddress", "Description": "MAC address of the network interface used for CrowdStrike connection.", "Type": "String", "Entity": null }, { "Name": "CpuSignature", "Description": "Unique identifier for the CPU architecture and features.", "Type": "String", "Entity": null }, { "Name": "CpuVendor", "Description": "Manufacturer of the CPU.", "Type": "String", "Entity": null }, { "Name": "DefaultGatewayIp", "Description": "IP address of the default network gateway.", "Type": "String", "Entity": null }, { "Name": "DeploymentType", "Description": "Type of CrowdStrike agent deployment on the host.", "Type": "String", "Entity": null }, { "Name": "DetectionSuppressionStatus", "Description": "Status of detection suppression rules applied to the host.", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "DevicePolicies", "Description": "List of security policies applied to the device.", "Type": "Object", "Entity": null }, { "Name": "Email", "Description": "Email address associated with the host or primary user.", "Type": "String", "Entity": null }, { "Name": "ExternalIp", "Description": "External IP address of the host.", "Type": "String", "Entity": null }, { "Name": "FilesystemContainmentStatus", "Description": "Status of filesystem containment feature for the host.", "Type": "String", "Entity": null }, { "Name": "FirstLoginTimestamp", "Description": "Timestamp of the first user login on the host.", "Type": "String", "Entity": null }, { "Name": "FirstSeen", "Description": "Timestamp of the first record associated with the entity", "Type": "String", "Entity": null }, { "Name": "GroupHash", "Description": "Hash identifier for the host's group membership.", "Type": "String", "Entity": null }, { "Name": "Groups", "Description": "List of security groups the host belongs to.", "Type": "Object", "Entity": null }, { "Name": "HostHiddenStatus", "Description": "Indicates if the host is hidden from normal visibility.", "Type": "String", "Entity": null }, { "Name": "HostUtcOffset", "Description": "UTC time offset for the host's timezone.", "Type": "String", "Entity": null }, { "Name": "Hostname", "Description": "Network hostname of the system.", "Type": "String", "Entity": null }, { "Name": "InstanceId", "Description": "Cloud instance identifier (if applicable).", "Type": "String", "Entity": null }, { "Name": "InternetExposure", "Description": "Level of internet exposure for the host.", "Type": "String", "Entity": null }, { "Name": "K8sClusterGitVersion", "Description": "Git version of the Kubernetes cluster deployment.", "Type": "String", "Entity": null }, { "Name": "K8sClusterId", "Description": "Unique identifier for the Kubernetes cluster.", "Type": "String", "Entity": null }, { "Name": "K8sClusterVersion", "Description": "Version of the Kubernetes cluster.", "Type": "String", "Entity": null }, { "Name": "KernelVersion", "Description": "Version of the operating system kernel.", "Type": "String", "Entity": null }, { "Name": "LastLoginTimestamp", "Description": "Timestamp of the most recent user login.", "Type": "String", "Entity": null }, { "Name": "LastLoginUid", "Description": "User ID of the last user to log in.", "Type": "String", "Entity": null }, { "Name": "LastLoginUser", "Description": "Username of the last user to log in.", "Type": "String", "Entity": null }, { "Name": "LastLoginUserSid", "Description": "Security identifier (SID) of the last user to log in.", "Type": "String", "Entity": null }, { "Name": "LastReboot", "Description": "Timestamp of the last system reboot.", "Type": "String", "Entity": null }, { "Name": "LastSeen", "Description": "Timestamp of the newest record associated with the entity", "Type": "String", "Entity": null }, { "Name": "LinuxSensorMode", "Description": "Operating mode of the CrowdStrike sensor on Linux systems.", "Type": "String", "Entity": null }, { "Name": "LocalIp", "Description": "Local/Internal IP address of the host.", "Type": "String", "Entity": null }, { "Name": "MacAddress", "Description": "MAC address of the network adapter", "Type": "String", "Entity": null }, { "Name": "MachineDomain", "Description": "Domain name the machine is joined to.", "Type": "String", "Entity": null }, { "Name": "MajorVersion", "Description": "Major version number of the operating system.", "Type": "String", "Entity": null }, { "Name": "ManagedApps", "Description": "List of applications managed by CrowdStrike on the host.", "Type": "Object", "Entity": null }, { "Name": "Meta", "Description": "Additional metadata about the host.", "Type": "Object", "Entity": null }, { "Name": "MigrationCompletedTime", "Description": "Timestamp when agent migration was completed.", "Type": "String", "Entity": null }, { "Name": "MinorVersion", "Description": "Minor version number of the operating system.", "Type": "String", "Entity": null }, { "Name": "ModifiedTimestamp", "Description": "Timestamp when the host record was last modified.", "Type": "String", "Entity": null }, { "Name": "Notes", "Description": "Custom notes or annotations about the host.", "Type": "Object", "Entity": null }, { "Name": "OsBuild", "Description": "Build number of the operating system.", "Type": "String", "Entity": null }, { "Name": "OsProductName", "Description": "Product name of the operating system.", "Type": "String", "Entity": null }, { "Name": "OsVersion", "Description": "Version string of the operating system.", "Type": "String", "Entity": null }, { "Name": "Ou", "Description": "Organizational Unit information for the host.", "Type": "Object", "Entity": null }, { "Name": "PlatformId", "Description": "Unique identifier for the platform type.", "Type": "String", "Entity": null }, { "Name": "PlatformName", "Description": "Name of the platform.", "Type": "String", "Entity": null }, { "Name": "PodAnnotations", "Description": "Kubernetes pod annotations associated with the host.", "Type": "Object", "Entity": null }, { "Name": "PodHostIp4", "Description": "IPv4 address of the Kubernetes pod host.", "Type": "String", "Entity": null }, { "Name": "PodHostIp6", "Description": "IPv6 address of the Kubernetes pod host.", "Type": "String", "Entity": null }, { "Name": "PodHostname", "Description": "Hostname of the Kubernetes pod.", "Type": "String", "Entity": null }, { "Name": "PodId", "Description": "Unique identifier for the Kubernetes pod.", "Type": "String", "Entity": null }, { "Name": "PodIp4", "Description": "IPv4 address assigned to the Kubernetes pod.", "Type": "String", "Entity": null }, { "Name": "PodIp6", "Description": "IPv6 address assigned to the Kubernetes pod.", "Type": "String", "Entity": null }, { "Name": "PodLabels", "Description": "Labels assigned to the Kubernetes pod.", "Type": "Object", "Entity": null }, { "Name": "PodName", "Description": "Name of the Kubernetes pod.", "Type": "String", "Entity": null }, { "Name": "PodNamespace", "Description": "Kubernetes namespace where the pod is deployed.", "Type": "String", "Entity": null }, { "Name": "PodServiceAccountName", "Description": "Name of the Kubernetes service account used by the pod.", "Type": "String", "Entity": null }, { "Name": "PointerSize", "Description": "Memory pointer size of the system architecture (32/64 bit).", "Type": "String", "Entity": null }, { "Name": "Policies", "Description": "List of insider risk management policies associated with the behavior", "Type": "Object", "Entity": null }, { "Name": "ProductType", "Description": "Type of product or system (numerical identifier).", "Type": "String", "Entity": null }, { "Name": "ProductTypeDesc", "Description": "Description of the product or system type.", "Type": "String", "Entity": null }, { "Name": "ProvisionStatus", "Description": "Current provisioning status of the host.", "Type": "String", "Entity": null }, { "Name": "ReducedFunctionalityMode", "Description": "Indicates if the host is running in reduced functionality mode.", "Type": "String", "Entity": null }, { "Name": "ReleaseGroup", "Description": "Group identifier for software release management.", "Type": "String", "Entity": null }, { "Name": "RtrState", "Description": "State of Real Time Response functionality.", "Type": "String", "Entity": null }, { "Name": "SerialNumber", "Description": "Unique identifier for the certificate within a certificate authority's systems", "Type": "String", "Entity": null }, { "Name": "ServicePackMajor", "Description": "Major version of installed service pack.", "Type": "String", "Entity": null }, { "Name": "ServicePackMinor", "Description": "Minor version of installed service pack.", "Type": "String", "Entity": null }, { "Name": "ServiceProvider", "Description": "Cloud service provider hosting the system.", "Type": "String", "Entity": null }, { "Name": "ServiceProviderAccountId", "Description": "Account identifier from the cloud service provider.", "Type": "String", "Entity": null }, { "Name": "SiteName", "Description": "Name of the site where the host is located.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "SystemManufacturer", "Description": "Manufacturer of the system hardware.", "Type": "String", "Entity": null }, { "Name": "SystemProductName", "Description": "Product name or model of the system.", "Type": "String", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "Object", "Entity": null }, { "Name": "CrowdStrikeDomain", "Description": "CrowdStrike host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CrowdStrikeIncidents", "TableSource": "sentinel", "Description": "The CrowdStrikeIncidents table contains logs from the CrowdStrike Incidents API that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the incident data was ingested.", "Type": "DateTime", "Entity": null }, { "Name": "AssignedTo", "Description": "ID of the user assigned to the incident.", "Type": "String", "Entity": null }, { "Name": "AssignedToName", "Description": "Name of the user assigned to handle the incident.", "Type": "String", "Entity": null }, { "Name": "Cid", "Description": "Customer ID in the CrowdStrike platform.", "Type": "String", "Entity": null }, { "Name": "Created", "Description": "Timestamp when the incident was created.", "Type": "DateTime", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "EmailState", "Description": "Current state of email notifications for the incident.", "Type": "String", "Entity": null }, { "Name": "End", "Description": "Timestamp when the incident was closed or resolved.", "Type": "DateTime", "Entity": null }, { "Name": "EventsHistogram", "Description": "Timeline of events associated with the incident.", "Type": "Object", "Entity": null }, { "Name": "FineScore", "Description": "Severity score assigned to the incident.", "Type": "Int32", "Entity": null }, { "Name": "GroupingIds", "Description": "List of IDs used to group related incidents.", "Type": "Object", "Entity": null }, { "Name": "HostIds", "Description": "List of host IDs involved in the incident.", "Type": "Object", "Entity": null }, { "Name": "Hosts", "Description": "Detailed information about affected hosts.", "Type": "Object", "Entity": null }, { "Name": "IncidentId", "Description": "Unique identifier of the incident", "Type": "String", "Entity": null }, { "Name": "IncidentType", "Description": "Numerical identifier for the type of incident.", "Type": "Int32", "Entity": null }, { "Name": "LmHostIds", "Description": "List of host IDs associated with Lightweight Mode.", "Type": "Object", "Entity": null }, { "Name": "LmHostsCapped", "Description": "Indicates if the number of Lightweight Mode hosts was capped.", "Type": "Boolean", "Entity": null }, { "Name": "LmTypes", "Description": "Types of Lightweight Mode configurations.", "Type": "Int32", "Entity": null }, { "Name": "LmraHostIds", "Description": "List of host IDs associated with LMRA (Lightweight Mode Remote Access).", "Type": "Object", "Entity": null }, { "Name": "LmraHostsCapped", "Description": "Indicates if the number of LMRA hosts was capped.", "Type": "Boolean", "Entity": null }, { "Name": "ModifiedTimestamp", "Description": "Timestamp when the incident was last modified.", "Type": "DateTime", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "Objectives", "Description": "List of attacker objectives identified in the incident.", "Type": "Object", "Entity": null }, { "Name": "Start", "Description": "Timestamp when the incident started.", "Type": "DateTime", "Entity": null }, { "Name": "State", "Description": "State where the sign-in occurred, if available", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "Int32", "Entity": null }, { "Name": "Tactics", "Description": "List of MITRE ATT&CK tactics identified in the incident.", "Type": "Object", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "Object", "Entity": null }, { "Name": "Techniques", "Description": "List of MITRE ATT&CK techniques identified in the incident.", "Type": "Object", "Entity": null }, { "Name": "Users", "Description": "List of users involved in or affected by the incident.", "Type": "Object", "Entity": null }, { "Name": "CrowdStrikeDomain", "Description": "CrowdStrike host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "CrowdStrikeVulnerabilities", "TableSource": "sentinel", "Description": "The CrowdStrikeVulnerabilities table contains logs from the CrowdStrike Vulnerabilities API that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) when the event was ingested.", "Type": "DateTime", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "Cid", "Description": "Customer ID in the CrowdStrike platform.", "Type": "String", "Entity": null }, { "Name": "Aid", "Description": "Agent ID of the system where vulnerability was detected.", "Type": "String", "Entity": null }, { "Name": "VulnerabilityId", "Description": "Unique identifier for the specific vulnerability.", "Type": "String", "Entity": null }, { "Name": "DataProviders", "Description": "List of data providers that reported this vulnerability.", "Type": "Object", "Entity": null }, { "Name": "CreatedTimestamp", "Description": "Timestamp when the vulnerability was first detected.", "Type": "DateTime", "Entity": null }, { "Name": "UpdatedTimestamp", "Description": "Timestamp when the vulnerability record was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Apps", "Description": "List of affected applications.", "Type": "Object", "Entity": null }, { "Name": "SuppressionInfo", "Description": "Information about vulnerability suppression if applied.", "Type": "Object", "Entity": null }, { "Name": "Confidence", "Description": "Confidence level of the vulnerability detection.", "Type": "String", "Entity": null }, { "Name": "App", "Description": "Detailed information about the affected application.", "Type": "Object", "Entity": null }, { "Name": "Cve", "Description": "Common Vulnerabilities and Exposures (CVE) information.", "Type": "Object", "Entity": null }, { "Name": "HostInfo", "Description": "Information about the affected host system.", "Type": "Object", "Entity": null }, { "Name": "Remediation", "Description": "Remediation steps or recommendations for the vulnerability.", "Type": "Object", "Entity": null }, { "Name": "CrowdStrikeDomain", "Description": "CrowdStrike host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "DataverseActivity", "TableSource": "sentinel", "Description": "Contains Microsoft Dataverse audit logs. It's typically used to track Dataverse and Dynamics 365 activities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceRecordId", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in (UTC) when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of user that performed the operation. See the UserType table in Office 365 management activity api schema documentation for details on the types of users.", "Type": "String", "Entity": null }, { "Name": "UserKey", "Description": "An alternative ID for the user identified in the UserId property.", "Type": "String", "Entity": null }, { "Name": "ResultStatus", "Description": "Indicates whether the action (specified in the Operation property) was successful or not.", "Type": "String", "Entity": null }, { "Name": "OriginalObjectId", "Description": "The ObjectId for Dataverse operation or business activity.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "The Dataverse user ID of the user who performed the action (specified in the Operation property) that resulted in the record being logged.", "Type": "String", "Entity": null }, { "Name": "UserUpn", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged.", "Type": "String", "Entity": null }, { "Name": "ClientIp", "Description": "The IP address of the device that was used when the activity was logged.", "Type": "String", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "CrmOrganizationUniqueName", "Description": "Unique name of the organization.", "Type": "String", "Entity": null }, { "Name": "InstanceUrl", "Description": "URL to the instance.", "Type": "String", "Entity": null }, { "Name": "ItemUrl", "Description": "URL to the record emitting the log.", "Type": "String", "Entity": null }, { "Name": "ItemType", "Description": "The type of object that was accessed or modified. See the ItemType table for details on the types of objects.", "Type": "String", "Entity": null }, { "Name": "Message", "Description": "Name of the message called in the Dynamics 365 SDK.", "Type": "String", "Entity": null }, { "Name": "EntityId", "Description": "Unique identifier of the entity.", "Type": "String", "Entity": null }, { "Name": "EntityName", "Description": "Name of the entity in the organization.", "Type": "String", "Entity": null }, { "Name": "Fields", "Description": "JSON of Key Value pair reflecting the values that were created or updated.", "Type": "Object", "Entity": null }, { "Name": "Query", "Description": "String used to run the query", "Type": "String", "Entity": null }, { "Name": "QueryResults", "Description": "One or multiple unique records returned by the Retrieve and Retrieve Multiple SDK message call.", "Type": "Object", "Entity": null }, { "Name": "ServiceContextId", "Description": "The unique id associated with service context.", "Type": "String", "Entity": null }, { "Name": "ServiceContextIdType", "Description": "Application defined token to define context use.", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "Name of the Service generating the log.", "Type": "String", "Entity": null }, { "Name": "SystemUserId", "Description": "Unique identifier of the user GUID in the organization.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "DnsAuditEvents", "TableSource": "sentinel", "Description": "DNS server audit events enable change tracking on the DNS server. An audit event is logged each time server, zone, or resource record settings are changed. This includes operational events such as zone transfers, and DNSSEC zone signing and unsigning. This table captures audit events that are not from dynamic updates.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "ActiveKey", "Description": "Signing key of the KSK's active key.", "Type": "String", "Entity": null }, { "Name": "Base64Data", "Description": "Key data.", "Type": "String", "Entity": null }, { "Name": "BufferSize", "Description": "Size of the buffer used for logging the event data.(in bytes)", "Type": "Int32", "Entity": null }, { "Name": "ChildZone", "Description": "Name of a child zone.", "Type": "String", "Entity": null }, { "Name": "ClientSubnetList", "Description": "The list of IPv4 and IPv6 of the client subnet.", "Type": "String", "Entity": null }, { "Name": "ClientSubnetRecord", "Description": "Then name of the client subnet.", "Type": "String", "Entity": null }, { "Name": "Condition", "Description": "Specific circumstances or requirements that trigger certain actions or policies.", "Type": "String", "Entity": null }, { "Name": "Criteria", "Description": "Criteria or conditions that triggered the event.", "Type": "String", "Entity": null }, { "Name": "CryptoAlgorithm", "Description": "The cryptographic algorithm used for securing DNS-related operations.", "Type": "String", "Entity": null }, { "Name": "CurrentRolloverStatus", "Description": "The state of the key rollover process from one key to another.", "Type": "String", "Entity": null }, { "Name": "CurrentState", "Description": "The current status of a DNS key or zone.", "Type": "String", "Entity": null }, { "Name": "DenialOfExistence", "Description": "The method used to prove that a certain DNS record does not exist.", "Type": "String", "Entity": null }, { "Name": "Digest", "Description": "A secure fingerprint, allowing DNS resolvers to validate the authenticity of the trust anchor information.", "Type": "String", "Entity": null }, { "Name": "DigestType", "Description": "Specifies the type of cryptographic hash algorithm used for generating the digest (hash) value.", "Type": "String", "Entity": null }, { "Name": "DistributeTrustAnchor", "Description": "Relates to the distribution of a trust anchor for DNSSEC, which is a secure public key that helps in the validation of DNS data.", "Type": "String", "Entity": null }, { "Name": "DnsKeyRecordSetTtl", "Description": "The time-to-live (TTL) value assigned to DNSKEY records when signing a DNS zone. This value determines how long a DNSKEY record will be considered valid before it needs to be refreshed.", "Type": "Int32", "Entity": null }, { "Name": "DnsKeySignatureValidityPeriod", "Description": "The duration in seconds that a DNSKEY record’s signature is considered valid.", "Type": "Int32", "Entity": null }, { "Name": "DnsQuery", "Description": "The domain that needs to be resolved.", "Type": "String", "Entity": null }, { "Name": "DnsQueryType", "Description": "The DNS resource record type codes as defined by the Internet Assigned Numbers Authority (IANA).", "Type": "Int32", "Entity": null }, { "Name": "DSRecordGenerationAlgorithm", "Description": "The algorithm used to generate the Delegation Signer (DS) record from the DNSKEY record.", "Type": "String", "Entity": null }, { "Name": "DSRecordSetTtl", "Description": "The time-to-live (TTL) value for the DS (Delegation Signer) record set.", "Type": "Int32", "Entity": null }, { "Name": "DSSignatureValidityPeriod", "Description": "The period in seconds that a DS (Delegation Signer) record’s signature is considered valid.", "Type": "Int32", "Entity": null }, { "Name": "EnableRfc5011KeyRollover", "Description": "The process of automating the update and rollover of DNSSEC keys in accordance with RFC 5011 standards.", "Type": "String", "Entity": null }, { "Name": "EventGuid", "Description": "Unique identifier for the specific event.", "Type": "String", "Entity": null }, { "Name": "EventId", "Description": "Contains the unique event identifier", "Type": "String", "Entity": null }, { "Name": "EventString", "Description": "Human-readable description of the event.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "Type of DNS event (e.g., zone transfer, dynamic update, DNSSEC signing).", "Type": "String", "Entity": null }, { "Name": "FilePath", "Description": "The location of a file or directory that the DNS server is interacting with.", "Type": "String", "Entity": null }, { "Name": "Forwarders", "Description": "DNS forwarders used by the server.", "Type": "String", "Entity": null }, { "Name": "InitialRolloverOffset", "Description": "The initial time delay (in seconds) before the first rollover action is triggered for a DNSSEC key.", "Type": "Int32", "Entity": null }, { "Name": "IsEnabled", "Description": "This parameter indicates whether the policy or exception list is currently active.", "Type": "String", "Entity": null }, { "Name": "IsKeyMasterServer", "Description": "Whether the DNS server is the primary key for a DNSSEC-signed zone.", "Type": "String", "Entity": null }, { "Name": "KeyId", "Description": "The unique identifier of a DNSSEC signing key.", "Type": "String", "Entity": null }, { "Name": "KeyLength", "Description": "The length of the cryptographic key used in DNSSEC signing operations.", "Type": "Int32", "Entity": null }, { "Name": "KeyMasterServer", "Description": "The DNS server that is responsible for generating and managing the DNSSEC keys for a zone.", "Type": "String", "Entity": null }, { "Name": "KeyOrZone", "Description": "The signing key used for authentication and data integrity in a specific DNS zone.", "Type": "String", "Entity": null }, { "Name": "KeyProtocol", "Description": "Protocol used for DNSSEC key management (e.g., DNSKEY, DS).", "Type": "String", "Entity": null }, { "Name": "KeyStorageProvider", "Description": "The system or service that is responsible for securely storing the DNSSEC keys.", "Type": "String", "Entity": null }, { "Name": "KeyTag", "Description": "A numeric identifier for the cryptographic key used by the DS record.", "Type": "Int32", "Entity": null }, { "Name": "KeyType", "Description": "The type of DNSSEC signing key being used.", "Type": "String", "Entity": null }, { "Name": "KskOrZsk", "Description": "The type of signing key used in a specific DNS zone.", "Type": "String", "Entity": null }, { "Name": "LastRolloverTime", "Description": "The last time a rollover process took place.", "Type": "DateTime", "Entity": null }, { "Name": "ListenAddresses", "Description": "IP addresses on which the DNS server listens.", "Type": "String", "Entity": null }, { "Name": "LookupValue", "Description": "Type of DNS lookup (e.g., recursive, iterative).", "Type": "String", "Entity": null }, { "Name": "MasterServer", "Description": "The primary DNS server from which a secondary DNS server obtains zone data.", "Type": "String", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "NameServer", "Description": "Name server responsible for the DNS event.", "Type": "String", "Entity": null }, { "Name": "NewPropertyValues", "Description": "The set of properties after they were updated for a specific policy or exception list in the DNS server or zone.", "Type": "String", "Entity": null }, { "Name": "NewValue", "Description": "The updated value assigned to a specific property key within the DNS zone.", "Type": "String", "Entity": null }, { "Name": "NextKey", "Description": "The upcoming key that will be used in the DNS zone signing process after the current active and standby keys.", "Type": "String", "Entity": null }, { "Name": "NextRolloverAction", "Description": "The rollover action performed.", "Type": "String", "Entity": null }, { "Name": "NextRolloverTime", "Description": "The next time a rollover process should happen.", "Type": "DateTime", "Entity": null }, { "Name": "NodeName", "Description": "Node display name", "Type": "String", "Entity": null }, { "Name": "NSec3HashAlgorithm", "Description": "The cryptographic hash algorithm used in the NSEC3 protocol for DNSSEC.", "Type": "Int32", "Entity": null }, { "Name": "NSec3Iterations", "Description": "The number of additional hashing iterations a DNSSEC-enabled DNS server uses.", "Type": "Int32", "Entity": null }, { "Name": "NSec3OptOut", "Description": "Indicates if the DNSSEC NSEC3 protocol is configured to allow unsigned delegations.", "Type": "String", "Entity": null }, { "Name": "NSec3RandomSaltLength", "Description": "The length of the random salt value used in the NSEC3 protocol for DNSSEC.", "Type": "Int32", "Entity": null }, { "Name": "NSec3UserSalt", "Description": "The user-defined salt value used in the NSEC3 protocol for DNSSEC.", "Type": "String", "Entity": null }, { "Name": "OldPropertyValues", "Description": "The set of properties before they were updated for a specific policy or exception list in the DNS server or zone.", "Type": "String", "Entity": null }, { "Name": "ParentHasSecureDelegation", "Description": "Whether the parent zone has a secure delegation to the child zone.", "Type": "String", "Entity": null }, { "Name": "Policy", "Description": "Defines rules or guidelines for managing specific aspects of DNS behavior.", "Type": "String", "Entity": null }, { "Name": "ProcessingOrder", "Description": "Determines the sequence in which policies are applied.", "Type": "Int32", "Entity": null }, { "Name": "PropagationTime", "Description": "Time taken for the event information to propagate. Duration (e.g., milliseconds) or “Immediate” if no delay.", "Type": "Int32", "Entity": null }, { "Name": "PropertyKey", "Description": "Specific property or setting affected by the event.", "Type": "String", "Entity": null }, { "Name": "RDATA", "Description": "Represents the data of the resource record that was created, deleted, or scavenged in the DNS zone.", "Type": "String", "Entity": null }, { "Name": "RecursionScope", "Description": "A specific area or set of conditions under which DNS recursion is allowed or applied on a DNS server.", "Type": "String", "Entity": null }, { "Name": "ReplicationScope", "Description": "Scope of DNS replication (e.g., forest-wide, domain-specific).", "Type": "String", "Entity": null }, { "Name": "RolloverPeriod", "Description": "Time interval for log rollover (e.g., daily, weekly).", "Type": "Int32", "Entity": null }, { "Name": "RolloverType", "Description": "Type of rollover (e.g., overwrite, append).", "Type": "String", "Entity": null }, { "Name": "ScavengeServers", "Description": "Servers involved in DNS scavenging (aging and cleanup of stale records).", "Type": "String", "Entity": null }, { "Name": "Scope", "Description": "The scope of the event (e.g., server-wide, zone-specific).", "Type": "String", "Entity": null }, { "Name": "Scopes", "Description": "Scopes in token claims", "Type": "String", "Entity": null }, { "Name": "SecureDelegationPollingPeriod", "Description": "Interval for polling secure delegation information. Numeric value (e.g., minutes) or “Disabled” if not applicable.", "Type": "Int32", "Entity": null }, { "Name": "SeizedOrTransferred", "Description": "Refers to the action taken, either a seizure (when control is forcibly transferred) or a voluntary transfer of the key master role.", "Type": "String", "Entity": null }, { "Name": "ServerName", "Description": "Represents the DNS server where the policy or exception list is being configured.", "Type": "String", "Entity": null }, { "Name": "Setting", "Description": "Specific DNS configuration setting modified by the event.", "Type": "String", "Entity": null }, { "Name": "SignatureInceptionOffset", "Description": "Offset time for DNSSEC signature inception. Duration (e.g., seconds) or “Immediate” if no delay.", "Type": "Int32", "Entity": null }, { "Name": "Source", "Description": "The registry path or other location used to determine the current device setting", "Type": "String", "Entity": null }, { "Name": "StandbyKey", "Description": "the backup key that will be used if the current active key is compromised or needs to be replaced in the DNS zone signing process.", "Type": "String", "Entity": null }, { "Name": "StoreKeysInAD", "Description": "Specifies whether the keys are stored in Active Directory Domain Services (AD DS). This setting applies only to Active Directory-integrated zones when the vendor of KeyStorageProvider is Microsoft.", "Type": "String", "Entity": null }, { "Name": "SubTreeAging", "Description": "Mechanism that affects the aging (expiration) of DNS records within a specific subtree or branch of a DNS zone.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "TTL", "Description": "The time-to-live for the DNS record, indicating how long the record should be cached before it is discarded or refreshed.", "Type": "Int32", "Entity": null }, { "Name": "VirtualizationID", "Description": "A unique key to manage and coordinate activities within the virtualized environment.", "Type": "String", "Entity": null }, { "Name": "WithNewKeys", "Description": "Indicates whether new DNSSEC keys were generated.", "Type": "String", "Entity": null }, { "Name": "WithWithout", "Description": "Whether key signing key (KSK) metadata is included or excluded when exporting DNSSEC settings for a specific zone.", "Type": "String", "Entity": null }, { "Name": "Zone", "Description": "The zone related to the activity.", "Type": "String", "Entity": null }, { "Name": "ZoneFile", "Description": "The name of the zone file.", "Type": "String", "Entity": null }, { "Name": "ZoneName", "Description": "The name of a DNS zone on which the zone which the event relates to.", "Type": "String", "Entity": null }, { "Name": "ZoneScope", "Description": "A list of scopes and weights for the zone.", "Type": "String", "Entity": null }, { "Name": "ZoneSignatureValidityPeriod", "Description": "The amount of time that signatures that cover all other record sets are valid.", "Type": "Int32", "Entity": null }, { "Name": "AdditionalData", "Description": "Additional information not already scoped into its own dedicated field.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "DnsEvents", "TableSource": "sentinel", "Description": "", "Schema": [ { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "EventId", "Description": "Contains the unique event identifier", "Type": "Int32", "Entity": null }, { "Name": "SubType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ClientIP", "Description": "", "Type": "String", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "QueryType", "Description": "Type of the query", "Type": "String", "Entity": null }, { "Name": "ResultCode", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "IPAddresses", "Description": "JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and the IP class (RFC 1918 & RFC 4291)", "Type": "String", "Entity": null }, { "Name": "MaliciousIP", "Description": "", "Type": "String", "Entity": null }, { "Name": "IndicatorThreatType", "Description": "", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Confidence", "Description": "", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "Int32", "Entity": null }, { "Name": "RemoteIPLongitude", "Description": "", "Type": "Double", "Entity": null }, { "Name": "RemoteIPLatitude", "Description": "", "Type": "Double", "Entity": null }, { "Name": "RemoteIPCountry", "Description": "", "Type": "String", "Entity": null }, { "Name": "Message", "Description": "", "Type": "String", "Entity": null }, { "Name": "TaskCategory", "Description": "", "Type": "String", "Entity": null }, { "Name": "Result", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "DnsInventory", "TableSource": "sentinel", "Description": "", "Schema": [ { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "SubType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceRecordName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceRecordType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ZoneName", "Description": "", "Type": "String", "Entity": null }, { "Name": "DomainName", "Description": "Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack", "Type": "String", "Entity": null }, { "Name": "ForestName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ServerIPs", "Description": "", "Type": "String", "Entity": null }, { "Name": "DynamicUpdate", "Description": "", "Type": "String", "Entity": null }, { "Name": "DnsSecSigned", "Description": "", "Type": "String", "Entity": null }, { "Name": "NameServers", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "DynamicSummary", "TableSource": "sentinel", "Description": "Azure Sentinel Dynamic Summary provides a security data storage to persist concentrated findings and summaries for hunting, investigation, search, detection. Summary description and detailed observables can be stored in Log Analytics for further analysis and report generation.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was ingested to Azure Monitor.", "Type": "DateTime", "Entity": null }, { "Name": "AzureTenantId", "Description": "The AAD tenant ID to which this DynamicSummary table belongs.", "Type": "String", "Entity": null }, { "Name": "SummaryId", "Description": "Summary unique ID.", "Type": "String", "Entity": null }, { "Name": "SummaryItemId", "Description": "Summary item unique ID.", "Type": "String", "Entity": null }, { "Name": "SummaryName", "Description": "The Summary display name, unique within workspace.", "Type": "String", "Entity": null }, { "Name": "RelationName", "Description": "The original data source name.", "Type": "String", "Entity": null }, { "Name": "RelationId", "Description": "The original data source ID", "Type": "String", "Entity": null }, { "Name": "SearchKey", "Description": "SearchKey is used to optimize query performance when using DynamicSummary for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field to join in other event tables by IP address.", "Type": "String", "Entity": null }, { "Name": "CreatedBy", "Description": "Identity of the user account who created the profile", "Type": "Object", "Entity": null }, { "Name": "CreatedTimeUTC", "Description": "The time (UTC) when the summary was created.", "Type": "DateTime", "Entity": null }, { "Name": "UpdatedBy", "Description": "The JSON object with the user who updated summary, including: object ID, email and name.", "Type": "Object", "Entity": null }, { "Name": "UpdatedTimeUTC", "Description": "The time (UTC) when the summary was updated.", "Type": "DateTime", "Entity": null }, { "Name": "SummaryDescription", "Description": "The description provided by user.", "Type": "String", "Entity": null }, { "Name": "Tactics", "Description": "MITRE ATT&CK tactics are what attackers are trying to achieve. For example, exfiltration.", "Type": "Object", "Entity": null }, { "Name": "Techniques", "Description": "MITRE ATT&CK techniques are how those tactics are accomplished.", "Type": "Object", "Entity": null }, { "Name": "SummaryStatus", "Description": "Active or deleted.", "Type": "String", "Entity": null }, { "Name": "SourceInfo", "Description": "The JSON object with the data producer info, including source, name, version.", "Type": "Object", "Entity": null }, { "Name": "Query", "Description": "String used to run the query", "Type": "String", "Entity": null }, { "Name": "QueryStartDate", "Description": "Events that occurred after this datetime will be included in the result.", "Type": "DateTime", "Entity": null }, { "Name": "QueryEndDate", "Description": "Events that occurred before this datetime will be included in the result.", "Type": "DateTime", "Entity": null }, { "Name": "EventTimeUTC", "Description": "The time (UTC) when the summary item occurred originally.", "Type": "DateTime", "Entity": null }, { "Name": "ObservableType", "Description": "Observables are stateful events ot properties that are related to the operation of computing system, which are helpful in identifying indicators of compromise. For example, login.", "Type": "String", "Entity": null }, { "Name": "ObservableValue", "Description": "Value for observable type, such as: anomalous RDP activity.", "Type": "String", "Entity": null }, { "Name": "PackedContent", "Description": "The JSON object has packed columns which can be generated by using KQL pack_all().", "Type": "Object", "Entity": null }, { "Name": "SummaryDataType", "Description": "This flag is used to tell if the record is either a summary level or a summary item level record.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "Dynamics365Activity", "TableSource": "sentinel", "Description": "Audit logs for Dynamics 365 tenants collected by Azure Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceRecordId", "Description": "Unique identifier of an audit record", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in Coordinated Universal Time (UTC) when the user performed the activity", "Type": "DateTime", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of user that performed the operation. See the UserType table in Office 365 management activity api schema documentation for details on the types of users", "Type": "String", "Entity": null }, { "Name": "UserKey", "Description": "An alternative ID for the user identified in the UserId property", "Type": "String", "Entity": null }, { "Name": "OfficeWorkload", "Description": "The Office 365 service where the activity occurred", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table in Office 365 management activity api schema documentation for details on the types of audit log records", "Type": "String", "Entity": null }, { "Name": "ResultStatus", "Description": "Indicates whether the action (specified in the Operation property) was successful or not", "Type": "String", "Entity": null }, { "Name": "OriginalObjectId", "Description": "The ObjectId for SharePoint and OneDrive about business activity", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged", "Type": "String", "Entity": null }, { "Name": "ClientIP", "Description": "The IP address of the device that was used when the activity was logged", "Type": "String", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "CrmOrganizationUniqueName", "Description": "Unique name of the organization", "Type": "String", "Entity": null }, { "Name": "InstanceUrl", "Description": "URL to the instance", "Type": "String", "Entity": null }, { "Name": "ItemUrl", "Description": "URL to the record emitting the log", "Type": "String", "Entity": null }, { "Name": "ItemType", "Description": "The type of object that was accessed or modified. See the ItemType table for details on the types of objects", "Type": "String", "Entity": null }, { "Name": "Message", "Description": "Name of the message called in the Dynamics365 SDK", "Type": "String", "Entity": null }, { "Name": "EntityId", "Description": "Unique identifier of the entity", "Type": "String", "Entity": null }, { "Name": "EntityName", "Description": "Name of the entity in the organization", "Type": "String", "Entity": null }, { "Name": "Fields", "Description": "JSON of Key Value pair reflecting the values that were created or updated", "Type": "Object", "Entity": null }, { "Name": "Query", "Description": "String used to run the query", "Type": "String", "Entity": null }, { "Name": "QueryResults", "Description": "One or multiple unique records returned by the Retrieve and Retrieve Multiple SDK message call", "Type": "Object", "Entity": null }, { "Name": "ServiceName", "Description": "Name of the Service generating the log", "Type": "String", "Entity": null }, { "Name": "SystemUserId", "Description": "Unique identifier of the user GUID in the organization", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPApigee", "TableSource": "sentinel", "Description": "The Google ApigeeX data connector provides the capability to ingest Audit logs into Microsoft Sentinel using the Google Apigee API. Refer to [Google Apigee API](https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/?apix=true) documentation for more information.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The full log name including resource path.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "Time the log entry was received by Cloud Logging.", "Type": "DateTime", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "Object", "Entity": null }, { "Name": "ProtoPayload", "Description": "Holds the structured audit log data, including authentication, method name, resource name, and service-specific information.", "Type": "Object", "Entity": null }, { "Name": "GCPResource", "Description": "Describes the resource associated with the log entry, including labels and resource type.", "Type": "Object", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp indicating when the log entry was created or received.", "Type": "DateTime", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPAuditLogs", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) audit logs, ingested from Sentinel's connector, enable you to capture three types of audit logs: admin activity logs, data access logs, and access transparency logs. Google cloud audit Logs record a trail that practitioners can use to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the log entry was received by logging.", "Type": "DateTime", "Entity": null }, { "Name": "ServiceName", "Description": "The name of the API service performing the operation. For example, 'compute.googleapis.com'.", "Type": "String", "Entity": null }, { "Name": "MethodName", "Description": "The name of the service method or operation. For API calls, this should be the name of the API method.", "Type": "String", "Entity": null }, { "Name": "GCPResourceName", "Description": "The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name.", "Type": "String", "Entity": null }, { "Name": "NumResponseItems", "Description": "The number of items returned from a list or query API method, if applicable.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "Object", "Entity": null }, { "Name": "AuthenticationInfo", "Description": "Authentication information.", "Type": "Object", "Entity": null }, { "Name": "AuthorizationInfo", "Description": "Authorization information. If there are multiple resources or permissions involved, then there is one AuthorizationInfo element for each {resource, permission} tuple.", "Type": "Object", "Entity": null }, { "Name": "RequestMetadata", "Description": "Metadata about the operation.", "Type": "Object", "Entity": null }, { "Name": "Request", "Description": "The operation request. This may not include all request parameters, such as those that are too large, privacy-sensitive, or duplicated elsewhere in the log record. It should never include user-generated data, such as file contents. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property.", "Type": "Object", "Entity": null }, { "Name": "Response", "Description": "The operation response. This may not include all response elements, such as those that are too large, privacy-sensitive, or duplicated elsewhere in the log record. It should never include user-generated data, such as file contents. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property.", "Type": "Object", "Entity": null }, { "Name": "Metadata", "Description": "Other service-specific data about the request, response, and other information associated with the current audited event.", "Type": "Object", "Entity": null }, { "Name": "StatusMessage", "Description": "The message status of the overall operation.", "Type": "String", "Entity": null }, { "Name": "PrincipalEmail", "Description": "The email address of the authenticated user (or service account on behalf of third party principal) making the request. For third party identity callers, the principalSubject field is populated instead of this field. For privacy reasons, the principal email address is sometimes redacted.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made.", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "ProjectId", "Description": "The identifier of the Google Cloud Platform (GCP) project associated with this resource, such as \"my-project\".", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "The identifier of the type associated with this resource, such as 'pubsub_subscription'.", "Type": "String", "Entity": null }, { "Name": "Subscription", "Description": "A named resource representing the stream of messages from a single, specific topic, to be delivered to the subscribing application.", "Type": "String", "Entity": null }, { "Name": "ResourceLocation", "Description": "The resource location information.", "Type": "Object", "Entity": null }, { "Name": "ResourceOriginalState", "Description": "The resource original state before mutation. Present only for operations which have successfully modified the targeted resource(s). In general, this field should contain all changed fields, except those that are already been included in request, response, metadata or serviceData fields. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property.", "Type": "Object", "Entity": null }, { "Name": "ServiceData", "Description": "An object containing fields of an arbitrary type. An additional field \"@type\" contains a URI identifying the type. Example: { \"id\": 1234, \"@type\": \"types.example.com/standard/id\" }.", "Type": "Object", "Entity": null }, { "Name": "InsertId", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPCDN", "TableSource": "sentinel", "Description": "The Google Cloud Platform CDN data connector provides the capability to ingest Cloud CDN Audit logs and Cloud CDN Traffic logs into Microsoft Sentinel using the Compute Engine API.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "InsertID", "Description": "A unique identifier for the log entry assigned by the logging system", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The full resource name of the log to which this entry belongs", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The time the log entry was received by the logging system", "Type": "DateTime", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log entry was fetched into Microsoft Sentinel", "Type": "DateTime", "Entity": null }, { "Name": "LabelsAPIRootTriggerID", "Description": "The root trigger ID identifying the origin request that caused this log entry", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsBackendServiceID", "Description": "The unique identifier for the GCE backend service", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsBackendBucketID", "Description": "Holds the ResourceLabelsBackendBucketID value recorded in the CDN or load balancer log", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsProjectID", "Description": "The identifier of the Google Cloud project associated with this resource", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsLocation", "Description": "The geographical or regional location of the resource", "Type": "String", "Entity": null }, { "Name": "PayloadType", "Description": "Type URL of the request or response payload", "Type": "String", "Entity": null }, { "Name": "MethodName", "Description": "The name of the API method invoked", "Type": "String", "Entity": null }, { "Name": "NumResponseItems", "Description": "The number of items returned in a list response", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "The Google service processing the request", "Type": "String", "Entity": null }, { "Name": "AuthenticationInfoPrincipalEmail", "Description": "The email of the authenticated identity making the request", "Type": "String", "Entity": null }, { "Name": "AuthorizationInfo", "Description": "Authorization details such as permission name, granted status, and resource type", "Type": "String", "Entity": null }, { "Name": "RequestType", "Description": "Type of the request payload object", "Type": "String", "Entity": null }, { "Name": "RequestKeyName", "Description": "The name of the key used in the request", "Type": "String", "Entity": null }, { "Name": "RequestGroup", "Description": "The reference to instance group used by the backend service", "Type": "String", "Entity": null }, { "Name": "RequestSecurityPolicy", "Description": "The name or full path of the security policy attached to the backend service", "Type": "String", "Entity": null }, { "Name": "RequestCompressionMode", "Description": "Specifies whether and how compression is applied", "Type": "String", "Entity": null }, { "Name": "RequestDescription", "Description": "A custom description associated with the backend service configuration", "Type": "String", "Entity": null }, { "Name": "RequestEnableCDN", "Description": "Boolean indicating if Cloud CDN is enabled for the backend service", "Type": "Boolean", "Entity": null }, { "Name": "RequestIPAddressSelectionPolicy", "Description": "Specifies IP address family for the backend", "Type": "String", "Entity": null }, { "Name": "RequestLoadBalancingScheme", "Description": "Load balancing scheme used", "Type": "String", "Entity": null }, { "Name": "RequestLocalityLbPolicy", "Description": "Locality-based load balancing strategy", "Type": "String", "Entity": null }, { "Name": "RequestName", "Description": "The name assigned to the resource in the request", "Type": "String", "Entity": null }, { "Name": "RequestPortName", "Description": "The named port of the backend service", "Type": "String", "Entity": null }, { "Name": "RequestProtocol", "Description": "Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS", "Type": "String", "Entity": null }, { "Name": "RequestSessionAffinity", "Description": "Affinity setting used to keep sessions on the same backend", "Type": "String", "Entity": null }, { "Name": "RequestTimeoutSec", "Description": "Timeout value (in seconds) for the backend service", "Type": "String", "Entity": null }, { "Name": "RequestBackends", "Description": "Configuration for backend groups", "Type": "String", "Entity": null }, { "Name": "RequestCDNPolicySignedUrlCacheMaxAgeSec", "Description": "Cache TTL for signed URLs in seconds", "Type": "String", "Entity": null }, { "Name": "RequestFingerprint", "Description": "Fingerprint of the request configuration, used for optimistic locking", "Type": "String", "Entity": null }, { "Name": "RequestCDNPolicyCacheMode", "Description": "Cache mode setting", "Type": "String", "Entity": null }, { "Name": "RequestCDNPolicyClientTtl", "Description": "Time-to-live set on responses for clients", "Type": "String", "Entity": null }, { "Name": "RequestCDNPolicyDefaultTtl", "Description": "Default TTL applied when no caching headers are set", "Type": "String", "Entity": null }, { "Name": "RequestCDNPolicyMaxTtl", "Description": "Maximum allowed TTL for cached responses", "Type": "String", "Entity": null }, { "Name": "RequestCDNPolicyNegativeCaching", "Description": "Boolean indicating if negative caching is enabled", "Type": "Boolean", "Entity": null }, { "Name": "RequestCDNPolicyServeWhileStale", "Description": "Duration responses are served while stale", "Type": "String", "Entity": null }, { "Name": "RequestCDNPolicyCacheKeyPolicyIncludeHost", "Description": "Whether the host is included in the cache key", "Type": "Boolean", "Entity": null }, { "Name": "RequestCDNPolicyCacheKeyPolicyIncludeProtocol", "Description": "Whether protocol is included in the cache key", "Type": "Boolean", "Entity": null }, { "Name": "RequestCDNPolicyCacheKeyPolicyIncludeQueryString", "Description": "Whether the query string is included in the cache key", "Type": "Boolean", "Entity": null }, { "Name": "RequestConnectionDrainingTimeoutSec", "Description": "Time in seconds for draining connections during backend removal", "Type": "String", "Entity": null }, { "Name": "RequestHealthChecks", "Description": "List of health check resources attached to the backend service", "Type": "String", "Entity": null }, { "Name": "RequestLogConfigEnable", "Description": "Boolean to enable request logging", "Type": "Boolean", "Entity": null }, { "Name": "RequestLogConfigSampleRate", "Description": "Sampling rate for log entries when logging is enabled", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerIP", "Description": "IP address of the request initiator", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerSuppliedUserAgent", "Description": "User agent string of the request initiator", "Type": "String", "Entity": null }, { "Name": "RequestMetadataDestinationAttributes", "Description": "Attributes of the destination, often empty in public APIs", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesAuth", "Description": "Authentication metadata for the request", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesTime", "Description": "Time when the request was initiated", "Type": "DateTime", "Entity": null }, { "Name": "RequestMetadataRequestAttributesReason", "Description": "Encoded reason for the request", "Type": "String", "Entity": null }, { "Name": "ResourceLocationCurrentLocations", "Description": "Region or location associated with the resource", "Type": "String", "Entity": null }, { "Name": "ResponseType", "Description": "Type of the response object returned", "Type": "String", "Entity": null }, { "Name": "ResponseID", "Description": "Unique identifier for the response or operation", "Type": "String", "Entity": null }, { "Name": "ResponseInsertTime", "Description": "Time when the response operation was created", "Type": "DateTime", "Entity": null }, { "Name": "ResponseName", "Description": "Name assigned to the long-running operation", "Type": "String", "Entity": null }, { "Name": "ResponseOperationType", "Description": "Type of the operation performed", "Type": "String", "Entity": null }, { "Name": "ResponseProgress", "Description": "Progress of the operation in percentage", "Type": "String", "Entity": null }, { "Name": "ResponseSelfLink", "Description": "URI of the operation", "Type": "String", "Entity": null }, { "Name": "ResponseSelfLinkWithID", "Description": "URI of the operation with ID appended", "Type": "String", "Entity": null }, { "Name": "ResponseStartTime", "Description": "Time when the operation started", "Type": "DateTime", "Entity": null }, { "Name": "ResponseStatus", "Description": "Status of the operation", "Type": "String", "Entity": null }, { "Name": "ResponseTargetID", "Description": "ID of the target resource affected by the operation", "Type": "String", "Entity": null }, { "Name": "ResponseTargetLink", "Description": "URI of the affected resource", "Type": "String", "Entity": null }, { "Name": "ResponseUser", "Description": "User who initiated the operation.", "Type": "String", "Entity": null }, { "Name": "OperationFirst", "Description": "Boolean flag indicating this log entry is the first record in a long-running operation", "Type": "Boolean", "Entity": null }, { "Name": "OperationLast", "Description": "Boolean flag indicating this log entry is the final record in a long-running operation", "Type": "Boolean", "Entity": null }, { "Name": "OperationID", "Description": "Unique identifier for the operation", "Type": "String", "Entity": null }, { "Name": "OperationProducer", "Description": "The service that initiated and owns the operation", "Type": "String", "Entity": null }, { "Name": "SpanID", "Description": "Identifier of the span within a trace", "Type": "String", "Entity": null }, { "Name": "Trace", "Description": "Identifier of the trace", "Type": "String", "Entity": null }, { "Name": "HttpRequestCacheLookup", "Description": "Boolean flag indicating whether the request attempted a cache lookup before contacting the backend", "Type": "Boolean", "Entity": null }, { "Name": "HttpRequestLatency", "Description": "The latency or total time taken to process the request", "Type": "String", "Entity": null }, { "Name": "HttpRequestRemoteIP", "Description": "The IP address of the client that made the request", "Type": "String", "Entity": null }, { "Name": "HttpRequestRequestMethod", "Description": "HTTP method used for the request", "Type": "String", "Entity": null }, { "Name": "HttpRequestRequestSize", "Description": "Size of the incoming HTTP request in bytes", "Type": "String", "Entity": null }, { "Name": "HttpRequestRequestUrl", "Description": "Full URL that was requested", "Type": "String", "Entity": null }, { "Name": "HttpRequestResponseSize", "Description": "Size of the HTTP response payload sent to the client, in bytes", "Type": "String", "Entity": null }, { "Name": "HttpRequestCacheFillBytes", "Description": "Number of bytes written to the cache from this response", "Type": "String", "Entity": null }, { "Name": "HttpRequestCacheHit", "Description": "Boolean flag indicating whether the response was served from cache", "Type": "Boolean", "Entity": null }, { "Name": "HttpRequestServerIP", "Description": "IP address of the server (or Google Front End) that processed the request", "Type": "String", "Entity": null }, { "Name": "HttpRequestStatus", "Description": "HTTP status code returned by the server", "Type": "String", "Entity": null }, { "Name": "HttpRequestUserAgent", "Description": "User agent string from the HTTP request header", "Type": "String", "Entity": null }, { "Name": "JsonPayloadType", "Description": "The protobuf type URL describing the type of jsonPayload content in the log", "Type": "String", "Entity": null }, { "Name": "BackendTargetProjectNumber", "Description": "Holds the project number where the backend target—backend service or backend bucket—has been created", "Type": "String", "Entity": null }, { "Name": "CacheDecision", "Description": "Indicates caching decisions taken", "Type": "String", "Entity": null }, { "Name": "CacheID", "Description": "Unique identifier for the cache entry associated with this response", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": null }, { "Name": "StatusDetails", "Description": "Holds a string that explains why the load balancer returned the HTTP status that it did", "Type": "String", "Entity": null }, { "Name": "EnforcedEdgeSecurityPolicyConfiguredAction", "Description": "The configured action that was evaluated in the edge security policy", "Type": "String", "Entity": null }, { "Name": "EnforcedEdgeSecurityPolicyName", "Description": "The name of the edge security policy that was applied to the request", "Type": "String", "Entity": null }, { "Name": "EnforcedEdgeSecurityPolicyOutcome", "Description": "The outcome of applying the policy", "Type": "String", "Entity": null }, { "Name": "EnforcedEdgeSecurityPolicyPriority", "Description": "The priority value of the rule within the edge security policy that matched the request", "Type": "String", "Entity": null }, { "Name": "OverrideResponseCode", "Description": "Holds the override response code applied to the response sent to the client", "Type": "String", "Entity": null }, { "Name": "ErrorService", "Description": "Holds the backend service that provided the custom error response", "Type": "String", "Entity": null }, { "Name": "ErrorBackendStatusDetails", "Description": "Backend-specific error details when a request fails or is served with an error response", "Type": "String", "Entity": null }, { "Name": "AuthzPolicyInfoPolicies", "Description": "The list of Authorization policies that match the request", "Type": "String", "Entity": null }, { "Name": "AuthzPolicyInfoResult", "Description": "Stores information about the Authorization Policy result", "Type": "String", "Entity": null }, { "Name": "LoadBalancingScheme", "Description": "Holds a string that describes which load balancing scheme was used to route the request", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsBackendServiceName", "Description": "The name of the backend service", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsForwardingRuleName", "Description": "The name of the forwarding rule object", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsTargetProxyName", "Description": "The name of the target proxy object referenced by the forwarding rule", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsUrlMapName", "Description": "The name of the URL map object configured to select a backend service", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsZone", "Description": "The zone in which the load balancer is running", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPCloudRun", "TableSource": "sentinel", "Description": "The GCP Cloud Run data connector provides the capability to ingest Cloud Run request logs into Microsoft Sentinel using Pub/Sub. Refer the [Cloud Run Overview](https://cloud.google.com/run/docs/logging) for more details.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "InsertId", "Description": "Unique identifier for the log entry.", "Type": "String", "Entity": null }, { "Name": "JsonPayloadMessage", "Description": "The message field extracted from the jsonPayload.", "Type": "String", "Entity": null }, { "Name": "JsonPayloadRequest", "Description": "The request field extracted from the jsonPayload.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Generic labels associated with the log entry.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The name of the log from which the entry originated.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The timestamp when the log entry was received by Log Analytics.", "Type": "DateTime", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log entry was originally generated in GCP.", "Type": "DateTime", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "PayloadType", "Description": "The type of payload contained within the log entry.", "Type": "String", "Entity": null }, { "Name": "PayloadAuthInfoPrincipalEmail", "Description": "The email address of the principal (user or service account) that initiated the action.", "Type": "String", "Entity": null }, { "Name": "PayloadAuthorizationInfo", "Description": "Detailed authorization information for the logged action, represented as a Dynamic (JSON) object.", "Type": "Object", "Entity": null }, { "Name": "PayloadMethodName", "Description": "The name of the API method that was invoked.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestType", "Description": "The type of request made to the Cloud Run service.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestName", "Description": "The name of the specific request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestRegion", "Description": "The GCP region where the request originated or was processed.", "Type": "String", "Entity": null }, { "Name": "PayloadrequestMetadatacallerSuppliedUserAgent", "Description": "The user agent String provided by the caller.", "Type": "String", "Entity": null }, { "Name": "PayloadrequestMetadataDestinationAttributes", "Description": "Attributes related to the destination of the request.", "Type": "String", "Entity": null }, { "Name": "PayloadrequestMetadatarequestAttributesAuth", "Description": "Authentication attributes embedded within the request.", "Type": "String", "Entity": null }, { "Name": "PayloadrequestMetadatarequestAttributesTime", "Description": "The timestamp associated with the request attributes.", "Type": "DateTime", "Entity": null }, { "Name": "PayloadResourceLocationCurrentLocations", "Description": "Current location(s) of the resource involved in the log entry.", "Type": "String", "Entity": null }, { "Name": "PayloadResourceName", "Description": "The name of the GCP resource relevant to the log entry.", "Type": "String", "Entity": null }, { "Name": "PayloadServiceName", "Description": "The name of the GCP service involved in the log entry.", "Type": "String", "Entity": null }, { "Name": "PayloadAuthenticationInfoPrincipalSubject", "Description": "The subject identifier of the authenticated principal.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestLabelSelector", "Description": "The label selector used in the request, typically for filtering resources.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestParent", "Description": "The parent resource of the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceApiVersion", "Description": "The API version of the Cloud Run service in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceKind", "Description": "The 'kind' of the Cloud Run service (e.g., 'Service').", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceSpec", "Description": "The specification details of the Cloud Run service in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadAuthenticationInfoServiceAccountKeyName", "Description": "The name of the service account key used for authentication.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseType", "Description": "The type of response received from the Cloud Run service.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseApiVersion", "Description": "The API version of the response from the Cloud Run service.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseKind", "Description": "The 'kind' of resource returned in the response (e.g., 'Service').", "Type": "String", "Entity": null }, { "Name": "PayloadResponseSpec", "Description": "The specification details of the resource in the response.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseMetadataName", "Description": "The name of the resource within the response metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseNameSpace", "Description": "The namespace of the resource within the response.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseMetadataAnnotations", "Description": "Annotations associated with the response metadata, typically key-value pairs.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseStatus", "Description": "The status of the operation or resource in the response.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseMetadataSelfLink", "Description": "The self-link URL for the resource in the response metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseMetadataCreationTimestamp", "Description": "The timestamp when the resource in the response metadata was created.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseMetadataUID", "Description": "The unique identifier (UID) of the resource in the response metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseMetadataGeneration", "Description": "The generation number of the resource in the response metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseMetadataResourceVersion", "Description": "The resource version of the resource in the response metadata, indicating its state.", "Type": "String", "Entity": null }, { "Name": "PayloadResponseServiceMetadatalabels", "Description": "Labels from the service metadata within the response.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestOptionsRequestedPolicyVersion", "Description": "The requested policy version within the request options.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestResource", "Description": "The resource specified in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestJobApiVersion", "Description": "The API version of the Cloud Run job in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestJobKind", "Description": "The 'kind' of the Cloud Run job (e.g., 'Job').", "Type": "String", "Entity": null }, { "Name": "PayloadRequestJobSpec", "Description": "The specification details of the Cloud Run job in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestJobMetadataName", "Description": "The name of the Cloud Run job within the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestJobMetadataNameSpace", "Description": "The namespace of the Cloud Run job within the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestJobMetadataAnnotations", "Description": "Annotations associated with the Cloud Run job's request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestDomainMappingApiVersion", "Description": "The API version of the Cloud Run domain mapping in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestDomainMappingKind", "Description": "The 'kind' of the Cloud Run domain mapping (e.g., 'DomainMapping').", "Type": "String", "Entity": null }, { "Name": "PayloadRequestDomainMappingSpec", "Description": "The specification details of the Cloud Run domain mapping in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestDomainMappingMetadataName", "Description": "The name of the Cloud Run domain mapping within the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestDomainMappingMetadataNameSpace", "Description": "The namespace of the Cloud Run domain mapping within the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestDomainMappingMetadataAnnotations", "Description": "Annotations associated with the Cloud Run domain mapping's request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestDomainMappingStatus", "Description": "The status of the Cloud Run domain mapping in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataName", "Description": "The name of the Cloud Run service within the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataNameSpace", "Description": "The namespace of the Cloud Run service within the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataResourceVersion", "Description": "The resource version of the Cloud Run service in the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataSelfLink", "Description": "The self-link URL for the Cloud Run service in the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataCreationTimestamp", "Description": "The timestamp when the Cloud Run service in the request metadata was created.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataUID", "Description": "The unique identifier (UID) of the Cloud Run service in the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataGeneration", "Description": "The generation number of the Cloud Run service in the request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadatalabels", "Description": "Labels from the Cloud Run service metadata within the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceMetadataAnnotations", "Description": "Annotations associated with the Cloud Run service's request metadata.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceStatusConditions", "Description": "Conditions indicating the current state of the Cloud Run service in the request status.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceObservedGeneration", "Description": "The observed generation of the Cloud Run service in the request status.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceTraffic", "Description": "Traffic distribution settings for the Cloud Run service in the request status.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceLatestRevision", "Description": "The name of the latest revision for the Cloud Run service in the request status.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceReadyRevision", "Description": "The name of the ready revision for the Cloud Run service in the request status.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestServiceServiceURL", "Description": "The URL of the Cloud Run service in the request status.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestImageUri", "Description": "The URI of the container image used for the Cloud Run service.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestStorageSourceGeneration", "Description": "The generation of the storage source used in the request.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestBuildpackBuildBaseImage", "Description": "The base image used by the buildpack for the build process.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestBuildpackBuildEnableAutomaticUpdates", "Description": "Indicates whether automatic updates are enabled for the buildpack build.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestMetadataRequestAttributesReason", "Description": "The reason specified in the request attributes metadata.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsJobName", "Description": "The name of the associated Cloud Run job.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelslocation", "Description": "The GCP location of the Cloud Run resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsProjectId", "Description": "The GCP project ID where the Cloud Run resource resides.", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "The type of GCP resource (e.g., 'CloudRunService', 'CloudRunJob').", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsConfigurationName", "Description": "The name of the associated Cloud Run configuration.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsRevisionName", "Description": "The name of the associated Cloud Run revision.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsServiceName", "Description": "The name of the associated Cloud Run service.", "Type": "String", "Entity": null }, { "Name": "PayloadrequestMetadataCallerIp", "Description": "The IP address of the client that made the request.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPCloudSQL", "TableSource": "sentinel", "Description": "The GCP Cloud SQL data connector provides the capability to ingest logs into Microsoft Sentinel using the GCP Cloud SQL API. With the broader resource.type=cloudsql_database collection it now covers Cloud SQL admin/management audit logs, data-access audit logs (pgAudit DDL/DML events) and engine/session logs (connect, disconnect and failed-login lines from postgres.log and similar). Refer to [GCP cloud SQL Audit Logs](https://cloud.google.com/sql/docs/mysql/audit-logging) documentation for more information.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "InsertId", "Description": "Unique identifier for the log entry.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "Name of the log where the entry is recorded.", "Type": "String", "Entity": null }, { "Name": "OperationFirst", "Description": "Indicates if this is the first log entry in an operation.", "Type": "Boolean", "Entity": null }, { "Name": "OperationLast", "Description": "Indicates if this is the last log entry in an operation.", "Type": "Boolean", "Entity": null }, { "Name": "OperationId", "Description": "Identifier for a batch of requests; the same identifier is used for all requests in a batch but if requests are non-batched, the identifier is unique per request", "Type": "String", "Entity": null }, { "Name": "OperationProducer", "Description": "The service that produced the operation.", "Type": "String", "Entity": null }, { "Name": "PayloadType", "Description": "Deprecated. Use ProtoPayload column to find this field. Type of the payload in the log entry.", "Type": "String", "Entity": null }, { "Name": "AuthInfoPrincipalEmail", "Description": "The principal email address initiating the request.", "Type": "String", "Entity": null }, { "Name": "AuthInfoPrincipalSubject", "Description": "The subject associated with the principal.", "Type": "String", "Entity": null }, { "Name": "AuthInfoServiceAccountKeyName", "Description": "Deprecated. Use ProtoPayload column to find this field. Name of the service account key used for the request.", "Type": "String", "Entity": null }, { "Name": "MetadataType", "Description": "Deprecated. Use ProtoPayload column to find this field. Type of metadata associated with the log entry.", "Type": "String", "Entity": null }, { "Name": "RequestEnableFinalBackup", "Description": "Deprecated. Use ProtoPayload column to find this field. Indicates if final backup was enabled in the request.", "Type": "Boolean", "Entity": null }, { "Name": "RequestFinalBackupTtlDays", "Description": "Deprecated. Use ProtoPayload column to find this field. Time to live (in days) for the final backup.", "Type": "String", "Entity": null }, { "Name": "RequestName", "Description": "Deprecated. Use ProtoPayload column to find this field. Name field from the request payload.", "Type": "String", "Entity": null }, { "Name": "RequestFilter", "Description": "Deprecated. Use ProtoPayload column to find this field. Filter used in the request to narrow results.", "Type": "String", "Entity": null }, { "Name": "RequestPageSize", "Description": "Deprecated. Use ProtoPayload column to find this field. Page size specified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestParent", "Description": "Deprecated. Use ProtoPayload column to find this field. The parent resource under which the request is made.", "Type": "String", "Entity": null }, { "Name": "RequestInstance", "Description": "Deprecated. Use ProtoPayload column to find this field. Instance identifier from the request.", "Type": "String", "Entity": null }, { "Name": "RequestMaxResults", "Description": "Deprecated. Use ProtoPayload column to find this field. Maximum number of results requested.", "Type": "String", "Entity": null }, { "Name": "RequestResourceId", "Description": "Deprecated. Use ProtoPayload column to find this field. ID of the resource being requested.", "Type": "String", "Entity": null }, { "Name": "RequestStartTime", "Description": "Deprecated. Use ProtoPayload column to find this field. Start time specified in the request.", "Type": "DateTime", "Entity": null }, { "Name": "RequestOperation", "Description": "Deprecated. Use ProtoPayload column to find this field. The operation type included in the request.", "Type": "String", "Entity": null }, { "Name": "RequestSha1Fingerprint", "Description": "Deprecated. Use ProtoPayload column to find this field. SHA-1 fingerprint associated with the certificate.", "Type": "String", "Entity": null }, { "Name": "RequestBodyCommonName", "Description": "Deprecated. Use ProtoPayload column to find this field. Common name used for certificates.", "Type": "String", "Entity": null }, { "Name": "RequestBodyKind", "Description": "Deprecated. Use ProtoPayload column to find this field. The kind field in the request body.", "Type": "String", "Entity": null }, { "Name": "RequestBodyDescription", "Description": "Deprecated. Use ProtoPayload column to find this field. Description of the instance or operation.", "Type": "String", "Entity": null }, { "Name": "RequestBodyLocation", "Description": "Deprecated. Use ProtoPayload column to find this field. Location setting in the request body.", "Type": "String", "Entity": null }, { "Name": "RequestBodyCloneContextDestinationInstanceName", "Description": "Deprecated. Use ProtoPayload column to find this field. Destination instance name in clone context.", "Type": "String", "Entity": null }, { "Name": "RequestBodyFailoverContext", "Description": "Deprecated. Use ProtoPayload column to find this field. Context for failover configuration.", "Type": "Object", "Entity": null }, { "Name": "RequestBodyBackup", "Description": "Deprecated. Use ProtoPayload column to find this field. Backup configuration in the request body.", "Type": "String", "Entity": null }, { "Name": "RequestBodyNodeCount", "Description": "Deprecated. Use ProtoPayload column to find this field. Number of nodes configured in the request.", "Type": "String", "Entity": null }, { "Name": "RequestBodyRotateServerCaContext", "Description": "Deprecated. Use ProtoPayload column to find this field. Server CA rotation configuration context.", "Type": "Object", "Entity": null }, { "Name": "RequestBodyRestoreInstanceSettingsInstanceUid", "Description": "Deprecated. Use ProtoPayload column to find this field. UID of the instance in restore settings.", "Type": "String", "Entity": null }, { "Name": "RequestBodyRestoreInstanceSettingsName", "Description": "Deprecated. Use ProtoPayload column to find this field. Instance name in restore settings.", "Type": "String", "Entity": null }, { "Name": "RequestBodyRestoreInstanceSettingsProject", "Description": "Deprecated. Use ProtoPayload column to find this field. Project ID in restore settings.", "Type": "String", "Entity": null }, { "Name": "RequestBodyRestoreInstanceSettingsRegion", "Description": "Deprecated. Use ProtoPayload column to find this field. Region in restore settings.", "Type": "String", "Entity": null }, { "Name": "RequestBodyInstance", "Description": "Deprecated. Use ProtoPayload column to find this field. Instance details in the request body.", "Type": "String", "Entity": null }, { "Name": "RequestDatabase", "Description": "Database name specified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestBodyExportContext", "Description": "Deprecated. Use ProtoPayload column to find this field. Export context details.", "Type": "Object", "Entity": null }, { "Name": "RequestBodySettingsActivationPolicy", "Description": "Deprecated. Use ProtoPayload column to find this field. Activation policy for the instance.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsActiveDirectoryConfig", "Description": "Deprecated. Use ProtoPayload column to find this field. Active Directory configuration settings.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsAvailabilityType", "Description": "Deprecated. Use ProtoPayload column to find this field. Availability type setting.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsRetentinedBackup", "Description": "Deprecated. Use ProtoPayload column to find this field. Retention policy for backups.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsRetentionUnit", "Description": "Deprecated. Use ProtoPayload column to find this field. Unit of retention for backups.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsBackupEnabled", "Description": "Deprecated. Use ProtoPayload column to find this field. Indicates if backups are enabled.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodyProject", "Description": "Deprecated. Use ProtoPayload column to find this field. Project ID in the request body.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsBackupPointInTimeRecoveryEnabled", "Description": "Deprecated. Use ProtoPayload column to find this field. Flag for point-in-time recovery.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsBackupLocation", "Description": "Deprecated. Use ProtoPayload column to find this field. Location for backups.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsBinaryLogEnabled", "Description": "Deprecated. Use ProtoPayload column to find this field. Indicates if binary logging is enabled.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodySettingsBackupStartTime", "Description": "Deprecated. Use ProtoPayload column to find this field. Scheduled start time for backups.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsTransactionLogRetentionDays", "Description": "Deprecated. Use ProtoPayload column to find this field. Retention period for transaction logs.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsConnectionPoolConfig", "Description": "Deprecated. Use ProtoPayload column to find this field. Connection pool configuration.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsdataCacheConfigDataCacheEnabled", "Description": "Deprecated. Use ProtoPayload column to find this field. Flag for enabling data cache.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodySettingsDataDiskSizeGb", "Description": "Deprecated. Use ProtoPayload column to find this field. Size of the data disk in GB.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsDataDiskType", "Description": "Deprecated. Use ProtoPayload column to find this field. Type of data disk used.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsDeletionProtectionEnabled", "Description": "Deprecated. Use ProtoPayload column to find this field. Indicates if deletion protection is enabled.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodySettingsEdition", "Description": "Deprecated. Use ProtoPayload column to find this field. Edition of the Cloud SQL instance.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsEnableGoogleMlIntegration", "Description": "Deprecated. Use ProtoPayload column to find this field. Flag to enable Google ML integration.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodySettingsInsightsConfig", "Description": "Deprecated. Use ProtoPayload column to find this field. Insights configuration settings.", "Type": "Object", "Entity": null }, { "Name": "RequestBodySettingsIPConfiguration", "Description": "Deprecated. Use ProtoPayload column to find this field. IP configuration settings.", "Type": "Object", "Entity": null }, { "Name": "RequestBodySettingsLocationPreference", "Description": "Deprecated. Use ProtoPayload column to find this field. Location preference for the instance.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsMaintenanceWindow", "Description": "Deprecated. Use ProtoPayload column to find this field. Maintenance window configuration.", "Type": "Object", "Entity": null }, { "Name": "RequestBodySettingsRetainBackupsOnDelete", "Description": "Deprecated. Use ProtoPayload column to find this field. Flag to retain backups after deletion.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodySettingsVersion", "Description": "Deprecated. Use ProtoPayload column to find this field. Version information flag.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodySettingsSqlServerAuditConfigRetentionInterval", "Description": "Deprecated. Use ProtoPayload column to find this field. Audit retention interval for SQL Server.", "Type": "DateTime", "Entity": null }, { "Name": "RequestBodySettingsSqlServerAuditConfigUploadInterval", "Description": "Deprecated. Use ProtoPayload column to find this field. Audit upload interval for SQL Server.", "Type": "DateTime", "Entity": null }, { "Name": "RequestBodySettingsStorageAutoResize", "Description": "Deprecated. Use ProtoPayload column to find this field. Indicates if storage auto-resize is enabled.", "Type": "Boolean", "Entity": null }, { "Name": "RequestBodySettingsTier", "Description": "Deprecated. Use ProtoPayload column to find this field. Service tier of the instance.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsTmeZone", "Description": "Deprecated. Use ProtoPayload column to find this field. Time zone settings for the instance.", "Type": "String", "Entity": null }, { "Name": "RequestBodySettingsUserbackuplable", "Description": "Deprecated. Use ProtoPayload column to find this field. User backup label setting.", "Type": "String", "Entity": null }, { "Name": "RequestProject", "Description": "Deprecated. Use ProtoPayload column to find this field. Project associated with the request.", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerIP", "Description": "IP address of the caller.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesDestinationAttributes", "Description": "Deprecated. Use ProtoPayload column to find this field. Destination attributes for the request.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesAuth", "Description": "Deprecated. Use ProtoPayload column to find this field. Authentication attributes of the request.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesRequestReason", "Description": "Deprecated. Use ProtoPayload column to find this field. Reason for the request.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesRequestTime", "Description": "Deprecated. Use ProtoPayload column to find this field. Timestamp when the request was made.", "Type": "DateTime", "Entity": null }, { "Name": "GCPResourceName", "Description": "Full resource name of the Cloud SQL instance.", "Type": "String", "Entity": null }, { "Name": "ResponseType", "Description": "Deprecated. Use ProtoPayload column to find this field. Type of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseClientCert", "Description": "Deprecated. Use ProtoPayload column to find this field. Client certificate in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseEphemeralCertKind", "Description": "Deprecated. Use ProtoPayload column to find this field. Kind of ephemeral certificate in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseBackupContextBackupId", "Description": "Deprecated. Use ProtoPayload column to find this field. Backup ID from the response's backup context.", "Type": "String", "Entity": null }, { "Name": "ResponseBackupContextKind", "Description": "Deprecated. Use ProtoPayload column to find this field. Kind of backup context returned.", "Type": "String", "Entity": null }, { "Name": "ResponseBackupContextName", "Description": "Deprecated. Use ProtoPayload column to find this field. Name in the backup context of the response.", "Type": "String", "Entity": null }, { "Name": "OperationInsertTime", "Description": "Deprecated. Use ProtoPayload column to find this field. Timestamp when the operation was inserted.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseInstanceUid", "Description": "Deprecated. Use ProtoPayload column to find this field. Instance UID returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseKind", "Description": "Deprecated. Use ProtoPayload column to find this field. Kind field of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseName", "Description": "Deprecated. Use ProtoPayload column to find this field. Name included in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseOperationType", "Description": "Deprecated. Use ProtoPayload column to find this field. Operation type in the response.", "Type": "String", "Entity": null }, { "Name": "ResponsePromoteContextPrimary", "Description": "Deprecated. Use ProtoPayload column to find this field. Primary instance in the promote context.", "Type": "String", "Entity": null }, { "Name": "ResponsePromoteContextReplica", "Description": "Deprecated. Use ProtoPayload column to find this field. Replica instance in the promote context.", "Type": "String", "Entity": null }, { "Name": "ResponseSelfLink", "Description": "Deprecated. Use ProtoPayload column to find this field. Self-link URL of the response resource.", "Type": "String", "Entity": null }, { "Name": "ResponseStatus", "Description": "Deprecated. Use ProtoPayload column to find this field. Status of the response operation.", "Type": "String", "Entity": null }, { "Name": "ResponseTargetId", "Description": "Deprecated. Use ProtoPayload column to find this field. Target ID in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseTargetLink", "Description": "Deprecated. Use ProtoPayload column to find this field. Target link URL in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseTargetProject", "Description": "Deprecated. Use ProtoPayload column to find this field. Project associated with the response target.", "Type": "String", "Entity": null }, { "Name": "ResponseUser", "Description": "Deprecated. Use ProtoPayload column to find this field. User information from the response.", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "Name of the GCP service handling the request.", "Type": "String", "Entity": null }, { "Name": "StatusCode", "Description": "Status code returned by the operation.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "Timestamp when the log was received.", "Type": "DateTime", "Entity": null }, { "Name": "ResourceLabelsDatabaseId", "Description": "Database identifier from resource labels.", "Type": "String", "Entity": null }, { "Name": "StatusMessage", "Description": "Message describing the status of the operation.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsProjectId", "Description": "Project ID from resource labels.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsRegion", "Description": "Region from resource labels.", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "Type of the resource.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "TimeGenerated", "Description": "Time when the log entry was generated.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseServerCaCert", "Description": "Deprecated. Use ProtoPayload column to find this field. PEM-encoded CA certificate from the server used for TLS validation", "Type": "String", "Entity": null }, { "Name": "ResponseOperation", "Description": "Deprecated. Use ProtoPayload column to find this field. Indicates the type of operation performed in the response.", "Type": "String", "Entity": null }, { "Name": "RequestEndTime", "Description": "Deprecated. Use ProtoPayload column to find this field. Timestamp marking when the request processing completed", "Type": "DateTime", "Entity": null }, { "Name": "MethodName", "Description": "The name of the service method or operation invoked (e.g. cloudsql.instances.query).", "Type": "String", "Entity": null }, { "Name": "ProtoPayload", "Description": "Full protoPayload object; parse any audit field from here.", "Type": "Object", "Entity": null }, { "Name": "TextPayload", "Description": "Raw engine/session log line (postgres.log etc). Not parsed.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Top-level LogEntry labels e.g. INSTANCE_UID, SOURCE_ID.", "Type": "Object", "Entity": null }, { "Name": "JsonPayload", "Description": "Structured engine log payload when present.", "Type": "Object", "Entity": null }, { "Name": "RequestUser", "Description": "Database user that executed the statement (pgAudit request.user).", "Type": "String", "Entity": null }, { "Name": "RequestCommand", "Description": "SQL command executed, e.g. CREATE INDEX or INSERT (pgAudit request.command).", "Type": "String", "Entity": null }, { "Name": "RequestStatement", "Description": "Full SQL statement text (pgAudit request.statement).", "Type": "String", "Entity": null }, { "Name": "RequestAuditClass", "Description": "pgAudit audit class, e.g. DDL, WRITE or READ (pgAudit request.auditClass).", "Type": "String", "Entity": null }, { "Name": "RequestAuditType", "Description": "pgAudit audit type, e.g. SESSION or OBJECT (pgAudit request.auditType).", "Type": "String", "Entity": null }, { "Name": "RequestDatabaseSessionId", "Description": "Database session identifier for the pgAudit event (pgAudit request.databaseSessionId).", "Type": "String", "Entity": null }, { "Name": "RequestStatementId", "Description": "Statement identifier within the database session (pgAudit request.statementId).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPComputeEngine", "TableSource": "sentinel", "Description": "The Google Cloud Platform Compute Engine data connector provides the capability to ingest Compute Engine Audit logs into Microsoft Sentinel using the Google Cloud Compute Engine API. Refer to [Cloud Compute Engine API](https://cloud.google.com/compute/docs/reference/rest/v1) documentation for more information.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry used to prevent duplication.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "A set of key-value pairs that provide additional metadata about the log entry.", "Type": "Object", "Entity": null }, { "Name": "LogName", "Description": "The full resource name of the log to which this log entry belongs.", "Type": "String", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "Object", "Entity": null }, { "Name": "ProtoPayload", "Description": "The structured payload of the log entry, typically in protocol buffer format; contains detailed event data.", "Type": "Object", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The time the log entry was received by the logging system.", "Type": "DateTime", "Entity": null }, { "Name": "GCPResource", "Description": "Information about the monitored resource associated with the log entry, such as VM instance, database, etc.", "Type": "Object", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The actual time the event described by the log entry occurred.", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPDNS", "TableSource": "sentinel", "Description": "The Google Cloud Platform DNS data connector provides the capability to ingest Cloud DNS Query logs and Cloud DNS Audit logs into Microsoft Sentinel using the Google Cloud DNS API.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier assigned to each log entry.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The name of the log where this entry is stored.", "Type": "String", "Entity": null }, { "Name": "PayloadType", "Description": "The format or type of the payload in the log entry.", "Type": "String", "Entity": null }, { "Name": "AuthenticationInfoPrincipalEmail", "Description": "Email address of the user or service account performing the action.", "Type": "String", "Entity": null }, { "Name": "AuthenticationInfoPrincipalSubject", "Description": "The subject identifier for the principal (user or service account).", "Type": "String", "Entity": null }, { "Name": "AuthorizationInfo", "Description": "Details about the authorization decision for the request.", "Type": "String", "Entity": null }, { "Name": "MethodName", "Description": "The API method or operation invoked in the request.", "Type": "String", "Entity": null }, { "Name": "RequestAPIType", "Description": "The type of API request being logged.", "Type": "String", "Entity": null }, { "Name": "RequestChangeAdditions", "Description": "Details of resource additions in the request.", "Type": "String", "Entity": null }, { "Name": "RequestChangeDeletions", "Description": "Details of resource deletions in the request.", "Type": "String", "Entity": null }, { "Name": "RequestManagedZoneDescription", "Description": "Description of the managed DNS zone in the request.", "Type": "String", "Entity": null }, { "Name": "RequestManagedZoneDnsName", "Description": "The DNS name of the managed zone in the request.", "Type": "String", "Entity": null }, { "Name": "RequestManagedZoneName", "Description": "The name of the managed DNS zone in the request.", "Type": "String", "Entity": null }, { "Name": "RequestManagedZone", "Description": "Details of the managed DNS zone in the request.", "Type": "String", "Entity": null }, { "Name": "RequestManagedZoneVisibility", "Description": "The visibility (public or private) of the managed zone in the request.", "Type": "String", "Entity": null }, { "Name": "ReqManZonePrivVisibConfigNetworks", "Description": "List of networks configured for private visibility of the managed zone.", "Type": "String", "Entity": null }, { "Name": "RequestName", "Description": "Name of the resource affected by the request.", "Type": "String", "Entity": null }, { "Name": "RequestProject", "Description": "Google Cloud project associated with the request.", "Type": "String", "Entity": null }, { "Name": "RequestType", "Description": "Type of the request (e.g., Create, Delete, Update).", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerIp", "Description": "IP address of the caller initiating the request.", "Type": "String", "Entity": null }, { "Name": "ReqmetaCallerSuppliedUserAgent", "Description": "User agent String provided by the caller.", "Type": "String", "Entity": null }, { "Name": "ReqmetaRequestAttributesTime", "Description": "Timestamp when the request was initiated.", "Type": "DateTime", "Entity": null }, { "Name": "GCPResourceName", "Description": "Name of the resource being accessed or modified.", "Type": "String", "Entity": null }, { "Name": "ResponseType", "Description": "Type of response returned from the API.", "Type": "String", "Entity": null }, { "Name": "ResponseChangeDeletions", "Description": "Details of deletions in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseChangeId", "Description": "Identifier for the change request in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseChangeStartTime", "Description": "Timestamp indicating when the change operation started.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseChangeStatus", "Description": "Status of the change operation in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneCreationTime", "Description": "Timestamp when the managed zone was created.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseManagedZoneDescription", "Description": "Description of the managed zone returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneDnsName", "Description": "DNS name of the managed zone returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneFingerprint", "Description": "Fingerprint for detecting changes in the managed zone.", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneId", "Description": "Unique identifier for the managed zone.", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneName", "Description": "Name of the managed zone returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneNameServers", "Description": "List of name servers associated with the managed zone.", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneVisibility", "Description": "Visibility setting (public/private) of the managed zone.", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "Name of the Google Cloud service processing the request.", "Type": "String", "Entity": null }, { "Name": "StatusCode", "Description": "HTTP status code returned for the request.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsLocation", "Description": "Location of the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsProjectId", "Description": "Google Cloud project ID associated with the resource.", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "Type of the resource (e.g., compute instance, DNS record).", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "VmProjectId", "Description": "Google Cloud project ID of the network from which the query was sent.", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "QueryType", "Description": "Type of the query", "Type": "String", "Entity": null }, { "Name": "Rdata", "Description": "DNS answer in presentation format.", "Type": "String", "Entity": null }, { "Name": "VmInstanceId", "Description": "Compute Engine VM instance ID.", "Type": "String", "Entity": null }, { "Name": "VmInstanceName", "Description": "Compute Engine VM instance name.", "Type": "String", "Entity": null }, { "Name": "ResponseCode", "Description": "Response code for the operation.", "Type": "String", "Entity": null }, { "Name": "AuthAnswer", "Description": "Indicates if the DNS response is authoritative.", "Type": "Boolean", "Entity": null }, { "Name": "QueryName", "Description": "The domain name queried.", "Type": "String", "Entity": null }, { "Name": "VmZoneName", "Description": "Name of the VM zone from which the query originated.", "Type": "String", "Entity": null }, { "Name": "SourceIP", "Description": "IP address from which the query originated.", "Type": "String", "Entity": null }, { "Name": "DestinationIP", "Description": "Target IP address of the request.", "Type": "String", "Entity": null }, { "Name": "ReqManZoneCloudLogConfigEnableLogging", "Description": "Indicates whether logging was enabled in the request for the managed zone.", "Type": "Boolean", "Entity": null }, { "Name": "ResManZoneCloudLogConfigEnableLogging", "Description": "Indicates whether logging was enabled in the response for the managed zone.", "Type": "Boolean", "Entity": null }, { "Name": "ResourceLabelsPolicyName", "Description": "Represents the policy name associated with the DNS resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsSourceType", "Description": "Specifies the source type of the resource being modified", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsTargetName", "Description": "The target resource name within Google Cloud DNS, such as the managed zone or DNS policy being modified.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsTargetType", "Description": "The type of DNS resource being acted upon", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsZoneName", "Description": "The name of the managed DNS zone related to the operation.", "Type": "String", "Entity": null }, { "Name": "RespManZonePrivVisibConfigNetworks", "Description": "Lists networks associated with a private managed zone under private visibility configuration.", "Type": "String", "Entity": null }, { "Name": "ResponseChangeAdditions", "Description": "Represents additions made to DNS records (e.g., new A, AAAA, CNAME, or TXT records).", "Type": "String", "Entity": null }, { "Name": "ResponseManagedZoneRrsetCount", "Description": "The total number of resource record sets (RRsets) within a managed zone.", "Type": "String", "Entity": null }, { "Name": "ResponseOpZoneContextNewValue", "Description": "The new value after an operation modifies a DNS managed zone.", "Type": "String", "Entity": null }, { "Name": "ResponseOpZoneContextOldValue", "Description": "The previous value before an operation modified the DNS managed zone.", "Type": "String", "Entity": null }, { "Name": "ResponseOperationId", "Description": "A unique identifier for the DNS operation performed.", "Type": "String", "Entity": null }, { "Name": "ResponseOperationStartTime", "Description": "The timestamp when the DNS operation started.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseOperationStatus", "Description": "The status of the DNS operation", "Type": "String", "Entity": null }, { "Name": "ResponseOperationType", "Description": "The type of DNS operation executed (e.g., create, update, delete).", "Type": "String", "Entity": null }, { "Name": "ResponseOperationUser", "Description": "The user or service account that performed the DNS operation.", "Type": "String", "Entity": null }, { "Name": "ServerLatency", "Description": "Measures the latency of the request to Google Cloud DNS.", "Type": "String", "Entity": null }, { "Name": "SourceNetwork", "Description": "The originating network of the DNS request.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log entry was created.", "Type": "DateTime", "Entity": null }, { "Name": "VmInstanceIdString", "Description": "The VM instance ID (if applicable) associated with the request.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPFirewallLogs", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) firewall logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the log entry was received by logging.", "Type": "DateTime", "Entity": null }, { "Name": "VpcSubnetworkName", "Description": "The Subnetnetwork name of the Virtual Private Network(VPC) where the firewall rule applied.", "Type": "String", "Entity": null }, { "Name": "VpcName", "Description": "The name of the Virtual Private Network(VPC) where the firewall rule applied.", "Type": "String", "Entity": null }, { "Name": "VpcProjectId", "Description": "The project id of the Virtual Private Network(VPC) where the firewall rule applied.", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "Direction", "Description": "The direction of that the firewall rule applies.", "Type": "String", "Entity": null }, { "Name": "IpPortInfo", "Description": "The information regarding the rule port and protocol.", "Type": "Object", "Entity": null }, { "Name": "Priority", "Description": "The priority of the rule.", "Type": "String", "Entity": null }, { "Name": "Referance", "Description": "The rule that triggered the log.", "Type": "String", "Entity": null }, { "Name": "SourceRange", "Description": "The range of the ip addresses that the rule applied to.", "Type": "Object", "Entity": null }, { "Name": "RemoteLocationCity", "Description": "The city name based on the resource location.", "Type": "String", "Entity": null }, { "Name": "RemoteLocationContinent", "Description": "The continent name based on the resource location.", "Type": "String", "Entity": null }, { "Name": "RemoteLocationCountry", "Description": "The country name based on the resource location.", "Type": "String", "Entity": null }, { "Name": "RemoteLocationRegion", "Description": "The region name based on the resource location.", "Type": "String", "Entity": null }, { "Name": "InstanceProjectId", "Description": "the project ID associated with the instance that was involved in the firewall rule event.", "Type": "String", "Entity": null }, { "Name": "InstanceRegion", "Description": "the region associated with the instance that was involved in the firewall rule event.", "Type": "String", "Entity": null }, { "Name": "InstanceVmName", "Description": "the virtual machine name associated with the instance that was involved in the firewall rule event.", "Type": "String", "Entity": null }, { "Name": "InstanceZone", "Description": "the zone associated with the instance that was involved in the firewall rule event.", "Type": "String", "Entity": null }, { "Name": "Disposition", "Description": "the final action taken on network traffic that matches a given rule.", "Type": "String", "Entity": null }, { "Name": "DestIp", "Description": "the IP address of the target device or service that incoming or outgoing network traffic is trying to reach.", "Type": "String", "Entity": null }, { "Name": "DestPort", "Description": "the Port of the target device or service that incoming or outgoing network traffic is trying to reach.", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "SrcIp", "Description": "the IP address of the source device or service that incoming or outgoing network traffic is trying to reach.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "the Port of the source device or service that incoming or outgoing network traffic is trying to reach.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made.", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "ProjectId", "Description": "The identifier of the Google Cloud Platform (GCP) project associated with this resource, such as \"my-project\".", "Type": "String", "Entity": null }, { "Name": "ResourceLocation", "Description": "The resource location information.", "Type": "String", "Entity": null }, { "Name": "SubnetworkId", "Description": "The resource subnetwork id.", "Type": "String", "Entity": null }, { "Name": "ResourceSubnetworkName", "Description": "The resource subnetwork name.", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "The identifier of the type associated with this resource, such as 'pubsub_subscription'.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPIAM", "TableSource": "sentinel", "Description": "The Google Cloud Platform IAM audit logs, ingested from Sentinel's connector, eAudit logs relating to Identity and Access Management (IAM) activities within Google Cloud.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp representing the time at which the log entry was generated.", "Type": "DateTime", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "Timestamp representing the time when the log entry was received by the system.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry, typically used for deduplication.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The name of the log in which the entry resides.", "Type": "String", "Entity": null }, { "Name": "AuthInfoPrincipalEmail", "Description": "The email address associated with the principal (e.g., user, service account) performing the action.", "Type": "String", "Entity": null }, { "Name": "AuthInfoPrincipalSubject", "Description": "The subject or identifier associated with the principal performing the action.", "Type": "String", "Entity": null }, { "Name": "MethodName", "Description": "The name of the method being invoked.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsProjectId", "Description": "Project ID for the resource being accessed or logged.", "Type": "String", "Entity": null }, { "Name": "PayloadType", "Description": "The type of payload being processed or transmitted.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerIp", "Description": "The IP address from which the request originated.", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "The name of the service that generated the log entry.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerSuppliedUserAgent", "Description": "The user-agent String provided by the caller during the request.", "Type": "String", "Entity": null }, { "Name": "AuthorizationInfo", "Description": "Information related to the authorization of the request.", "Type": "String", "Entity": null }, { "Name": "GCPResourceName", "Description": "The name of the resource involved in the request or logged event.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsMethod", "Description": "The method associated with the resource, often used for filtering or categorization.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsVersion", "Description": "The version of the resource being logged.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsService", "Description": "The service to which the resource belongs.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsLocation", "Description": "The geographical or logical location of the resource.", "Type": "String", "Entity": null }, { "Name": "RequestFullResourceName", "Description": "Full name of the resource requested.", "Type": "String", "Entity": null }, { "Name": "RequestPageSize", "Description": "The size of the page requested in a paginated request.", "Type": "String", "Entity": null }, { "Name": "RequestSkipVisibilityCheck", "Description": "Boolean indicating whether the visibility check for the request should be skipped.", "Type": "Boolean", "Entity": null }, { "Name": "AuthInfoServiceAccountDelegationInfo", "Description": "Delegation information for a service account.", "Type": "String", "Entity": null }, { "Name": "OperationId", "Description": "Identifier for a batch of requests; the same identifier is used for all requests in a batch but if requests are non-batched, the identifier is unique per request", "Type": "String", "Entity": null }, { "Name": "OperationProducer", "Description": "The producer (system or service) that initiated the operation.", "Type": "String", "Entity": null }, { "Name": "OperationFirst", "Description": "Boolean indicating whether this is the first operation in a sequence.", "Type": "Boolean", "Entity": null }, { "Name": "OperationLast", "Description": "Boolean indicating whether this is the last operation in a sequence.", "Type": "Boolean", "Entity": null }, { "Name": "ResourceLabelsUniqueId", "Description": "A unique identifier for the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsEmailId", "Description": "Email identifier associated with the resource.", "Type": "String", "Entity": null }, { "Name": "MetadataIdentityDelegationChain", "Description": "A chain of delegated identities for the request.", "Type": "String", "Entity": null }, { "Name": "RequestType", "Description": "The type of request being made.", "Type": "String", "Entity": null }, { "Name": "RequestName", "Description": "The name of the request.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesTime", "Description": "Time-related attributes of the request metadata.", "Type": "String", "Entity": null }, { "Name": "RequestPolicyEtag", "Description": "The ETag value for the request policy.", "Type": "String", "Entity": null }, { "Name": "RequestPolicyAuditConfigs", "Description": "Configuration for auditing in the request policy.", "Type": "String", "Entity": null }, { "Name": "RequestPolicyBindings", "Description": "Binding configurations associated with the request policy.", "Type": "String", "Entity": null }, { "Name": "RequestResource", "Description": "The resource being requested.", "Type": "String", "Entity": null }, { "Name": "ResponseAuditConfigs", "Description": "Audit configurations in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseBindings", "Description": "The bindings used in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseEtag", "Description": "The ETag value for the response.", "Type": "String", "Entity": null }, { "Name": "ServiceDataPolicyDeltaBindingDeltas", "Description": "Changes to policy bindings in the response.", "Type": "String", "Entity": null }, { "Name": "NumResponseItems", "Description": "The number of items returned in the response.", "Type": "String", "Entity": null }, { "Name": "RequestParent", "Description": "The parent resource of the request.", "Type": "String", "Entity": null }, { "Name": "RequestShowDeleted", "Description": "Boolean indicating if deleted items should be included in the response.", "Type": "Boolean", "Entity": null }, { "Name": "RequestRemoveDeletedServiceAccounts", "Description": "Boolean indicating if deleted service accounts should be removed.", "Type": "Boolean", "Entity": null }, { "Name": "RequestIncludeInactiveApiRoles", "Description": "Boolean indicating whether inactive API roles should be included in the request.", "Type": "Boolean", "Entity": null }, { "Name": "AuthenticationInfoPrincipalSubject", "Description": "Subject associated with the authenticated principal in the request.", "Type": "String", "Entity": null }, { "Name": "ResponseType", "Description": "The type of response being returned.", "Type": "String", "Entity": null }, { "Name": "ServiceDataType", "Description": "The type of service data being logged.", "Type": "String", "Entity": null }, { "Name": "RequestGrantType", "Description": "The grant type associated with the request.", "Type": "String", "Entity": null }, { "Name": "RequestSubjectTokenType", "Description": "The type of subject token being used in the request.", "Type": "String", "Entity": null }, { "Name": "MetadataMappedPrincipal", "Description": "Mapped principal in the metadata.", "Type": "String", "Entity": null }, { "Name": "MetadataType", "Description": "The type of metadata being provided.", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "The type of resource involved in the request.", "Type": "String", "Entity": null }, { "Name": "RequestKeyTypes", "Description": "Types of keys involved in the request.", "Type": "String", "Entity": null }, { "Name": "RequestView", "Description": "The view or perspective for the request.", "Type": "String", "Entity": null }, { "Name": "RequestRequestedTokenType", "Description": "The type of token requested.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "StatusCode", "Description": "The HTTP or operation status code for the response.", "Type": "String", "Entity": null }, { "Name": "StatusMessage", "Description": "The message associated with the status code.", "Type": "String", "Entity": null }, { "Name": "ServiceDataPermissionDeltaRemovedPermissions", "Description": "Permissions that were removed in the service data policy.", "Type": "String", "Entity": null }, { "Name": "RequestUpdateMaskPaths", "Description": "The paths to be updated in the request.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsTopicId", "Description": "The topic ID associated with the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsRoleName", "Description": "The name of the role associated with the resource.", "Type": "String", "Entity": null }, { "Name": "ServiceDataPermissionDeltaAddedPermissions", "Description": "Permissions that were added in the service data policy.", "Type": "String", "Entity": null }, { "Name": "RequestRoleIncludedPermissions", "Description": "Permissions included in the role in the request.", "Type": "String", "Entity": null }, { "Name": "RequestRoleTitle", "Description": "Title of the role being requested.", "Type": "String", "Entity": null }, { "Name": "RequestRoleDescription", "Description": "Description of the role being requested.", "Type": "String", "Entity": null }, { "Name": "RequestRoleId", "Description": "The unique identifier for the role.", "Type": "String", "Entity": null }, { "Name": "ResponseGroupName", "Description": "The group name for the response.", "Type": "String", "Entity": null }, { "Name": "ResponseIncludedPermissions", "Description": "Permissions included in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseTitle", "Description": "Title associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseGroupTitle", "Description": "The title of the group in the response.", "Type": "String", "Entity": null }, { "Name": "RequestAccountId", "Description": "Account ID associated with the request.", "Type": "String", "Entity": null }, { "Name": "RequestServiceAccountDescription", "Description": "Description of the service account being requested.", "Type": "String", "Entity": null }, { "Name": "RequestServiceAccountDisplayName", "Description": "Display name of the service account being requested.", "Type": "String", "Entity": null }, { "Name": "ResponseOauth2ClientId", "Description": "OAuth2 client ID associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseName", "Description": "Name associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseUniqueId", "Description": "Unique identifier for the response.", "Type": "String", "Entity": null }, { "Name": "ResponseDescription", "Description": "Description of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseProjectId", "Description": "Project ID associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseDisplayName", "Description": "Display name associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseEmail", "Description": "Email associated with the response.", "Type": "String", "Entity": null }, { "Name": "RequestPrivateKeyType", "Description": "Type of private key being used in the request.", "Type": "String", "Entity": null }, { "Name": "ResponseValidBeforeTimeSeconds", "Description": "Time in seconds before the response becomes valid.", "Type": "String", "Entity": null }, { "Name": "ResponseValidAfterTimeSeconds", "Description": "Time in seconds after which the response becomes valid.", "Type": "String", "Entity": null }, { "Name": "ResponseKeyType", "Description": "The type of key used in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseKeyOrigin", "Description": "The origin of the key in the response.", "Type": "String", "Entity": null }, { "Name": "ResponsePrivateKeyType", "Description": "The type of private key used in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseKeyAlgorithm", "Description": "The key algorithm used in the response.", "Type": "String", "Entity": null }, { "Name": "RequestOptionsRequestedPolicyVersion", "Description": "The version of the policy requested.", "Type": "String", "Entity": null }, { "Name": "RequestPageToken", "Description": "Token for pagination in the request.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPIDS", "TableSource": "sentinel", "Description": "The Google Cloud Platform IDS data connector provides the capability to ingest Cloud IDS logs into Microsoft Sentinel using the Compute Engine API. This enables the detection and response to potential threats within the Google Cloud environment by monitoring network traffic and identifying suspicious activities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The full log name including resource path.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "Time the log entry was received by Cloud Logging.", "Type": "DateTime", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "DestinationIPAddress", "Description": "IP address of the device running the server application that processed the recorded action", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "String", "Entity": null }, { "Name": "ElapsedTime", "Description": "The elapsed time of the session.", "Type": "String", "Entity": null }, { "Name": "Network", "Description": "The network associated with the IDS endpoint.", "Type": "String", "Entity": null }, { "Name": "RepeatCount", "Description": "The number of sessions with the same source IP, destination IP, application, and type seen within 5 seconds.", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "SourcePort", "Description": "Port where the attacker communication originated from", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "TotalBytes", "Description": "The total number of bytes transferred in the session.", "Type": "String", "Entity": null }, { "Name": "TotalPackets", "Description": "The total number of packets transferred in the session.", "Type": "String", "Entity": null }, { "Name": "AlertSeverity", "Description": "Severity of the threat. One of INFORMATIONAL, LOW, MEDIUM, HIGH, or CRITICAL.", "Type": "String", "Entity": null }, { "Name": "AlertTime", "Description": "Time when the threat was discovered.", "Type": "DateTime", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "CVEs", "Description": "A list of CVEs associated with the threat.", "Type": "String", "Entity": null }, { "Name": "Details", "Description": "Additional information about the type of threat.", "Type": "String", "Entity": null }, { "Name": "Direction", "Description": "Suspected traffic's direction (client-to-server or server-to-client).", "Type": "String", "Entity": null }, { "Name": "JsonPayloadName", "Description": "Threat name.", "Type": "String", "Entity": null }, { "Name": "ThreatId", "Description": "Unique threat identifier.", "Type": "String", "Entity": null }, { "Name": "JsonPayloadType", "Description": "Type of the threat.", "Type": "String", "Entity": null }, { "Name": "URIOrFilename", "Description": "URI or filename of the relevant threat, if applicable.", "Type": "String", "Entity": null }, { "Name": "IPProtocol", "Description": "Suspected traffic's IP protocol.", "Type": "String", "Entity": null }, { "Name": "SourceIPAddress", "Description": "Suspected traffic's source IP address.", "Type": "String", "Entity": null }, { "Name": "OperationId", "Description": "Identifier for a batch of requests; the same identifier is used for all requests in a batch but if requests are non-batched, the identifier is unique per request", "Type": "String", "Entity": null }, { "Name": "OperationFirst", "Description": "Indicates if this is the first log entry in a sequence of operations.", "Type": "Boolean", "Entity": null }, { "Name": "OperationLast", "Description": "Indicates if this is the last log entry in a sequence of operations.", "Type": "Boolean", "Entity": null }, { "Name": "OperationProducer", "Description": "Component or service that generated the operation.", "Type": "String", "Entity": null }, { "Name": "PayloadType", "Description": "Type or format of the payload associated with the request.", "Type": "String", "Entity": null }, { "Name": "AuthenticationInfoPrincipalEmail", "Description": "Email address of the authenticated user or service account initiating the request.", "Type": "String", "Entity": null }, { "Name": "AuthorizationInfo", "Description": "Information about permissions or roles evaluated for the operation.", "Type": "String", "Entity": null }, { "Name": "MethodName", "Description": "Name of the API method or function that was invoked.", "Type": "String", "Entity": null }, { "Name": "NumResponseItems", "Description": "Number of items returned in the response, if applicable.", "Type": "String", "Entity": null }, { "Name": "RequestName", "Description": "Name or identifier of the resource being accessed or modified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestType", "Description": "Type of request.", "Type": "String", "Entity": null }, { "Name": "RequestParent", "Description": "Parent resource of the request, indicating hierarchy or context.", "Type": "String", "Entity": null }, { "Name": "RequestEndpointName", "Description": "Name of the endpoint to which the request was sent.", "Type": "String", "Entity": null }, { "Name": "RequestEndpointNetwork", "Description": "Network path or name through which the endpoint was accessed.", "Type": "String", "Entity": null }, { "Name": "RequestEndpointSeverity", "Description": "Severity associated with the endpoint in the context of threat detection or access.", "Type": "String", "Entity": null }, { "Name": "RequestEndpointTrafficLogs", "Description": "Details or references to traffic logs related to the endpoint request.", "Type": "String", "Entity": null }, { "Name": "RequestEndpointId", "Description": "Unique identifier of the endpoint that handled the request.", "Type": "String", "Entity": null }, { "Name": "RequestEndpointThreatExceptions", "Description": "Threat exceptions applied to the endpoint for this request, if any.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerIP", "Description": "IP address of the caller who initiated the request.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataDestinationAttributes", "Description": "Metadata attributes about the destination service or resource.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesTime", "Description": "Timestamp of when the request attributes were recorded.", "Type": "DateTime", "Entity": null }, { "Name": "RequestMetadataRequestAttributesAuth", "Description": "Authentication-related request attributes, such as tokens or auth levels.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesReason", "Description": "Reason for the request, such as a policy action or user-initiated change.", "Type": "String", "Entity": null }, { "Name": "ResourceLocationCurrentLocations", "Description": "Current physical or logical location(s) of the resource at the time of the log entry.", "Type": "String", "Entity": null }, { "Name": "ResponseType", "Description": "Type or format of the response returned from the operation.", "Type": "String", "Entity": null }, { "Name": "ResponseName", "Description": "Name or ID of the resource returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseNetwork", "Description": "Network path or identifier associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseSeverity", "Description": "Severity level of the response, especially in the context of errors or alerts.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log entry was generated and ingested by the logging system.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseState", "Description": "State or result of the response action taken for the detected threat.", "Type": "String", "Entity": null }, { "Name": "ResponseThreatExceptions", "Description": "List of any threat exceptions applied during the response, allowing specific threats to bypass enforcement.", "Type": "String", "Entity": null }, { "Name": "ResponseTrafficLogs", "Description": "Indicates whether traffic logs were captured for the session or threat response.", "Type": "Boolean", "Entity": null }, { "Name": "ServiceName", "Description": "Name of the cloud service associated with the log entry or threat detection.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsMethod", "Description": "The method or operation performed on the resource, often linked to an API call or service method.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsProjectId", "Description": "Project ID associated with the resource, typically representing the Google Cloud project.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsService", "Description": "Service label indicating which cloud service.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsId", "Description": "Unique identifier for the resource involved in the log entry.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsLocation", "Description": "Geographic or regional location of the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsResourceContainer", "Description": "Name of the container or logical grouping the resource belongs to (e.g., folder, organization).", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "RequestUpdateMaskPaths", "Description": "The paths to be updated in the request.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPLoadBalancer", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) GCPLoadBalancer logs, enable you to capture network inbound activity from the load balancer and Web Application Firewall (WAF) to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the log entry was received by logging.", "Type": "DateTime", "Entity": null }, { "Name": "BackendTargetProjectNumber", "Description": "The Backend Service Project Number.", "Type": "String", "Entity": null }, { "Name": "CacheDecision", "Description": "Indicates whether a request was served from the cache or the backend.", "Type": "Object", "Entity": null }, { "Name": "EnforcedSecurityPolicy", "Description": "Indicates whether a security policy (such as a WAF or access control rules) was applied to a request.", "Type": "Object", "Entity": null }, { "Name": "PreviewSecurityPolicy", "Description": "Request matches a rule configured for preview (present only when a preview rule would have taken priority over the enforced rule).", "Type": "Object", "Entity": null }, { "Name": "EnforcedEdgeSecurityPolicy", "Description": "the edge security policy rule that was enforced.", "Type": "Object", "Entity": null }, { "Name": "PreviewEdgeSecurityPolicy", "Description": "populated if a request matches an edge security policy rule configured for preview.", "Type": "Object", "Entity": null }, { "Name": "PayloadRemoteIp", "Description": "The remote ip address of the payload.", "Type": "String", "Entity": null }, { "Name": "SecurityPolicyRequestData", "Description": "The security policy data of the request.", "Type": "Object", "Entity": null }, { "Name": "StatusDetails", "Description": "The status details of the request.", "Type": "String", "Entity": null }, { "Name": "Latency", "Description": "The latency of the request.", "Type": "String", "Entity": null }, { "Name": "RemoteIp", "Description": "The remote ip of the request.", "Type": "String", "Entity": null }, { "Name": "RequestMethod", "Description": "HTTP method of the request", "Type": "String", "Entity": null }, { "Name": "RequestSize", "Description": "The size of the request.", "Type": "String", "Entity": null }, { "Name": "RequestUrl", "Description": "The url of the request.", "Type": "String", "Entity": null }, { "Name": "RequestStatus", "Description": "The status code of the request.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "BackendServiceName", "Description": "The backend service name in Google Cloud Platform .", "Type": "String", "Entity": null }, { "Name": "ForwardingRuleName", "Description": "The forwarding rule resource of the load balancer in Google Cloud Platform.", "Type": "String", "Entity": null }, { "Name": "ProjectId", "Description": "The Project id in Google Cloud Platform", "Type": "String", "Entity": null }, { "Name": "UrlMapName", "Description": "The url map resource name in Google Cloud Platform.", "Type": "String", "Entity": null }, { "Name": "Zone", "Description": "The Zone name of the Load Balancer.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made.", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPMonitoring", "TableSource": "sentinel", "Description": "The Google Cloud Platform Cloud Monitoring data connector ingests Monitoring logs from Google Cloud into Microsoft Sentinel using the Google Cloud Monitoring API. Refer to [Cloud Monitoring API](https://cloud.google.com/monitoring/api/v3) documentation for more details.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "MetricLabels", "Description": "Key-value pairs that identify the characteristics of the metric (e.g., instance ID, region, etc.)", "Type": "Object", "Entity": null }, { "Name": "MetricType", "Description": "The full path of the metric type being monitored (e.g., 'compute.googleapis.com/instance/cpu/utilization')", "Type": "String", "Entity": null }, { "Name": "MetricKind", "Description": "The type of metric: GAUGE (instant value), DELTA (change over time), or CUMULATIVE (accumulated value)", "Type": "String", "Entity": null }, { "Name": "GCPResource", "Description": "The monitored resource associated with the metric (e.g., VM instance, GKE cluster), includes resource type and labels", "Type": "Object", "Entity": null }, { "Name": "ValueType", "Description": "The type of value recorded: INT64, DOUBLE, BOOL, STRING, or DISTRIBUTION", "Type": "String", "Entity": null }, { "Name": "Points", "Description": "A list of time series data points that contain values and timestamps for the metric", "Type": "Object", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the metric or log entry was generated at the source, representing the actual occurrence time of the data point.", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPNAT", "TableSource": "sentinel", "Description": "The Google Cloud Platform NAT data connector provides the capability to ingest Cloud NAT Audit logs and Cloud NAT Traffic logs into Microsoft Sentinel using the Compute Engine API. Refer the [Product overview](https://cloud.google.com/nat/docs/overview) document for more details.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the log was ingested by Log Analytics.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "Unique identifier for the log entry within the GCP logging system.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "Name of the log stream.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The time the log entry was received by GCP Logging.", "Type": "DateTime", "Entity": null }, { "Name": "GCPResourceType", "Description": "Type of the monitored GCP resource (e.g., 'router', 'gce_instance').", "Type": "String", "Entity": null }, { "Name": "ProjectId", "Description": "ID of the GCP project that generated the log entry.", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "Region of the GCP resource involved in the NAT traffic.", "Type": "String", "Entity": null }, { "Name": "RouterId", "Description": "Identifier of the Cloud Router managing the NAT gateway.", "Type": "String", "Entity": null }, { "Name": "GatewayName", "Description": "Name of the Cloud NAT gateway instance.", "Type": "String", "Entity": null }, { "Name": "AllocationStatus", "Description": "Status of the NAT IP address allocation.", "Type": "String", "Entity": null }, { "Name": "SrcIp", "Description": "Source internal IP address from which the traffic originated.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "Source port on the internal VM or resource.", "Type": "String", "Entity": null }, { "Name": "DestIp", "Description": "Destination external IP address the traffic was sent to.", "Type": "String", "Entity": null }, { "Name": "DestPort", "Description": "Destination port on the remote host.", "Type": "String", "Entity": null }, { "Name": "NatIp", "Description": "Public NAT IP address assigned for this flow.", "Type": "String", "Entity": null }, { "Name": "NatPort", "Description": "Public NAT port assigned for this flow.", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "VmName", "Description": "Name of the virtual machine that initiated the NAT traffic.", "Type": "String", "Entity": null }, { "Name": "EndpointRegion", "Description": "Region of the destination endpoint.", "Type": "String", "Entity": null }, { "Name": "EndpointZone", "Description": "Zone of the destination endpoint if applicable.", "Type": "String", "Entity": null }, { "Name": "ASN", "Description": "Autonomous System Number (ASN) associated with the destination IP.", "Type": "String", "Entity": null }, { "Name": "Country", "Description": "Country/Region where the account user is located", "Type": "String", "Entity": null }, { "Name": "City", "Description": "City where the client IP address is geolocated", "Type": "String", "Entity": null }, { "Name": "DestinationRegion", "Description": "Continent or larger geographical region of the destination.", "Type": "String", "Entity": null }, { "Name": "Continent", "Description": "Continent where the destination IP is located.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPNATAudit", "TableSource": "sentinel", "Description": "The Google Cloud Platform NAT data connector provides the capability to ingest Cloud NAT Audit logs and Cloud NAT Traffic logs into Microsoft Sentinel using the Compute Engine API. Refer the [Product overview](https://cloud.google.com/nat/docs/overview) document for more details.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time at which the log was generated.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "A unique ID for the log entry.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The name of the log stream.", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "Type of the GCP resource.", "Type": "String", "Entity": null }, { "Name": "ResourceRegion", "Description": "Region of the GCP resource.", "Type": "String", "Entity": null }, { "Name": "RouterId", "Description": "Identifier of the Cloud Router.", "Type": "String", "Entity": null }, { "Name": "ProjectId", "Description": "GCP Project ID where the event occurred.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "RootTriggerId", "Description": "Root trigger ID of the operation.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "Time when the log was received.", "Type": "DateTime", "Entity": null }, { "Name": "PayloadType", "Description": "Type of payload in the log.", "Type": "String", "Entity": null }, { "Name": "PrincipalEmail", "Description": "Email of the principal initiating the request.", "Type": "String", "Entity": null }, { "Name": "PrincipalSubject", "Description": "Subject or identity of the principal.", "Type": "String", "Entity": null }, { "Name": "CallerIp", "Description": "IP address of the caller.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "RequestAttributeTime", "Description": "Timestamp of the request attribute.", "Type": "DateTime", "Entity": null }, { "Name": "RequestAttributeAuth", "Description": "Authorization details of the request.", "Type": "String", "Entity": null }, { "Name": "RequestAttributeDestination", "Description": "Destination details of the request.", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "Name of the GCP service.", "Type": "String", "Entity": null }, { "Name": "MethodName", "Description": "API method invoked.", "Type": "String", "Entity": null }, { "Name": "AuthorizationInfo", "Description": "Details about the authorization.", "Type": "String", "Entity": null }, { "Name": "GCPResourceName", "Description": "Name of the resource affected.", "Type": "String", "Entity": null }, { "Name": "RequestType", "Description": "Type of the request.", "Type": "String", "Entity": null }, { "Name": "RequestName", "Description": "Name of the request.", "Type": "String", "Entity": null }, { "Name": "RequestNetwork", "Description": "Network where the request was made.", "Type": "String", "Entity": null }, { "Name": "PayloadRequestNats", "Description": "NATs request payload.", "Type": "String", "Entity": null }, { "Name": "EncryptedInterconnectRouter", "Description": "Whether the router uses encrypted interconnect.", "Type": "Boolean", "Entity": null }, { "Name": "RequestRegion", "Description": "Region where the request originated.", "Type": "String", "Entity": null }, { "Name": "RequestSelfLink", "Description": "SelfLink URL of the request resource.", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "ResponseType", "Description": "Type of the response returned.", "Type": "String", "Entity": null }, { "Name": "ResponseName", "Description": "Name of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseUser", "Description": "User returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseTargetId", "Description": "Target ID in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseStatus", "Description": "Status of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseProgress", "Description": "Progress status of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseStartTime", "Description": "Start time of the response.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseRegion", "Description": "Region associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseSelfLinkWithId", "Description": "SelfLink URL with ID in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseInsertTime", "Description": "Insert time of the response.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseTargetLink", "Description": "Target link in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseSelfLink", "Description": "SelfLink URL of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseId", "Description": "Identifier of the response.", "Type": "String", "Entity": null }, { "Name": "ResponseOperationType", "Description": "Type of operation performed.", "Type": "String", "Entity": null }, { "Name": "ResponseErrorCode", "Description": "Error code if any error occurred.", "Type": "String", "Entity": null }, { "Name": "ResponseErrors", "Description": "Details of any errors returned.", "Type": "String", "Entity": null }, { "Name": "ResponseErrorMessage", "Description": "Error message returned, if any.", "Type": "String", "Entity": null }, { "Name": "ResourceLocation", "Description": "Geographic location of the resource.", "Type": "String", "Entity": null }, { "Name": "OperationId", "Description": "Identifier for a batch of requests; the same identifier is used for all requests in a batch but if requests are non-batched, the identifier is unique per request", "Type": "String", "Entity": null }, { "Name": "OperationProducer", "Description": "Producer of the operation.", "Type": "String", "Entity": null }, { "Name": "OperationFirst", "Description": "Indicates if this is the first operation in the series.", "Type": "Boolean", "Entity": null }, { "Name": "OperationLast", "Description": "Indicates if this is the last operation in the series.", "Type": "Boolean", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPResourceManager", "TableSource": "sentinel", "Description": "The Google Cloud Platform Resource Manager data connector provides the capability to ingest Resource Manager [Admin Activity and Data Access Audit logs](https://cloud.google.com/resource-manager/docs/audit-logging) into Microsoft Sentinel using the Cloud Resource Manager API. Refer the [Product overview](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy) document for more details.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the log entry was received by logging.", "Type": "DateTime", "Entity": null }, { "Name": "InsertID", "Description": "A unique ID for the log entry used for deduplication.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The full resource name of the log (e.g., projects/[PROJECT_ID]/logs/[LOG_ID]).", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The time the log entry was received by Cloud Logging.", "Type": "DateTime", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "PayloadType", "Description": "The type of the log payload (e.g., protoPayload, textPayload).", "Type": "String", "Entity": null }, { "Name": "MethodName", "Description": "The API method that was called (e.g., google.cloud.resourcemanager.v3.Projects.CreateProject).", "Type": "String", "Entity": null }, { "Name": "GCPResourceName", "Description": "The name of the resource that the operation is acting on.", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "The name of the GCP service handling the request (e.g., cloudresourcemanager.googleapis.com).", "Type": "String", "Entity": null }, { "Name": "NumResponseItems", "Description": "The number of items returned in the response, if applicable.", "Type": "String", "Entity": null }, { "Name": "AuthenticationInfoPrincipalEmail", "Description": "The email address of the authenticated principal making the request.", "Type": "String", "Entity": null }, { "Name": "AuthenticationInfoPrincipalSubject", "Description": "The unique subject identifier for the principal (useful for federated identities).", "Type": "String", "Entity": null }, { "Name": "AuthenticationInfoServiceAccountKeyName", "Description": "The resource name of the service account key used to authenticate the request.", "Type": "String", "Entity": null }, { "Name": "AuthorizationInfo", "Description": "Details on the authorization checks performed, including the permissions evaluated.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "MetadataType", "Description": "The type of metadata associated with the log entry.", "Type": "String", "Entity": null }, { "Name": "MetadataParentDeltaDestinationParentId", "Description": "The destination parent ID when a resource moves between parents (e.g., folder or org).", "Type": "String", "Entity": null }, { "Name": "MetadataParentDeltaDestinationParentType", "Description": "The type of destination parent (e.g., folder, organization).", "Type": "String", "Entity": null }, { "Name": "MetadataParentDeltaSourceParentId", "Description": "The original parent ID of the resource before the move.", "Type": "String", "Entity": null }, { "Name": "MetadataParentDeltaSourceParentType", "Description": "The type of source parent (e.g., folder, organization).", "Type": "String", "Entity": null }, { "Name": "RequestType", "Description": "The type of request being made (e.g., Create, Update, Delete).", "Type": "String", "Entity": null }, { "Name": "RequestResource", "Description": "The full representation of the resource included in the request.", "Type": "String", "Entity": null }, { "Name": "RequestName", "Description": "The name or ID of the resource targeted by the request.", "Type": "String", "Entity": null }, { "Name": "RequestCreateTime", "Description": "The timestamp when the resource was created as specified in the request.", "Type": "DateTime", "Entity": null }, { "Name": "RequestLifecycleState", "Description": "The lifecycle state of the resource in the request (e.g., ACTIVE, DELETE_REQUESTED).", "Type": "String", "Entity": null }, { "Name": "RequestProjectId", "Description": "The project ID associated with the request.", "Type": "String", "Entity": null }, { "Name": "RequestParent", "Description": "The parent resource (e.g., folder or org) under which the request is being made.", "Type": "String", "Entity": null }, { "Name": "RequestListValue", "Description": "A list of values specified in the request (e.g., tags, constraints).", "Type": "String", "Entity": null }, { "Name": "RequestPageSize", "Description": "The number of results to return per page in a list request.", "Type": "String", "Entity": null }, { "Name": "RequestCustomConstraint", "Description": "Custom constraint configuration specified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestDestinationParent", "Description": "The resource name of the destination parent, used in resource moves.", "Type": "String", "Entity": null }, { "Name": "RequestUpdateMask", "Description": "A comma-separated list specifying the fields to be updated in a partial update request.", "Type": "String", "Entity": null }, { "Name": "RequestConstraint", "Description": "The Org Policy constraint specified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestQuery", "Description": "A query String used for filtering results (e.g., in search or list operations).", "Type": "String", "Entity": null }, { "Name": "RequestPolicyAuditConfigs", "Description": "The audit configuration settings defined in the policy request.", "Type": "String", "Entity": null }, { "Name": "RequestPolicyBindings", "Description": "A list of role bindings defined in the IAM policy request.", "Type": "String", "Entity": null }, { "Name": "RequestPolicyEtag", "Description": "The ETag used for concurrency control in the policy request.", "Type": "String", "Entity": null }, { "Name": "RequestPolicyName", "Description": "The resource name of the policy being modified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestPolicySpec", "Description": "Detailed specification of the Org Policy being applied.", "Type": "String", "Entity": null }, { "Name": "RequestOptionsRequestedPolicyVersion", "Description": "The version of the IAM policy format requested.", "Type": "String", "Entity": null }, { "Name": "RequestProjectName", "Description": "The display name of the project specified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestProjectProjectId", "Description": "The unique project ID provided in the request.", "Type": "String", "Entity": null }, { "Name": "RequestProjectProjectNumber", "Description": "The numerical project identifier.", "Type": "String", "Entity": null }, { "Name": "RequestProjectLifecycleState", "Description": "The lifecycle state of the project (e.g., ACTIVE, DELETE_REQUESTED).", "Type": "String", "Entity": null }, { "Name": "RequestProjectCreateTime", "Description": "The time the project was created as per the request.", "Type": "DateTime", "Entity": null }, { "Name": "RequestProjectLabels", "Description": "Key-value labels assigned to the project in the request.", "Type": "String", "Entity": null }, { "Name": "RequestProjectParent", "Description": "The parent resource (folder or organization) under which the project is created.", "Type": "String", "Entity": null }, { "Name": "RequestFolderDisplayName", "Description": "The display name of the folder provided in the request.", "Type": "String", "Entity": null }, { "Name": "RequestFolderParent", "Description": "The parent resource of the folder specified in the request.", "Type": "String", "Entity": null }, { "Name": "RequestTagValueName", "Description": "The full resource name of the tag value in the request.", "Type": "String", "Entity": null }, { "Name": "RequestTagKeyName", "Description": "The full resource name of the tag key referenced in the request.", "Type": "String", "Entity": null }, { "Name": "RequestTagBindingTagValue", "Description": "The tag value being bound to a resource in the request.", "Type": "String", "Entity": null }, { "Name": "RequestTagBindingParent", "Description": "The full name of the resource to which the tag is being bound.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerIP", "Description": "The IP address of the caller who made the request.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataCallerSuppliedUserAgent", "Description": "The user agent String provided by the caller's client application.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataDestinationAttributes", "Description": "Metadata about the request destination, such as port or protocol.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesAuth", "Description": "Authentication attributes related to the request, such as authority selector or principal email.", "Type": "String", "Entity": null }, { "Name": "RequestMetadataRequestAttributesTime", "Description": "The timestamp when the request was made.", "Type": "DateTime", "Entity": null }, { "Name": "RequestMetadataRequestAttributesReason", "Description": "The reason or justification for making the request (if provided).", "Type": "String", "Entity": null }, { "Name": "ResponseType", "Description": "The type of the response payload.", "Type": "String", "Entity": null }, { "Name": "ResponseAuditConfigs", "Description": "The audit configurations returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseBindings", "Description": "The IAM role bindings included in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseEtag", "Description": "The ETag used for concurrency control in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseCreateTime", "Description": "The timestamp when the resource was created, as returned in the response.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseDisplayName", "Description": "The display name of the resource returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseName", "Description": "The full resource name returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseParent", "Description": "The parent resource name associated with the response.", "Type": "String", "Entity": null }, { "Name": "ResponseState", "Description": "The current state of the resource (e.g., ACTIVE, DELETED).", "Type": "String", "Entity": null }, { "Name": "ResponseUpdateTime", "Description": "The time when the resource was last updated, as per the response.", "Type": "DateTime", "Entity": null }, { "Name": "ResponseLifecycleState", "Description": "The lifecycle state of the resource in the response (e.g., ACTIVE, DELETE_REQUESTED).", "Type": "String", "Entity": null }, { "Name": "ResponseProjectId", "Description": "The project ID returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseProjectNumber", "Description": "The project ID returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseLabels", "Description": "The key-value labels attached to the resource in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseDescription", "Description": "A description of the resource or result returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseNamespacedName", "Description": "A namespaced identifier for the resource (used in tagging).", "Type": "String", "Entity": null }, { "Name": "ResponseShortName", "Description": "The short, user-defined name of the resource returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseTagKey", "Description": "The tag key associated with the resource returned in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseTagValue", "Description": "The tag value associated with the resource in the response.", "Type": "String", "Entity": null }, { "Name": "ResponseTagValueNamespacedName", "Description": "A fully qualified name (including tag key) for the tag value.", "Type": "String", "Entity": null }, { "Name": "ResponsePolicySpec", "Description": "The policy specification returned in the response (Org Policy or IAM policy).", "Type": "String", "Entity": null }, { "Name": "ServiceDataType", "Description": "The type of service-specific data returned in the response.", "Type": "String", "Entity": null }, { "Name": "ServiceDataPolicyDeltaBindingDeltas", "Description": "Changes (additions or removals) to IAM bindings as part of the policy delta.", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "The type of resource involved in the operation (e.g., project, folder, organization).", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsOrganizationId", "Description": "The organization ID associated with the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsFolderId", "Description": "The folder ID associated with the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsProjectId", "Description": "The project ID associated with the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsMethod", "Description": "The method name label used for filtering in logs.", "Type": "String", "Entity": null }, { "Name": "ResourceLabelsService", "Description": "The service name label used for filtering in logs.", "Type": "String", "Entity": null }, { "Name": "OperationFirst", "Description": "Indicates whether this is the first log entry for a long-running operation.", "Type": "Boolean", "Entity": null }, { "Name": "OperationLast", "Description": "Indicates whether this is the last log entry for a long-running operation.", "Type": "Boolean", "Entity": null }, { "Name": "OperationID", "Description": "An identifier for a long-running operation shared across related log entries.", "Type": "String", "Entity": null }, { "Name": "OperationProducer", "Description": "The name of the producer of the operation (e.g., the GCP service executing the operation).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GCPVPCFlow", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) VPC Flow Logs enable you to capture network traffic activity at the VPC level, allowing you to monitor access patterns, analyze network performance, and detect potential threats across GCP resources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the log entry was received by logging.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier assigned to each log entry.", "Type": "String", "Entity": null }, { "Name": "BytesSent", "Description": "Amount of bytes sent from the source to the destination.", "Type": "String", "Entity": null }, { "Name": "PacketsSent", "Description": "Number of packets sent from the source to the destination.", "Type": "String", "Entity": null }, { "Name": "Reporter", "Description": "The side which reported the flow.", "Type": "String", "Entity": null }, { "Name": "Rttmsec", "Description": "The measured latency is the time elapsed between sending a SEQ and receiving a corresponding ACK.", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "LogName", "Description": "The name of the log where this entry is stored.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "Timestamp of the event when it was received by the logging service.", "Type": "DateTime", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ProjectId", "Description": "ProjectId of the resource.", "Type": "String", "Entity": null }, { "Name": "SubnetworkId", "Description": "ID of the Google Cloud project containing the VPC", "Type": "String", "Entity": null }, { "Name": "SubnetworkName", "Description": "Name of the subnet", "Type": "String", "Entity": null }, { "Name": "GCPResourceType", "Description": "Type of the resource (e.g., compute instance, DNS record).", "Type": "String", "Entity": null }, { "Name": "DestIp", "Description": "Destination IP address", "Type": "String", "Entity": null }, { "Name": "DestPort", "Description": "Destination port", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "SrcIp", "Description": "Source IP address", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "Source port", "Type": "String", "Entity": null }, { "Name": "DestInstanceProjectId", "Description": "ID of the Google Cloud project that contains the VM resource", "Type": "String", "Entity": null }, { "Name": "DestInstanceRegion", "Description": "Region of the VM", "Type": "String", "Entity": null }, { "Name": "DestInstanceVmName", "Description": "Instance name of the VM", "Type": "String", "Entity": null }, { "Name": "DestInstanceZone", "Description": "Zone of the VM", "Type": "String", "Entity": null }, { "Name": "DestInstanceGroupName", "Description": "Name of the instance group", "Type": "String", "Entity": null }, { "Name": "DestInstanceGroupZone", "Description": "If the instance group is zonal, this field is populated with the zone of the instance group.", "Type": "String", "Entity": null }, { "Name": "DestInstanceGroupRegion", "Description": "If the instance group is regional, this field is populated with the region of the instance group.", "Type": "String", "Entity": null }, { "Name": "DestVpcProjectId", "Description": "ID of the Google Cloud project containing the VPC", "Type": "String", "Entity": null }, { "Name": "DestVpcSubnetworkName", "Description": "Name of the subnet", "Type": "String", "Entity": null }, { "Name": "DestVpcSubnetworkRegion", "Description": "Region of the subnet", "Type": "String", "Entity": null }, { "Name": "DestVpcName", "Description": "Name of the network", "Type": "String", "Entity": null }, { "Name": "NetworkServiceDscp", "Description": "If the Differentiated Services field is present in packet headers, this field is populated with the DSCP value.", "Type": "String", "Entity": null }, { "Name": "SrcInstanceProjectId", "Description": "ID of the Google Cloud project that contains the source VM resource", "Type": "String", "Entity": null }, { "Name": "SrcInstanceRegion", "Description": "Region of the source VM", "Type": "String", "Entity": null }, { "Name": "SrcInstanceVmName", "Description": "Instance name of the source VM", "Type": "String", "Entity": null }, { "Name": "SrcInstanceZone", "Description": "Zone of the source VM", "Type": "String", "Entity": null }, { "Name": "SrcInstanceGroupName", "Description": "Name of the source instance group", "Type": "String", "Entity": null }, { "Name": "SrcInstanceGroupZone", "Description": "If the source instance group is zonal, this field is populated with the zone of the source instance group.", "Type": "String", "Entity": null }, { "Name": "SrcInstanceGroupRegion", "Description": "If the source instance group is regional, this field is populated with the region of the source instance group.", "Type": "String", "Entity": null }, { "Name": "SrcVpcProjectId", "Description": "ID of the Google Cloud project containing the VPC", "Type": "String", "Entity": null }, { "Name": "SrcVpcSubnetworkName", "Description": "Name of the source subnet,", "Type": "String", "Entity": null }, { "Name": "SrcVpcSubnetworkRegion", "Description": "Name of the source region", "Type": "String", "Entity": null }, { "Name": "SrcVpcName", "Description": "Name of the source network", "Type": "String", "Entity": null }, { "Name": "DestGoogleServiceType", "Description": "This field is set to GOOGLE_API if the destination is a Google API service.", "Type": "String", "Entity": null }, { "Name": "SrcGoogleServiceType", "Description": "This field is set to GOOGLE_API if the source is a Google API service.", "Type": "String", "Entity": null }, { "Name": "DestLocationAsn", "Description": "The ASN of the external destination network to which this endpoint belongs.", "Type": "String", "Entity": null }, { "Name": "DestLocationContinent", "Description": "Continent for external destination endpoints.", "Type": "String", "Entity": null }, { "Name": "DestLocationCity", "Description": "City for external destination endpoints.", "Type": "String", "Entity": null }, { "Name": "DestLocationCountry", "Description": "Country for external destination endpoints.", "Type": "String", "Entity": null }, { "Name": "DestLocationRegion", "Description": "Region for external destination endpoints.", "Type": "String", "Entity": null }, { "Name": "SrcLocationAsn", "Description": "The ASN of the external source network to which this endpoint belongs.", "Type": "String", "Entity": null }, { "Name": "SrcLocationContinent", "Description": "Continent for external source endpoints.", "Type": "String", "Entity": null }, { "Name": "SrcLocationCountry", "Description": "Country for external source endpoints.", "Type": "String", "Entity": null }, { "Name": "SrcLocationCity", "Description": "City for external source endpoints.", "Type": "String", "Entity": null }, { "Name": "SrcLocationRegion", "Description": "Region for external source endpoints.", "Type": "String", "Entity": null }, { "Name": "InternetRoutingDetailsEgressAsn", "Description": "List of relevant AS paths. If there are multiple AS paths available to the flow, the field might contain more than one AS path.", "Type": "String", "Entity": null }, { "Name": "LbBackendGroupName", "Description": "Name of the backend group", "Type": "String", "Entity": null }, { "Name": "LbBackendGroupType", "Description": "Type of the backend group", "Type": "String", "Entity": null }, { "Name": "LbForwardingRuleName", "Description": "Name of the forwarding rule", "Type": "String", "Entity": null }, { "Name": "LbForwardingRuleProjectId", "Description": "Google Cloud project ID of the forwarding rule", "Type": "String", "Entity": null }, { "Name": "LbReporter", "Description": "Cloud Load Balancing reporter. Can be either CLIENT or BACKEND", "Type": "String", "Entity": null }, { "Name": "LbScheme", "Description": "Load balancer scheme", "Type": "String", "Entity": null }, { "Name": "LbUrlMapName", "Description": "Name of the URL map. Populated if the type of the load balancer is APPLICATION_LOAD_BALANCER.", "Type": "String", "Entity": null }, { "Name": "LbBackendServiceName", "Description": "Name of the backend service.", "Type": "String", "Entity": null }, { "Name": "LbType", "Description": "Load balancer type.", "Type": "String", "Entity": null }, { "Name": "LbBackendGroupLocation", "Description": "Location of the backend group", "Type": "String", "Entity": null }, { "Name": "LbVpc", "Description": "VPC network details of the load balancer", "Type": "Object", "Entity": null }, { "Name": "SrcGkeClusterLocation", "Description": "Location of the source cluster. This can be a zone or a region depending if the cluster is zonal or regional.", "Type": "String", "Entity": null }, { "Name": "SrcGkeClusterName", "Description": "Source GKE cluster name.", "Type": "String", "Entity": null }, { "Name": "SrcGkeService", "Description": "Source GKE Service name.", "Type": "Object", "Entity": null }, { "Name": "SrcGkePodName", "Description": "Name of the source Pod", "Type": "String", "Entity": null }, { "Name": "SrcGkePodNamespace", "Description": "Namespace of the source Pod", "Type": "String", "Entity": null }, { "Name": "SrcGkePodWorkloadName", "Description": "Name of the top-level source workload controller", "Type": "String", "Entity": null }, { "Name": "SrcGkePodWorkloadType", "Description": "Type of the top-level source workload controller.", "Type": "String", "Entity": null }, { "Name": "DestGkeClusterLocation", "Description": "Location of the destination cluster. This can be a zone or a region depending if the cluster is zonal or regional.", "Type": "String", "Entity": null }, { "Name": "DestGkeClusterName", "Description": "Destination GKE cluster name.", "Type": "String", "Entity": null }, { "Name": "DestGkeService", "Description": "Destination GKE Service name.", "Type": "Object", "Entity": null }, { "Name": "DestGkePodName", "Description": "Name of the destination Pod", "Type": "String", "Entity": null }, { "Name": "DestGkePodNamespace", "Description": "Namespace of the destination Pod", "Type": "String", "Entity": null }, { "Name": "DestGkePodWorkloadName", "Description": "Name of the top-level destination workload controller", "Type": "String", "Entity": null }, { "Name": "DestGkePodWorkloadType", "Description": "Type of the top-level destination workload controller.", "Type": "String", "Entity": null }, { "Name": "PscAttachmentProjectId", "Description": "Google Cloud project ID of the service attachment", "Type": "String", "Entity": null }, { "Name": "PscAttachmentRegion", "Description": "Region of the service attachment", "Type": "String", "Entity": null }, { "Name": "PscAttachmentVpc", "Description": "VPC network details of the service attachment", "Type": "Object", "Entity": null }, { "Name": "PscEndpointProjectId", "Description": "Google Cloud project ID of the Private Service Connect endpoint", "Type": "String", "Entity": null }, { "Name": "PscEndpointConnectionId", "Description": "Private Service Connect connection ID", "Type": "String", "Entity": null }, { "Name": "PscEndpointRegion", "Description": "Region of the endpoint. Not populated if the target service type is GLOBAL_GOOGLE_APIS.", "Type": "String", "Entity": null }, { "Name": "PscEndpointTargetServiceType", "Description": "Target service type. Can be either GLOBAL_GOOGLE_APIS or PUBLISHED_SERVICE.", "Type": "String", "Entity": null }, { "Name": "PscEndpointVpc", "Description": "VPC network details of the Private Service Connect endpoint", "Type": "Object", "Entity": null }, { "Name": "SrcGatewayProjectId", "Description": "Google Cloud project ID of the gateway", "Type": "String", "Entity": null }, { "Name": "SrcGatewayLocation", "Description": "Region of the gateway", "Type": "String", "Entity": null }, { "Name": "SrcGatewayName", "Description": "Name of the gateway", "Type": "String", "Entity": null }, { "Name": "SrcGatewayType", "Description": "Type of the gateway. Can be INTERCONNECT_ATTACHMENT or VPN_TUNNEL.", "Type": "String", "Entity": null }, { "Name": "SrcGatewayVpc", "Description": "VPC network details of the gateway", "Type": "Object", "Entity": null }, { "Name": "SrcGatewayInterconnectName", "Description": "If the type of the gateway is INTERCONNECT_ATTACHMENT, this field is populated with the name of the Cloud Interconnect connection on which the VLAN attachment is configured.", "Type": "String", "Entity": null }, { "Name": "SrcGatewayInterconnectProjectNumber", "Description": "If the type of the gateway is INTERCONNECT_ATTACHMENT, this field is populated with the Google Cloud project number of the Cloud Interconnect connection on which the VLAN attachment is configured.", "Type": "String", "Entity": null }, { "Name": "DestGatewayProjectId", "Description": "Google Cloud project ID of the destination gateway", "Type": "String", "Entity": null }, { "Name": "DestGatewayLocation", "Description": "Region of the destination gateway", "Type": "String", "Entity": null }, { "Name": "DestGatewayName", "Description": "Name of the destination gateway", "Type": "String", "Entity": null }, { "Name": "DestGatewayType", "Description": "Type of the destination gateway. Can be INTERCONNECT_ATTACHMENT or VPN_TUNNEL.", "Type": "String", "Entity": null }, { "Name": "DestGatewayVpc", "Description": "VPC network details of the gateway", "Type": "Object", "Entity": null }, { "Name": "DestGatewayInterconnectName", "Description": "If the type of the gateway is INTERCONNECT_ATTACHMENT, this field is populated with the name of the Cloud Interconnect connection on which the VLAN attachment is configured.", "Type": "String", "Entity": null }, { "Name": "DestGatewayInterconnectProjectNumber", "Description": "If the type of the gateway is INTERCONNECT_ATTACHMENT, this field is populated with the Google Cloud project number of the Cloud Interconnect connection on which the VLAN attachment is configured.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GKEAPIServer", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp indicating when the log event was created or generated by the source system.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "Unique ID for the log entry used to prevent duplication.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "Name of the log stream, usually indicating the source.", "Type": "String", "Entity": null }, { "Name": "Pid", "Description": "Process ID that generated the log entry.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "SourceFile", "Description": "Source file in the API server codebase where the log originated.", "Type": "String", "Entity": null }, { "Name": "SourceLine", "Description": "Line number in the source file.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "Timestamp when GCP Logging received the log.", "Type": "DateTime", "Entity": null }, { "Name": "ClusterName", "Description": "Name of the Kubernetes cluster.", "Type": "String", "Entity": null }, { "Name": "ComponentLocation", "Description": "Region or zone where the API server is located.", "Type": "String", "Entity": null }, { "Name": "ComponentName", "Description": "Name of hardware or firmware component", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ProjectID", "Description": "GCP project ID where the GKE cluster resides.", "Type": "String", "Entity": null }, { "Name": "ComputeResourceName", "Description": "Name of the compute instance or pod.", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "HttpVerb", "Description": "HTTP method (e.g., GET, POST, PUT, DELETE).", "Type": "String", "Entity": null }, { "Name": "URI", "Description": "Full URI of the API request to the Kubernetes API server.", "Type": "String", "Entity": null }, { "Name": "Latency", "Description": "Total time taken to serve the request.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "AuditID", "Description": "Unique identifier for the audit log entry.", "Type": "String", "Entity": null }, { "Name": "SrcIP", "Description": "Source IP address of the client that sent the request.", "Type": "String", "Entity": null }, { "Name": "Message", "Description": "The content of the log message.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Dynamic field containing various labels associated with the log entry.", "Type": "Object", "Entity": null }, { "Name": "ResponseCode", "Description": "HTTP response status code.", "Type": "Int32", "Entity": null }, { "Name": "ApfPl", "Description": "API Priority and Fairness (APF) Priority Level.", "Type": "String", "Entity": null }, { "Name": "ApfFs", "Description": "APF Flow Schema.", "Type": "String", "Entity": null }, { "Name": "ApfISeats", "Description": "Number of seats initially allocated by APF.", "Type": "Int32", "Entity": null }, { "Name": "ApfFSeats", "Description": "Final number of seats used after adjustments.", "Type": "Int32", "Entity": null }, { "Name": "ApfAdditionalLatency", "Description": "Additional latency due to APF throttling.", "Type": "String", "Entity": null }, { "Name": "ApfExecutionTime", "Description": "Time taken to execute the request excluding APF wait time.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GKEApplication", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp indicating when the log event was created or generated by the source system.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry, useful for deduplication.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The full resource name of the log (e.g., 'projects/[PROJECT_ID]/logs/[LOG_ID]').", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Key-value pairs providing additional metadata about the log entry.", "Type": "Object", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The time the log entry was received by the logging system.", "Type": "DateTime", "Entity": null }, { "Name": "ClusterName", "Description": "The name of the GKE cluster from which the log entry originated.", "Type": "String", "Entity": null }, { "Name": "NamespaceName", "Description": "The Kubernetes namespace associated with the log entry.", "Type": "String", "Entity": null }, { "Name": "PodName", "Description": "The name of the Kubernetes pod where the container is running.", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ContainerName", "Description": "Name of the container in Kubernetes or another runtime environment", "Type": "String", "Entity": null }, { "Name": "JsonPayload", "Description": "Structured JSON-formatted log content if available.", "Type": "Object", "Entity": null }, { "Name": "ProjectID", "Description": "The ID of the Google Cloud project where the log entry originated.", "Type": "String", "Entity": null }, { "Name": "TextPayload", "Description": "Unstructured text message associated with the log entry.", "Type": "String", "Entity": null }, { "Name": "ComputeResourceName", "Description": "The name of the underlying compute resource (such as the node or instance).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GKEAudit", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp indicating when the log event was created or generated by the source system.", "Type": "DateTime", "Entity": null }, { "Name": "LogType", "Description": "The category or type of log, such as GKEAudit, indicating the origin of the log data.", "Type": "String", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry, used to deduplicate log records.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The time when the log entry was received by the logging system.", "Type": "DateTime", "Entity": null }, { "Name": "Labels", "Description": "Custom key-value pairs that provide additional metadata for the log entry, such as environment or custom tags.", "Type": "Object", "Entity": null }, { "Name": "ProtoPayload", "Description": "A structured representation of the audit log entry using the Protobuf format. Contains detailed audit event data such as method name, status, and authentication info.", "Type": "Object", "Entity": null }, { "Name": "JsonPayload", "Description": "The JSON representation of the log entry payload, often containing key audit data when not using ProtoPayload.", "Type": "Object", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "Object", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "logName", "Description": "The full name of the log (e.g., projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity), showing the type and location of the log data.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GKEControllerManager", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp indicating when the log event was created or generated by the source system.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry to prevent duplication.", "Type": "String", "Entity": null }, { "Name": "Message", "Description": "The content of the log message.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Dynamic field containing various labels associated with the log entry.", "Type": "Object", "Entity": null }, { "Name": "LogName", "Description": "The full resource name of the log (e.g., projects/{project_id}/logs/{log_id}).", "Type": "String", "Entity": null }, { "Name": "Pid", "Description": "The process ID of the component that emitted the log, if available.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "SourceFile", "Description": "The source file in the Kubernetes codebase where the log originated.", "Type": "String", "Entity": null }, { "Name": "SourceLine", "Description": "The line number in the source file where the log was emitted.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The time the log was received by Cloud Logging.", "Type": "DateTime", "Entity": null }, { "Name": "ClusterName", "Description": "The name of the GKE cluster from which the log was generated.", "Type": "String", "Entity": null }, { "Name": "ComponentLocation", "Description": "The zone or region of the Kubernetes component emitting the log.", "Type": "String", "Entity": null }, { "Name": "ComponentName", "Description": "Name of hardware or firmware component", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ProjectID", "Description": "The Google Cloud project ID where the GKE cluster is hosted.", "Type": "String", "Entity": null }, { "Name": "ComputeResourceName", "Description": "The name of the compute resource (e.g., VM name or controller name) associated with the log.", "Type": "String", "Entity": null }, { "Name": "Logger", "Description": "The logging class or module that generated the message, often used for categorizing logs.", "Type": "String", "Entity": null }, { "Name": "Kind", "Description": "The type of Kubernetes resource being managed or referenced (e.g., Deployment, ReplicaSet).", "Type": "String", "Entity": null }, { "Name": "Key", "Description": "A unique identifier for the Kubernetes resource (typically namespace/name).", "Type": "String", "Entity": null }, { "Name": "Duration", "Description": "The time duration the operation took, generally in seconds with fractional precision (e.g., 1.234567s).", "Type": "String", "Entity": null }, { "Name": "SyncStatus", "Description": "The synchronization status or result of the controller operation (e.g., success, error, requeue).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GKEHPADecision", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp indicating when the log event was created or generated by the source system.", "Type": "DateTime", "Entity": null }, { "Name": "InsertId", "Description": "A unique ID assigned to the log entry to ensure de-duplication.", "Type": "String", "Entity": null }, { "Name": "Message", "Description": "The content of the log message.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Dynamic field containing various labels associated with the log entry.", "Type": "Object", "Entity": null }, { "Name": "LogName", "Description": "The resource path of the log (e.g., projects/{project_id}/logs/{log_id}).", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "SourceFile", "Description": "The source code file where the log originated from.", "Type": "String", "Entity": null }, { "Name": "SourceLine", "Description": "The specific line number in the source file that generated the log.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The timestamp when the log was received by the logging system.", "Type": "DateTime", "Entity": null }, { "Name": "ClusterName", "Description": "The name of the GKE cluster where the HPA decision occurred.", "Type": "String", "Entity": null }, { "Name": "ComponentLocation", "Description": "The physical location (region or zone) of the Kubernetes component emitting the log.", "Type": "String", "Entity": null }, { "Name": "ComponentName", "Description": "Name of hardware or firmware component", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ProjectID", "Description": "The Google Cloud project ID that owns the GKE cluster.", "Type": "String", "Entity": null }, { "Name": "ComputeResourceName", "Description": "The name of the compute resource or pod that is being scaled.", "Type": "String", "Entity": null }, { "Name": "VMName", "Description": "The name of the VM instance hosting the workload.", "Type": "String", "Entity": null }, { "Name": "Zone", "Description": "The specific zone in which the resource resides.", "Type": "String", "Entity": null }, { "Name": "ActuationLatencySeconds", "Description": "Time taken (in seconds) to apply the autoscaling decision from the time it was made.", "Type": "Double", "Entity": null }, { "Name": "ActuationTime", "Description": "The timestamp when the autoscaler made a scaling decision.", "Type": "DateTime", "Entity": null }, { "Name": "ConfiguredSize", "Description": "The number of replicas configured after the autoscaler decision.", "Type": "Int32", "Entity": null }, { "Name": "HPA", "Description": "The name of the Horizontal Pod Autoscaler making the decision.", "Type": "String", "Entity": null }, { "Name": "LeadingMetricIndex", "Description": "Index indicating the metric that most influenced the autoscaling decision.", "Type": "Int32", "Entity": null }, { "Name": "Replicas", "Description": "The current number of replicas before the scaling decision.", "Type": "Int32", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "TargetRefAPIVersion", "Description": "API version of the target resource (e.g., apps/v1).", "Type": "String", "Entity": null }, { "Name": "TargetRefKind", "Description": "Kind of the target Kubernetes resource (e.g., Deployment, StatefulSet).", "Type": "String", "Entity": null }, { "Name": "TargetRefName", "Description": "The name of the target Kubernetes object being scaled.", "Type": "String", "Entity": null }, { "Name": "TopLevelLimit", "Description": "The top-level scaling limit set on the number of replicas (e.g., maxReplicas).", "Type": "String", "Entity": null }, { "Name": "TopLevelOverride", "Description": "An override value for top-level limits, if specified (e.g., via policy or admin input).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GKEScheduler", "TableSource": "sentinel", "Description": "The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp indicating when the log event was created or generated by the source system", "Type": "DateTime", "Entity": null }, { "Name": "Message", "Description": "The content of the log message.", "Type": "String", "Entity": null }, { "Name": "Labels", "Description": "Dynamic field containing various labels associated with the log entry.", "Type": "Object", "Entity": null }, { "Name": "InsertId", "Description": "A unique identifier for the log entry, used to deduplicate log records.", "Type": "String", "Entity": null }, { "Name": "LogName", "Description": "The full resource name of the log to which this log entry belongs, typically includes project and log type.", "Type": "String", "Entity": null }, { "Name": "Pid", "Description": "Process ID associated with the log entry, if available.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "SourceFile", "Description": "The source file where the log was generated, if available from sourceLocation.", "Type": "String", "Entity": null }, { "Name": "SourceLine", "Description": "The line number in the source file where the log was generated.", "Type": "String", "Entity": null }, { "Name": "ReceiveTimestamp", "Description": "The timestamp when the log entry was received by the logging system.", "Type": "DateTime", "Entity": null }, { "Name": "ClusterName", "Description": "Name of the GKE cluster from which the log originated.", "Type": "String", "Entity": null }, { "Name": "ComponentLocation", "Description": "Location or zone of the component (e.g., us-central1-a) within the cluster.", "Type": "String", "Entity": null }, { "Name": "ComponentName", "Description": "Name of hardware or firmware component", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "ProjectID", "Description": "Google Cloud project ID associated with the log entry.", "Type": "String", "Entity": null }, { "Name": "ComputeResourceName", "Description": "Name of the compute resource (e.g., VM instance) related to the log entry.", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "HttpVerb", "Description": "The HTTP method used in the request (e.g., GET, POST).", "Type": "String", "Entity": null }, { "Name": "URI", "Description": "The requested URI path extracted from the log message.", "Type": "String", "Entity": null }, { "Name": "Latency", "Description": "Request latency duration (e.g., time taken to complete the request).", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "AuditID", "Description": "An identifier used for tracking the audit trail of the request.", "Type": "String", "Entity": null }, { "Name": "SrcIP", "Description": "Source IP address of the client making the request.", "Type": "String", "Entity": null }, { "Name": "ResponseCode", "Description": "HTTP status code returned in the response (e.g., 200, 403).", "Type": "Int32", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GoogleCloudSCC", "TableSource": "sentinel", "Description": "Security Command Center is a comprehensive security and risk management platform for Google Cloud. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Findings", "Description": "A Dynamic array of all the findings associated with the resource.", "Type": "Object", "Entity": null }, { "Name": "FindingsResource", "Description": "A Dynamic array of the resource that was affected by the security finding.", "Type": "Object", "Entity": null }, { "Name": "SourceProperties", "Description": "A map of additional properties about the source of the security finding.", "Type": "Object", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time at which the security finding was first detected.", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "GoogleWorkspaceReports", "TableSource": "sentinel", "Description": "The [Google Workspace](https://workspace.google.com/) Activities data connector provides the capability to ingest Activity Events from [Google Workspace API](https://developers.google.com/admin-sdk/reports/reference/rest/v1/activities/list) into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Time that the log was generated.", "Type": "DateTime", "Entity": null }, { "Name": "Kind", "Description": "The type of API resource. For an activity report, the value is audit#activity.", "Type": "String", "Entity": null }, { "Name": "Etag", "Description": "ETag of the entry.", "Type": "String", "Entity": null }, { "Name": "OwnerDomain", "Description": "This is the domain that is affected by the report's event. For example domain of Admin console or the Drive application's document owner.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "IP address of the user doing the action.", "Type": "String", "Entity": null }, { "Name": "IdApplicationName", "Description": "Application name to which the event belongs.", "Type": "String", "Entity": null }, { "Name": "IdCustomerId", "Description": "The unique identifier for a Google Workspace account.", "Type": "String", "Entity": null }, { "Name": "IdUniqueQualifier", "Description": "Unique qualifier if multiple events have the same time.", "Type": "String", "Entity": null }, { "Name": "IdTime", "Description": "Time of occurrence of the activity. This is in UNIX epoch time in seconds.", "Type": "String", "Entity": null }, { "Name": "NetworkIpAsn", "Description": "IP Address of the user doing the action.", "Type": "Object", "Entity": null }, { "Name": "NetworkInfoRegionCode", "Description": "ISO 3166-1 alpha-2 region code of the user doing the action.", "Type": "String", "Entity": null }, { "Name": "NetworkInfoSubdivisionCode", "Description": "ISO 3166-2 region code (states and provinces) for countries of the user doing the action.", "Type": "String", "Entity": null }, { "Name": "ActorEmail", "Description": "The primary email address of the actor. May be absent if there is no email address associated with the actor.", "Type": "String", "Entity": null }, { "Name": "ActorCallerType", "Description": "The type of actor.", "Type": "String", "Entity": null }, { "Name": "ActorProfileId", "Description": "The unique Google Workspace profile ID of the actor. This value might be absent if the actor is not a Google Workspace user, or may be the number 105250506097979753968 which acts as a placeholder ID.", "Type": "String", "Entity": null }, { "Name": "ActorKey", "Description": "Only present when callerType is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts.", "Type": "String", "Entity": null }, { "Name": "ActorApplicationInfoOauthClientId", "Description": "OAuth client id of the third party application used to perform the action.", "Type": "String", "Entity": null }, { "Name": "ActorApplicationInfoApplicationName", "Description": "Name of the application used to perform the action.", "Type": "String", "Entity": null }, { "Name": "ActorApplicationInfoImpersonation", "Description": "Whether the application was impersonating a user.", "Type": "Boolean", "Entity": null }, { "Name": "ResourceDetails", "Description": "Details of the resource on which the action was performed.", "Type": "Object", "Entity": null }, { "Name": "EventType", "Description": "Type of event.", "Type": "String", "Entity": null }, { "Name": "EventName", "Description": "Name of the event.", "Type": "String", "Entity": null }, { "Name": "EventParameters", "Description": "JSON of all parameters that is associated with the Event.", "Type": "Object", "Entity": null }, { "Name": "AppName", "Description": "The application's display name as exposed by the associated service principal", "Type": "String", "Entity": null }, { "Name": "ApplicationName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ClientType", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "DeviceType", "Description": "Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer", "Type": "String", "Entity": null }, { "Name": "GroupEmail", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "NewValue", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "OldValue", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "OwnerEmail", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "EventResourceId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "EventResourceName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "SharedDriveId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "TargetDomain", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "UserEmail", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "Value", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "Visibility", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "String", "Entity": null }, { "Name": "BrowserVersion", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ChromeOrgUnitId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ContentHash", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ContentName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ContentRiskLevel", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ContentSize", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ContentTransferMethod", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ContentType", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": null }, { "Name": "DevicePlatform", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "DeviceUser", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "OrgUnitName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ProfileUserName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "ScanId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "TriggerDestination", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "TriggerSource", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "TriggerType", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "Url", "Description": "Full Url from email", "Type": "String", "Entity": null }, { "Name": "VirtualDeviceId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "AccountState", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Parameter to indicate the account state on the device.", "Type": "String", "Entity": null }, { "Name": "ActorIsCollaboratorAccount", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Indicates whether the actor is a collaborator account.", "Type": "Boolean", "Entity": null }, { "Name": "ApiKind", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The kind of API request made.", "Type": "String", "Entity": null }, { "Name": "ApplicationEdition", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The Google Workspace edition.", "Type": "String", "Entity": null }, { "Name": "Billable", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Whether this activity is billable.", "Type": "Boolean", "Entity": null }, { "Name": "CalendarId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Calendar Id of the relevant calendar in context of this action (for example the calendar that an event is on, or a calendar being subscribed to). Usually takes the form of the user's email address.", "Type": "String", "Entity": null }, { "Name": "ClientId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Client ID to which access has been granted / revoked.", "Type": "String", "Entity": null }, { "Name": "DestinationFolderId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The unique identifier of the destination folder.", "Type": "String", "Entity": null }, { "Name": "DestinationFolderTitle", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The title of the destination folder.", "Type": "String", "Entity": null }, { "Name": "DocId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The unique identifier of the document.", "Type": "String", "Entity": null }, { "Name": "DocTitle", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The title of the document.", "Type": "String", "Entity": null }, { "Name": "DocType", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The type of the document.", "Type": "String", "Entity": null }, { "Name": "DstUserUpn", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "DestUserUpn", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "DvcGuid", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The unique identifier of the device used.", "Type": "String", "Entity": null }, { "Name": "DvcInterfaceGuid", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The unique identifier of the device interface.", "Type": "String", "Entity": null }, { "Name": "DvcModelName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The model name of the device used.", "Type": "String", "Entity": null }, { "Name": "DvcModelNumber", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The model number of the device used.", "Type": "String", "Entity": null }, { "Name": "DvcType", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The type of the device used.", "Type": "String", "Entity": null }, { "Name": "EventEndTime", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The end time of the event.", "Type": "String", "Entity": null }, { "Name": "EventGuest", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The email address of the event guest.", "Type": "String", "Entity": null }, { "Name": "EventId", "Description": "Contains the unique event identifier", "Type": "String", "Entity": null }, { "Name": "EventMessage", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The name of the event.", "Type": "String", "Entity": null }, { "Name": "EventOriginalMessage", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. An array representing a chain of events, where each element is a sub-event.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The product associated with the event.", "Type": "String", "Entity": null }, { "Name": "EventResponseStatus", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.The response status of the event.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The start time of the event.", "Type": "String", "Entity": null }, { "Name": "EventTitle", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The title of the event.", "Type": "String", "Entity": null }, { "Name": "EventUid", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The unique identifier of the event.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The vendor of the event.", "Type": "String", "Entity": null }, { "Name": "GroupDomain", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The organizational unit (OU) name (path).", "Type": "String", "Entity": null }, { "Name": "IosVendorId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The vendor ID for iOS devices.", "Type": "String", "Entity": null }, { "Name": "IosVendorUID", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The vendor UID for iOS devices.", "Type": "String", "Entity": null }, { "Name": "IsSecondFactor", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Indicates if the event involves a second-factor authentication attempt.", "Type": "Boolean", "Entity": null }, { "Name": "IsSuspicious", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Indicates if the event is considered suspicious.", "Type": "Boolean", "Entity": null }, { "Name": "LastSyncAuditDate", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The date of the last synchronization audit.", "Type": "String", "Entity": null }, { "Name": "LoginChallengeMethod", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The method used for the login challenge.", "Type": "String", "Entity": null }, { "Name": "LoginChallengeStatus", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The status of the login challenge.", "Type": "String", "Entity": null }, { "Name": "LoginType", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The type of credentials used to attempt login.", "Type": "String", "Entity": null }, { "Name": "ModuleName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The new license for this product name.", "Type": "String", "Entity": null }, { "Name": "NotificationMessageId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The notification message Id.", "Type": "String", "Entity": null }, { "Name": "NotificationMethod", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The method used for the notification.", "Type": "String", "Entity": null }, { "Name": "NotificationType", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The type of notification.", "Type": "String", "Entity": null }, { "Name": "OldEventTitle", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. If the title of a calendar event has been changed, this is the previous title of the event.", "Type": "String", "Entity": null }, { "Name": "OldVisibility", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Old Visibility of Target File.", "Type": "String", "Entity": null }, { "Name": "OrganizerCalendarId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Calendar Id of this Event's organizer.", "Type": "String", "Entity": null }, { "Name": "OriginatingAppId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The Google Cloud Project ID of the application that performed the action.", "Type": "String", "Entity": null }, { "Name": "OsProperty", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Operating System properties.", "Type": "String", "Entity": null }, { "Name": "Owner", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The owner of the resource involved in the event.", "Type": "String", "Entity": null }, { "Name": "OwnerIsSharedDrive", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Indicates if the owner is a shared drive.", "Type": "Boolean", "Entity": null }, { "Name": "OwnerIsTeamDrive", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Indicates if the owner is a team drive.", "Type": "Boolean", "Entity": null }, { "Name": "PrimaryEvent", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Indicates if the event is the primary event in a chain of events.", "Type": "Boolean", "Entity": null }, { "Name": "ProcessName", "Description": "The name of the process", "Type": "String", "Entity": null }, { "Name": "RegisterPrivelege", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Device Policy app's privilege on the user's device.", "Type": "String", "Entity": null }, { "Name": "Resource_Id", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The unique resource Id of the device.", "Type": "String", "Entity": null }, { "Name": "RoleName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The unique name (ID) of the role assigned to the user.", "Type": "String", "Entity": null }, { "Name": "Scope", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The scope of the access request.", "Type": "String", "Entity": null }, { "Name": "ScopeData", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. Additional data related to the scope.", "Type": "String", "Entity": null }, { "Name": "SerialNumber", "Description": "Unique identifier for the certificate within a certificate authority's systems", "Type": "String", "Entity": null }, { "Name": "SourceFolderId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The ID of the source folder if the document is located in a shared drive.", "Type": "String", "Entity": null }, { "Name": "SourceFolderTitle", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The title of the source folder if the document is located in a shared drive.", "Type": "String", "Entity": null }, { "Name": "TargetCalendarId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The ID of the calendar targeted by the event.", "Type": "String", "Entity": null }, { "Name": "TargetUserDomain", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The domain targeted by the event.", "Type": "String", "Entity": null }, { "Name": "TargetUserName", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The user targeted by the event.", "Type": "String", "Entity": null }, { "Name": "TeamDriveId", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "UserAadid", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. This ID helps correlate events and activities to the correct Google Workspace tenant.", "Type": "String", "Entity": null }, { "Name": "UserAgentOriginal", "Description": "Deprecated. Use EventParameters column to find the value of this column instead. The user agent from the request that triggered this action.", "Type": "String", "Entity": null }, { "Name": "VisibilityChange", "Description": "Deprecated. Use EventParameters column to find the value of this column instead.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "HuntingBookmark", "TableSource": "sentinel", "Description": "Azure sentinel hunting bookmarks audit table", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of the log", "Type": "DateTime", "Entity": null }, { "Name": "BookmarkId", "Description": "Guid - the bookmark ARM resource name", "Type": "String", "Entity": null }, { "Name": "BookmarkName", "Description": "Bookmark name given by the user", "Type": "String", "Entity": null }, { "Name": "BookmarkType", "Description": "Can be used to mark bookmark origin - currently not used", "Type": "String", "Entity": null }, { "Name": "CreatedBy", "Description": "Identity of the user account who created the profile", "Type": "String", "Entity": null }, { "Name": "UpdatedBy", "Description": "JSON object with the user who last updated the bookmark, including: ObjectID, email and name", "Type": "String", "Entity": null }, { "Name": "CreatedTime", "Description": "The timestamp of bookmark first creation time", "Type": "DateTime", "Entity": null }, { "Name": "LastUpdatedTime", "Description": "The timestamp of bookmark last update time", "Type": "DateTime", "Entity": null }, { "Name": "EventTime", "Description": "Indicates the timestamp of when the event occurred", "Type": "DateTime", "Entity": null }, { "Name": "QueryText", "Description": "Original log analytics query text", "Type": "String", "Entity": null }, { "Name": "QueryResultRow", "Description": "JSON object with a single result row of the query", "Type": "String", "Entity": null }, { "Name": "QueryStartTime", "Description": "Query time range start time", "Type": "DateTime", "Entity": null }, { "Name": "QueryEndTime", "Description": "Query time range end time", "Type": "DateTime", "Entity": null }, { "Name": "Notes", "Description": "Notes provided by user", "Type": "String", "Entity": null }, { "Name": "Entities", "Description": "A serialized JSON of entities mapped by this bookmark", "Type": "String", "Entity": null }, { "Name": "SoftDeleted", "Description": "Was the bookmark deleted by user", "Type": "Boolean", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "IlumioInsights", "TableSource": "sentinel", "Description": "Ilumio Insights data connector provides the capability to ingest audit and event logs from the Ilumio Insight API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform and uses the Ilumio Insight API to fetch the events. The connector supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the record or event was logged.", "Type": "DateTime", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "AzureResourceId", "Description": "Unique identifier of the Azure resource associated with the device.", "Type": "String", "Entity": null }, { "Name": "ResourceInternalId", "Description": "Internal identifier for the monitored resource within Illumio.", "Type": "String", "Entity": null }, { "Name": "IllumioTenantId", "Description": "Tenant ID assigned by Illumio for multi-tenant environments.", "Type": "String", "Entity": null }, { "Name": "ResourceTenantId", "Description": "Unique identifier of the tenant of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceSubId", "Description": "Azure subscription ID that contains the resource.", "Type": "String", "Entity": null }, { "Name": "ResourceRegion", "Description": "The Azure region where the resource is deployed.", "Type": "String", "Entity": null }, { "Name": "ResourceVnetId", "Description": "Identifier for the Virtual Network (VNet) associated with the resource.", "Type": "String", "Entity": null }, { "Name": "IllumioUrl", "Description": "URL to view the record or associated details in the Illumio console.", "Type": "String", "Entity": null }, { "Name": "Service", "Description": "Name of the service the attacker attempted to use, if the attacker signed in using Kerberos or NTLM; for example: SMB, HTTP, cifs, SMB, host, ldap, SMB, krbtgt", "Type": "String", "Entity": null }, { "Name": "Port", "Description": "TCP port used during communication", "Type": "Int32", "Entity": null }, { "Name": "DestLabel", "Description": "Label or tag assigned to the destination entity.", "Type": "String", "Entity": null }, { "Name": "TotalReceivedBytes", "Description": "Total number of bytes received during the communication flow.", "Type": "Int32", "Entity": null }, { "Name": "DestCountry", "Description": "Country where the destination IP is located.", "Type": "String", "Entity": null }, { "Name": "DestPort", "Description": "Port number on the destination endpoint.", "Type": "Int32", "Entity": null }, { "Name": "SrcThreatLevel", "Description": "Threat level (e.g., Low, Medium, High) associated with the source IP.", "Type": "String", "Entity": null }, { "Name": "SrcCity", "Description": "City where the source IP is geolocated.", "Type": "String", "Entity": null }, { "Name": "DestThreatLevel", "Description": "Threat level associated with the destination IP.", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "Port number used by the source entity.", "Type": "Int32", "Entity": null }, { "Name": "VEScore", "Description": "Vulnerability exposure score indicating the risk level.", "Type": "Double", "Entity": null }, { "Name": "DestIsWellKnown", "Description": "Indicates if the destination is a known/trusted entity.", "Type": "Boolean", "Entity": null }, { "Name": "FlowCount", "Description": "Number of flows or sessions detected for this event.", "Type": "Int32", "Entity": null }, { "Name": "CvssSeverity", "Description": "CVSS (Common Vulnerability Scoring System) severity rating.", "Type": "String", "Entity": null }, { "Name": "SrcIP", "Description": "IP address of the source.", "Type": "String", "Entity": null }, { "Name": "DestIP", "Description": "IP address of the destination.", "Type": "String", "Entity": null }, { "Name": "UniqueId", "Description": "A unique identifier for the specific insight or event.", "Type": "String", "Entity": null }, { "Name": "DestCity", "Description": "City where the destination IP is geolocated.", "Type": "String", "Entity": null }, { "Name": "SrcIsWellKnown", "Description": "Indicates if the source is a known/trusted entity.", "Type": "Boolean", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "SrcLabel", "Description": "Label or tag assigned to the source entity.", "Type": "String", "Entity": null }, { "Name": "Proto", "Description": "Protocol used in the communication (e.g., TCP, UDP).", "Type": "String", "Entity": null }, { "Name": "TotalSentBytes", "Description": "Total number of bytes sent during the communication flow.", "Type": "Int32", "Entity": null }, { "Name": "SrcCountry", "Description": "Country where the source IP is located.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "LinuxAuditLog", "TableSource": "sentinel", "Description": "", "Schema": [ { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "ManagementGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeUploaded", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "ManagementGroupName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ExternalAgentIp", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "", "Type": "String", "Entity": null }, { "Name": "AuditID", "Description": "", "Type": "String", "Entity": null }, { "Name": "SerialNumber", "Description": "Unique identifier for the certificate within a certificate authority's systems", "Type": "String", "Entity": null }, { "Name": "uid", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "user", "Description": "", "Type": "String", "Entity": null }, { "Name": "node", "Description": "", "Type": "String", "Entity": null }, { "Name": "argc", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "a0", "Description": "", "Type": "String", "Entity": null }, { "Name": "a1", "Description": "", "Type": "String", "Entity": null }, { "Name": "a2", "Description": "", "Type": "String", "Entity": null }, { "Name": "a3", "Description": "", "Type": "String", "Entity": null }, { "Name": "a4", "Description": "", "Type": "String", "Entity": null }, { "Name": "a5", "Description": "", "Type": "String", "Entity": null }, { "Name": "a6", "Description": "", "Type": "String", "Entity": null }, { "Name": "a7", "Description": "", "Type": "String", "Entity": null }, { "Name": "a8", "Description": "", "Type": "String", "Entity": null }, { "Name": "a9", "Description": "", "Type": "String", "Entity": null }, { "Name": "auid", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "audit_user", "Description": "", "Type": "String", "Entity": null }, { "Name": "euid", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "op", "Description": "", "Type": "String", "Entity": null }, { "Name": "effective_user", "Description": "", "Type": "String", "Entity": null }, { "Name": "acct", "Description": "", "Type": "String", "Entity": null }, { "Name": "addr", "Description": "", "Type": "String", "Entity": null }, { "Name": "arch", "Description": "", "Type": "String", "Entity": null }, { "Name": "cmd", "Description": "", "Type": "String", "Entity": null }, { "Name": "comm", "Description": "", "Type": "String", "Entity": null }, { "Name": "cwd", "Description": "", "Type": "String", "Entity": null }, { "Name": "data", "Description": "", "Type": "String", "Entity": null }, { "Name": "exe", "Description": "", "Type": "String", "Entity": null }, { "Name": "exit", "Description": "", "Type": "String", "Entity": null }, { "Name": "family", "Description": "", "Type": "String", "Entity": null }, { "Name": "filetype", "Description": "", "Type": "String", "Entity": null }, { "Name": "gid", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "group", "Description": "", "Type": "String", "Entity": null }, { "Name": "egid", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "effective_group", "Description": "", "Type": "String", "Entity": null }, { "Name": "hostname", "Description": "", "Type": "String", "Entity": null }, { "Name": "icmptype", "Description": "", "Type": "String", "Entity": null }, { "Name": "key", "Description": "", "Type": "String", "Entity": null }, { "Name": "name", "Description": "", "Type": "String", "Entity": null }, { "Name": "path", "Description": "", "Type": "String", "Entity": null }, { "Name": "pid", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "ppid", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "res", "Description": "", "Type": "String", "Entity": null }, { "Name": "result", "Description": "", "Type": "String", "Entity": null }, { "Name": "ses", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "success", "Description": "", "Type": "String", "Entity": null }, { "Name": "syscall", "Description": "", "Type": "String", "Entity": null }, { "Name": "terminal", "Description": "", "Type": "String", "Entity": null }, { "Name": "tty", "Description": "", "Type": "String", "Entity": null }, { "Name": "vm", "Description": "", "Type": "String", "Entity": null }, { "Name": "RawRecord", "Description": "", "Type": "String", "Entity": null }, { "Name": "ComputerEnvironment", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "McasShadowItReporting", "TableSource": "sentinel", "Description": "McasShadowItReporting", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "StreamName", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineName", "Description": "", "Type": "String", "Entity": null }, { "Name": "MachineId", "Description": "Unique identifier for the machine in the service", "Type": "String", "Entity": null }, { "Name": "TotalEvents", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "BlockedEvents", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "UploadedBytes", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "TotalBytes", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "DownloadedBytes", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "IpAddress", "Description": "IP address that the attacker attempted to access", "Type": "String", "Entity": null }, { "Name": "UserName", "Description": "", "Type": "String", "Entity": null }, { "Name": "EnrichedUserName", "Description": "", "Type": "String", "Entity": null }, { "Name": "AppName", "Description": "The application's display name as exposed by the associated service principal", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "", "Type": "String", "Entity": null }, { "Name": "AppInstance", "Description": "", "Type": "String", "Entity": null }, { "Name": "AppCategory", "Description": "", "Type": "String", "Entity": null }, { "Name": "AppTags", "Description": "", "Type": "Object", "Entity": null }, { "Name": "AppScore", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "Date", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "RawUserName", "Description": "", "Type": "String", "Entity": null }, { "Name": "RichUserName", "Description": "", "Type": "String", "Entity": null }, { "Name": "AadTenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "MicrosoftGraphActivityLogs", "TableSource": "", "Description": "Microsoft Graph Activity Logs provide details of API requests made to Microsoft Graph for resources in the tenant.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time the request was received.", "Type": "DateTime", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "OperationId", "Description": "Identifier for a batch of requests; the same identifier is used for all requests in a batch but if requests are non-batched, the identifier is unique per request", "Type": "String", "Entity": null }, { "Name": "ClientRequestId", "Description": "Identifier for the client request sent; if none is available, the operation identifier is used instead", "Type": "String", "Entity": null }, { "Name": "ApiVersion", "Description": "The API version of the event", "Type": "String", "Entity": null }, { "Name": "RequestMethod", "Description": "HTTP method of the request", "Type": "String", "Entity": null }, { "Name": "ResponseStatusCode", "Description": "HTTP response status code for the request", "Type": "Int32", "Entity": null }, { "Name": "AadTenantId", "Description": "The Azure AD tenant ID.", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "RequestUri", "Description": "Uniform resource identifier (URI) of the request", "Type": "String", "Entity": null }, { "Name": "DurationMs", "Description": "The duration of the request in milliseconds.", "Type": "Int32", "Entity": null }, { "Name": "ResponseSizeBytes", "Description": "The size of the response in Bytes.", "Type": "Int32", "Entity": null }, { "Name": "SignInActivityId", "Description": "The identifier representing the sign-in activitys.", "Type": "String", "Entity": null }, { "Name": "Roles", "Description": "The roles in token claims.", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "UniqueTokenId", "Description": "A unique identifier for the token passed during sign-in. This identifier is used to correlate the sign-in with the token request.", "Type": "String", "Entity": null }, { "Name": "TokenIssuedAt", "Description": "The timestamp the token was issued at.", "Type": "DateTime", "Entity": null }, { "Name": "AppId", "Description": "The identifier for the application.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "The identifier of the user making the request.", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "Scopes", "Description": "Scopes in token claims", "Type": "String", "Entity": null }, { "Name": "IdentityProvider", "Description": "Identity provider that authenticated the subject of the token", "Type": "String", "Entity": null }, { "Name": "ClientAuthMethod", "Description": "Indicates how the client was authenticated. For a public client, the value is 0. If client ID and client secret are used, the value is 1. If a client certificate was used for authentication, the value is 2.", "Type": "Int32", "Entity": null }, { "Name": "Wids", "Description": "Denotes the tenant-wide roles assigned to this user.", "Type": "String", "Entity": null }, { "Name": "ATContent", "Description": "Reserved for future use.", "Type": "String", "Entity": null }, { "Name": "ATContentH", "Description": "Reserved for future use.", "Type": "String", "Entity": null }, { "Name": "ATContentP", "Description": "Reserved for future use.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "MicrosoftPurviewInformationProtection", "TableSource": "sentinel", "Description": "Microsoft Purview Information Protection audit logs.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record.", "Type": "Int32", "Entity": null }, { "Name": "RecordTypeName", "Description": "The record type name.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of user that performed the operation.", "Type": "String", "Entity": null }, { "Name": "UserKey", "Description": "An alternative ID for the user identified in the UserId property. This property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "ResultStatus", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed. For Exchange admin activity, the value is either True or False.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged.", "Type": "String", "Entity": null }, { "Name": "ClientIP", "Description": "The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format.", "Type": "String", "Entity": null }, { "Name": "Scope", "Description": "Was this event created by a hosted O365 service or an on-premises server.", "Type": "String", "Entity": null }, { "Name": "AppAccessContext", "Description": "The application context for the user or service principal that performed the action.", "Type": "Object", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "Platform", "Description": "The platform that provided the information about the agents; possible values: Copilot Studio", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": null }, { "Name": "EmailInfo", "Description": "The information required when the internalTarget is an email.", "Type": "Object", "Entity": null }, { "Name": "CurrentProtectionTypeName", "Description": "The type of protection applied.", "Type": "String", "Entity": null }, { "Name": "PreviousProtectionTypeName", "Description": "Previous protection type.", "Type": "String", "Entity": null }, { "Name": "ContentType", "Description": "Content type.", "Type": "String", "Entity": null }, { "Name": "TargetLocation", "Description": "The location of the document with respect to the user' device.", "Type": "String", "Entity": null }, { "Name": "IrmContentId", "Description": "The unique ID used for identifying the encrypted document after the operation is complete.", "Type": "String", "Entity": null }, { "Name": "SensitivityLabelId", "Description": "The current Microsoft Information Protection sensitivity label ID associated with the item", "Type": "String", "Entity": null }, { "Name": "SensitivityLabelOwnerEmail", "Description": "The email address of the owner of the sensitivity label.", "Type": "String", "Entity": null }, { "Name": "OldSensitivityLabelId", "Description": "The identifier of the sensitivity label previously applied to the document before the operation to change/remove the label was triggered.", "Type": "String", "Entity": null }, { "Name": "OldSensitivityLabelOwnerEmail", "Description": "The email address of the owner of the old sensitivity label.", "Type": "String", "Entity": null }, { "Name": "SensitivityLabelPolicyId", "Description": "The identifier for the sensitivity labeling policy that was matched based on the content of the document.", "Type": "String", "Entity": null }, { "Name": "LabelEventType", "Description": "The label operation.", "Type": "String", "Entity": null }, { "Name": "ActionSource", "Description": "The source of the label action.", "Type": "String", "Entity": null }, { "Name": "ActionSourceDetail", "Description": "More details about the source of the label action.", "Type": "String", "Entity": null }, { "Name": "JustificationText", "Description": "The justification to be provided, when configured by the admin in the sensitivity label policy, only when the sensitivity label is downgraded or removed by the user.", "Type": "String", "Entity": null }, { "Name": "SensitiveInfoTypeData", "Description": "Azure Information Protection - sensitive information types.", "Type": "Object", "Entity": null }, { "Name": "ProtectionEventData", "Description": "Azure Information Protection - protection event data.", "Type": "Object", "Entity": null }, { "Name": "Common", "Description": "Azure Information Protection - common event data.", "Type": "Object", "Entity": null }, { "Name": "DataState", "Description": "Azure Information Protection - data state.", "Type": "String", "Entity": null }, { "Name": "ProtectionEventTypeName", "Description": "Protection event type name.", "Type": "String", "Entity": null }, { "Name": "Sender", "Description": "The email address of the sender.", "Type": "String", "Entity": null }, { "Name": "Receivers", "Description": "The email addresses of the receivers.", "Type": "Object", "Entity": null }, { "Name": "ItemName", "Description": "The item name.", "Type": "String", "Entity": null }, { "Name": "LabelName", "Description": "The label name applied to the item.", "Type": "String", "Entity": null }, { "Name": "LabelAction", "Description": "The action applied by the label.", "Type": "String", "Entity": null }, { "Name": "LabelAppliedDateTime", "Description": "The date and time the label was applied.", "Type": "DateTime", "Entity": null }, { "Name": "ApplicationMode", "Description": "The label application mode, how the label was applied.", "Type": "String", "Entity": null }, { "Name": "ExchangeMetaData", "Description": "Exchange auto labeling metadata.", "Type": "Object", "Entity": null }, { "Name": "ConditionMatch", "Description": "The condition match that triggered the auto labeling.", "Type": "Object", "Entity": null }, { "Name": "RuleActions", "Description": "Actions defined by the rules.", "Type": "Object", "Entity": null }, { "Name": "WorkLoadItemId", "Description": "The workload item id.", "Type": "String", "Entity": null }, { "Name": "OverriddenActions", "Description": "Actions that were overridden by the rule actions.", "Type": "Object", "Entity": null }, { "Name": "SensitiveInfoDetectionIsIncluded", "Description": "Determines if sensitive info detection is included.", "Type": "Boolean", "Entity": null }, { "Name": "IsViewableByExternalUsers", "Description": "Is viewable by external users.", "Type": "Boolean", "Entity": null }, { "Name": "OverRideType", "Description": "Override type.", "Type": "String", "Entity": null }, { "Name": "ItemCreationTime", "Description": "The date and time the item was created.", "Type": "DateTime", "Entity": null }, { "Name": "ItemLastModifiedTime", "Description": "The date and time the item was last modified.", "Type": "DateTime", "Entity": null }, { "Name": "ItemSize", "Description": "The item size.", "Type": "String", "Entity": null }, { "Name": "OverRideReason", "Description": "The reason the sensitivity label was overridden.", "Type": "String", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ScopedLocationId", "Description": "The address that triggered the policy match.", "Type": "String", "Entity": null }, { "Name": "MachineName", "Description": "The machine name.", "Type": "String", "Entity": null }, { "Name": "PolicyId", "Description": "Unique identifier for the policy", "Type": "String", "Entity": null }, { "Name": "PolicyName", "Description": "Name of the policy", "Type": "String", "Entity": null }, { "Name": "PolicyVersion", "Description": "Version of the policy", "Type": "String", "Entity": null }, { "Name": "ExecutionRuleId", "Description": "The ID of the rule that was executed.", "Type": "String", "Entity": null }, { "Name": "ExecutionRuleName", "Description": "The name of the rule that was executed.", "Type": "String", "Entity": null }, { "Name": "ExecutionRuleVersion", "Description": "The version of the rule that was executed.", "Type": "String", "Entity": null }, { "Name": "RuleMode", "Description": "The current mode of the rule.", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "LabelVersion", "Description": "The label version applied by the auto labeling policy.", "Type": "String", "Entity": null }, { "Name": "MgtRuleId", "Description": "Management rule ID.", "Type": "String", "Entity": null }, { "Name": "SharePointMetaData", "Description": "SharePoint auto labeling metadata.", "Type": "Object", "Entity": null }, { "Name": "CurrentProtectionType", "Description": "Current protection event information.", "Type": "Object", "Entity": null }, { "Name": "PreviousProtectionType", "Description": "Previous protection event information.", "Type": "Object", "Entity": null }, { "Name": "SensitivityLabelEventFailureData", "Description": "Sensitivity Label Event Failure Data", "Type": "Object", "Entity": null }, { "Name": "AutoSensitivityLabelPolicyInfo", "Description": "Auto Sensitivity Label Policy Info", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "NetworkSessions", "TableSource": "sentinel", "Description": "Network connections or sessions such as those logged by firewalls, Wire Data, NSG, Netflow, proxy systems and web security gateways.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "Type of event being collected.", "Type": "String", "Entity": null }, { "Name": "EventSubType", "Description": "Additional description of type if applicable.", "Type": "String", "Entity": null }, { "Name": "EventCount", "Description": "The number of events aggregated, if applicable.", "Type": "Int32", "Entity": null }, { "Name": "EventEndTime", "Description": "The time in which the event ended.", "Type": "DateTime", "Entity": null }, { "Name": "EventMessage", "Description": "A general message or description, either included in, or generated from the record.", "Type": "String", "Entity": null }, { "Name": "DvcIpAddr", "Description": "The IP address of the device generating the record.", "Type": "String", "Entity": null }, { "Name": "DvcMacAddr", "Description": "The MAC address of the network interface of the reporting device from which the event was sent.", "Type": "String", "Entity": null }, { "Name": "DvcHostname", "Description": "The device name of the device generating the message.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventProductVersion", "Description": "The version of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventResourceId", "Description": "The resource ID of the device generating the message.", "Type": "String", "Entity": null }, { "Name": "EventReportUrl", "Description": "A link to the full report created by the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The result reported for the activity. Empty value when not applicable.", "Type": "String", "Entity": null }, { "Name": "EventResultDetails", "Description": "Reason for the result reported in EventResult", "Type": "String", "Entity": null }, { "Name": "EventSchemaVersion", "Description": "Azure Sentinel Schema Version.", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "If the activity reported has a security impact, denotes the severity of the impact.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "The record ID from the reporting device.", "Type": "String", "Entity": null }, { "Name": "EventStartTime", "Description": "The time in which the event stated.", "Type": "DateTime", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the event occurred, as reported by reporting source.", "Type": "DateTime", "Entity": null }, { "Name": "EventTimeIngested", "Description": "The time the event was ingested to Azure Sentinel. Will be added by Azure Sentinel.", "Type": "DateTime", "Entity": null }, { "Name": "EventUid", "Description": "Unique identifier used by Sentinel to mark a row.", "Type": "String", "Entity": null }, { "Name": "NetworkApplicationProtocol", "Description": "The application layer protocol used by the connection or session.", "Type": "String", "Entity": null }, { "Name": "DstBytes", "Description": "The number of bytes sent from the destination to the source for the connection or session.", "Type": "Int64", "Entity": null }, { "Name": "SrcBytes", "Description": "The number of bytes sent from the source to the destination for the connection or session.", "Type": "Int64", "Entity": null }, { "Name": "NetworkBytes", "Description": "Number of bytes sent in both directions. If both BytesReceived and BytesSent exist, BytesTotal should equal their sum.", "Type": "Int64", "Entity": null }, { "Name": "NetworkDirection", "Description": "The direction the connection or session, into or out of the organization.", "Type": "String", "Entity": null }, { "Name": "DstGeoCity", "Description": "The city associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "DstDvcHostname", "Description": "The device name of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstDvcFqdn", "Description": "The fully qualified domain name of the host where the log was created.", "Type": "String", "Entity": null }, { "Name": "DstDomainHostname", "Description": "The domain of the destination host.", "Type": "String", "Entity": null }, { "Name": "DstInterfaceName", "Description": "The network interface used for the connection or session by the destination device.", "Type": "String", "Entity": null }, { "Name": "DstInterfaceGuid", "Description": "GUID of the network interface which was used for authentication request.", "Type": "String", "Entity": null }, { "Name": "DstIpAddr", "Description": "The IP address of the connection or session destination.", "Type": "String", "Entity": null }, { "Name": "DstDvcIpAddr", "Description": "The destination IP address of a device that is not directly associated with the network packet.", "Type": "String", "Entity": null }, { "Name": "DstGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the destination IP address.", "Type": "Double", "Entity": null }, { "Name": "DstMacAddr", "Description": "The MAC address of the network interface at which the connection or session terminated.", "Type": "String", "Entity": null }, { "Name": "DstDvcMacAddr", "Description": "The destination MAC address of a device that is not directly associated with the network packet.", "Type": "String", "Entity": null }, { "Name": "DstDvcDomain", "Description": "The Domain of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstPortNumber", "Description": "The destination IP port.", "Type": "Int32", "Entity": null }, { "Name": "DstGeoRegion", "Description": "The region within a country associated with the destination IP address.", "Type": "String", "Entity": null }, { "Name": "DstResourceId", "Description": "The resource Id of the destination device.", "Type": "String", "Entity": null }, { "Name": "DstNatIpAddr", "Description": "If reported by an intermediary NAT device such as a firewall, the IP address used by the NAT device for communication with the source.", "Type": "String", "Entity": null }, { "Name": "DstNatPortNumber", "Description": "If reported by an intermediary NAT device such as a firewall, the port used by the NAT device for communication with the source.", "Type": "Int32", "Entity": null }, { "Name": "DstUserSid", "Description": "The User ID of the identity associated with the session's destination. Typically, the identity used to authenticate a server.", "Type": "String", "Entity": null }, { "Name": "DstUserAadId", "Description": "The Azure AD account object ID of the user at the destination end of the session.", "Type": "String", "Entity": null }, { "Name": "DstUserName", "Description": "The username of the identity associated with the session’s destination.", "Type": "String", "Entity": null }, { "Name": "DstUserUpn", "Description": "The UPN of the identity associated with the session’s destination.", "Type": "String", "Entity": null }, { "Name": "DstUserDomain", "Description": "The domain or computer name of the account at the destination of the session.", "Type": "String", "Entity": null }, { "Name": "DstZone", "Description": "The network zone of the destination, as defined by the reporting device.", "Type": "String", "Entity": null }, { "Name": "DstGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the destination IP address", "Type": "Double", "Entity": null }, { "Name": "DvcAction", "Description": "If reported by an intermediary device such as a firewall, the action taken by device.", "Type": "String", "Entity": null }, { "Name": "DvcInboundInterface", "Description": "If reported by an intermediary device such as a firewall, the network interface used by it for the connection to the source device.", "Type": "String", "Entity": null }, { "Name": "DvcOutboundInterface", "Description": "If reported by an intermediary device such as a firewall, the network interface used by it for the connection to the destination device.", "Type": "String", "Entity": null }, { "Name": "NetworkDuration", "Description": "The amount of time, in millisecond, for the completion of the network session or connection.", "Type": "Int32", "Entity": null }, { "Name": "NetworkIcmpCode", "Description": "For an ICMP message, ICMP message type numeric value (RFC 2780 or RFC 4443).", "Type": "Int32", "Entity": null }, { "Name": "NetworkIcmpType", "Description": "For an ICMP message, ICMP message type text representation (RFC 2780 or RFC 4443).", "Type": "String", "Entity": null }, { "Name": "DstPackets", "Description": "The number of packets sent from the destination to the source for the connection or session. The meaning of a packet is defined by the reporting device.", "Type": "Int64", "Entity": null }, { "Name": "SrcPackets", "Description": "The number of packets sent from the source to the destination for the connection or session. The meaning of a packet is defined by the reporting device.", "Type": "Int64", "Entity": null }, { "Name": "NetworkPackets", "Description": "Number of packets sent in both directions. If both PacketsReceived and PacketsSent exist, BytesTotal should equal their sum.", "Type": "Int64", "Entity": null }, { "Name": "HttpRequestTime", "Description": "The amount of time it took to send the request to the server, if applicable.", "Type": "Int32", "Entity": null }, { "Name": "HttpResponseTime", "Description": "The amount of time it took to receive a response in the server, if applicable.", "Type": "Int32", "Entity": null }, { "Name": "NetworkRuleName", "Description": "The name or ID of the rule by which DeviceAction was decided upon.", "Type": "String", "Entity": null }, { "Name": "NetworkRuleNumber", "Description": "Matched rule number.", "Type": "Int32", "Entity": null }, { "Name": "NetworkSessionId", "Description": "The session identifier as reported by the reporting device.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcDvcHostname", "Description": "The device name of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcFqdn", "Description": "The fully qualified domain name of the host where the log was created.", "Type": "String", "Entity": null }, { "Name": "SrcDvcDomain", "Description": "Domain of the device from which session was initiated.", "Type": "String", "Entity": null }, { "Name": "SrcDvcOs", "Description": "The OS of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcModelName", "Description": "The model of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcModelNumber", "Description": "The model number of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcType", "Description": "The type of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcInterfaceName", "Description": "The network interface used for the connection or session by the source device.", "Type": "String", "Entity": null }, { "Name": "SrcInterfaceGuid", "Description": "GUID of the network interface used.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address from which the connection or session originated.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIpAddr", "Description": "The source IP address of a device not directly associated with the network packet (collected by a provider or explicitly calculated).", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongitude", "Description": "The longitude of the geographical coordinate associated with the source IP address.", "Type": "Double", "Entity": null }, { "Name": "SrcMacAddr", "Description": "The MAC address of the network interface from which the connection od session originated.", "Type": "String", "Entity": null }, { "Name": "SrcDvcMacAddr", "Description": "The source MAC address of a device that is not directly associated with the network packet.", "Type": "String", "Entity": null }, { "Name": "SrcPortNumber", "Description": "The IP port from which the connection originated. May not be relevant for a session comprising multiple connections.", "Type": "Int32", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region within a country associated with the source IP address.", "Type": "String", "Entity": null }, { "Name": "SrcResourceId", "Description": "The resource ID of the device generating the message.", "Type": "String", "Entity": null }, { "Name": "SrcNatIpAddr", "Description": "If reported by an intermediary NAT device such as a firewall, the IP address used by the NAT device for communication with the destination.", "Type": "String", "Entity": null }, { "Name": "SrcNatPortNumber", "Description": "If reported by an intermediary NAT device such as a firewall, the port used by the NAT device for communication with the destination.", "Type": "Int32", "Entity": null }, { "Name": "SrcUserSid", "Description": "The user ID of the identity associated with the sessions source. Typically, user performing an action on the client.", "Type": "String", "Entity": null }, { "Name": "SrcUserAadId", "Description": "The Azure AD account object ID of the user at the source end of the session.", "Type": "String", "Entity": null }, { "Name": "SrcUserName", "Description": "The username of the identity associated with the sessions source. Typically, user performing an action on the client.", "Type": "String", "Entity": null }, { "Name": "SrcUserUpn", "Description": "UPN of the account initiating the session.", "Type": "String", "Entity": null }, { "Name": "SrcUserDomain", "Description": "The domain for the account initiating the session.", "Type": "String", "Entity": null }, { "Name": "SrcZone", "Description": "The network zone of the source, as defined by the reporting device.", "Type": "String", "Entity": null }, { "Name": "NetworkProtocol", "Description": "The IP protocol used by the connection or session. Typically, TCP, UDP or ICMP.", "Type": "String", "Entity": null }, { "Name": "CloudAppName", "Description": "The name of the destination application for an HTTP application as identified by a proxy.", "Type": "String", "Entity": null }, { "Name": "CloudAppId", "Description": "The ID of the destination application for an HTTP application as identified by a proxy. This value is usually specific to the proxy used.", "Type": "String", "Entity": null }, { "Name": "CloudAppOperation", "Description": "The operation the user performed in the context of the destination application for an HTTP application as identified by a proxy. This value is usually specific to the proxy used.", "Type": "String", "Entity": null }, { "Name": "CloudAppRiskLevel", "Description": "The risk level associated with an HTTP application as identified by a proxy. This value is usually specific to the proxy used.", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FilePath", "Description": "The full path, including file name, of the file.", "Type": "String", "Entity": null }, { "Name": "FileHashMd5", "Description": "The MD5 hash value of the file transmitted over the network connections for protocols.", "Type": "String", "Entity": null }, { "Name": "FileHashSha1", "Description": "The SHA1 hash value of the file transmitted over the network connections for protocols.", "Type": "String", "Entity": null }, { "Name": "FileHashSha256", "Description": "The SHA256 hash value of the file transmitted over the network connections for protocols.", "Type": "String", "Entity": null }, { "Name": "FileHashSha512", "Description": "The SHA512 hash value of the file transmitted over the network connections for protocols.", "Type": "String", "Entity": null }, { "Name": "FileExtension", "Description": "File extension of the attachment.", "Type": "String", "Entity": null }, { "Name": "FileMimeType", "Description": "The MIME type of the file transmitted over the network connections for protocols such as FTP and HTTP.", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int32", "Entity": null }, { "Name": "HttpVersion", "Description": "The HTTP Request Version for HTTP/HTTPS network connections.", "Type": "String", "Entity": null }, { "Name": "HttpRequestMethod", "Description": "The HTTP Method for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "HttpStatusCode", "Description": "The HTTP Status Code for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "HttpContentType", "Description": "The HTTP Response content type header for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "HttpReferrerOriginal", "Description": "The HTTP referrer header for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "HttpUserAgentOriginal", "Description": "The HTTP user agent header for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "HttpRequestXff", "Description": "The HTTP X-Forwarded-For header for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "UrlCategory", "Description": "The defined grouping of a URL (or could be just based on the domain in the URL) related to what it is (i.e.: adult, news, advertising, parked domains, etc.).", "Type": "String", "Entity": null }, { "Name": "UrlOriginal", "Description": "The HTTP request URL for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "UrlHostname", "Description": "The domain part of an HTTP request URL for HTTP/HTTPS network sessions.", "Type": "String", "Entity": null }, { "Name": "ThreatCategory", "Description": "The category of a threat identified by a security system such as Web Security Gateway of an IPS and is associated with this network session.", "Type": "String", "Entity": null }, { "Name": "ThreatId", "Description": "The ID of a threat identified by a security system such as Web Security Gateway of an IPS and is associated with this network session.", "Type": "String", "Entity": null }, { "Name": "ThreatName", "Description": "Detection name for any malware or other threats found", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "OAuthAppInfo", "TableSource": "defender", "Description": "Information about Microsoft 365-connected OAuth applications in the organization covered by Microsoft Cloud App Security.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "ReportId", "Description": "Unique identifier for the event", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time (UTC) when the record was generated", "Type": "DateTime", "Entity": null }, { "Name": "OAuthAppId", "Description": "A unique identifier that's assigned to an application when it’s registered to Entra with OAuth 2.0.", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "AppName", "Description": "The application's display name as exposed by the associated service principal", "Type": "String", "Entity": null }, { "Name": "AddedOnTime", "Description": "Date and time when the application was registered", "Type": "DateTime", "Entity": null }, { "Name": "LastModifiedTime", "Description": "Date and time the item or related metadata was last modified", "Type": "DateTime", "Entity": null }, { "Name": "AppStatus", "Description": "Status of the app; can be: Enabled, DisabledByMicrosoft, DisabledByAppGovernancePolicy, DisabledByUser, Deleted (information for apps with Deleted status is only available for 30 days since the app was deleted)", "Type": "String", "Entity": null }, { "Name": "VerifiedPublisher", "Description": "Specifies details about the verified publisher of the application which this service principal represents. It includes information such as: DisplayName, VerifiedPublisherId, AddedDateTime", "Type": "Object", "Entity": null }, { "Name": "PrivilegeLevel", "Description": "The privilege level of the app based on the highest classified permission granted to the app", "Type": "String", "Entity": null }, { "Name": "Permissions", "Description": "Contains an array of permission objects; each permission object includes PermissionName, TargetAppId, TargetAppDisplayName, PermissionType, PrivilegeLevel, UsageStatus", "Type": "Object", "Entity": null }, { "Name": "ConsentedUsersCount", "Description": "Count of users who have consented to the app; this information is only available when the app is not admin consented", "Type": "Int32", "Entity": null }, { "Name": "IsAdminConsented", "Description": "Value is True if a user has provided admin consent to the app on behalf of all the users in the org, otherwise the value is False", "Type": "Boolean", "Entity": null }, { "Name": "AppOrigin", "Description": "Specifies whether was the app is internal to the organization or registered in an external tenant", "Type": "String", "Entity": null }, { "Name": "LastUsedTime", "Description": "Date and time when the app was last used", "Type": "DateTime", "Entity": null }, { "Name": "AppOwnerTenantId", "Description": "Specifies the ID of the tenant where the app was registered", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "Timestamp", "Description": "Date and time when the record was generated", "Type": "DateTime", "Entity": null } ], "TableType": "Regular", "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "HasData": true, "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null }, { "Name": "OfficeActivity", "TableSource": "sentinel", "Description": "Audit logs for Office 365 tenants collected by Azure Sentinel. Including Exchange, SharePoint and Teams logs.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "UserDomain", "Description": "The domain of the user", "Type": "String", "Entity": null }, { "Name": "Activity", "Description": "Sensor activity", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in Coordinated Universal Time (UTC) when the user performed the activity", "Type": "DateTime", "Entity": null }, { "Name": "Operation", "Description": "Name of the admin activity", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of user that performed the operation. See the UserType table for details on the types of users", "Type": "String", "Entity": null }, { "Name": "UserKey", "Description": "An alternative ID for the user identified in the UserId property", "Type": "String", "Entity": null }, { "Name": "OfficeWorkload", "Description": "The Office 365 service where the activity occurred", "Type": "String", "Entity": null }, { "Name": "ResultStatus", "Description": "Indicates whether the action (specified in the Operation property) was successful or not", "Type": "String", "Entity": null }, { "Name": "ResultReasonType", "Description": "Reason for the result reported in ResultType", "Type": "String", "Entity": null }, { "Name": "OfficeObjectId", "Description": "For SharePoint and OneDrive for Business activity", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged", "Type": "String", "Entity": null }, { "Name": "ClientIP", "Description": "The IP address of the device that was used when the activity was logged", "Type": "String", "Entity": null }, { "Name": "Site_", "Description": "The GUID of the site where the file or folder accessed by the user is located", "Type": "String", "Entity": null }, { "Name": "ItemType", "Description": "The type of object that was accessed or modified. See the ItemType table for details on the types of objects", "Type": "String", "Entity": null }, { "Name": "EventSource", "Description": "Identifies that an event occurred in SharePoint. Possible values are SharePoint or ObjectModel", "Type": "String", "Entity": null }, { "Name": "Source_Name", "Description": "The entity that triggered the audited operation. Possible values are SharePoint or ObjectModel", "Type": "String", "Entity": null }, { "Name": "MachineDomainInfo", "Description": "Information about device sync operations", "Type": "String", "Entity": null }, { "Name": "MachineId", "Description": "Unique identifier for the machine in the service", "Type": "String", "Entity": null }, { "Name": "Site_Url", "Description": "The URL of the site where the file or folder accessed by the user is located", "Type": "String", "Entity": null }, { "Name": "SourceRelativeUrl", "Description": "The URL of the folder that contains the file accessed by the user", "Type": "String", "Entity": null }, { "Name": "SourceFileName", "Description": "The name of the file or folder accessed by the user", "Type": "String", "Entity": null }, { "Name": "SourceFileExtension", "Description": "The file extension of the file that was accessed by the user", "Type": "String", "Entity": null }, { "Name": "DestinationRelativeUrl", "Description": "The URL of the destination folder where a file is copied or moved", "Type": "String", "Entity": null }, { "Name": "DestinationFileName", "Description": "The name of the file that is copied or moved", "Type": "String", "Entity": null }, { "Name": "DestinationFileExtension", "Description": "The file extension of a file that is copied or moved", "Type": "String", "Entity": null }, { "Name": "UserSharedWith", "Description": "The user that a resource was shared with", "Type": "String", "Entity": null }, { "Name": "SharingType", "Description": "The type of sharing permissions that were assigned to the user that the resource was shared with. This user is identified by the UserSharedWith parameter", "Type": "String", "Entity": null }, { "Name": "CustomEvent", "Description": "Optional string for custom events", "Type": "String", "Entity": null }, { "Name": "Event_Data", "Description": "Optional payload for custom events", "Type": "String", "Entity": null }, { "Name": "ModifiedObjectResolvedName", "Description": "This is the user friendly name of the object that was modified by the cmdlet", "Type": "String", "Entity": null }, { "Name": "Parameters", "Description": "The name and value for all parameters that were used with the cmdlet that is identified in the Operations property", "Type": "String", "Entity": null }, { "Name": "ExternalAccess", "Description": "Specifies whether the cmdlet was run by a user in your organization", "Type": "String", "Entity": null }, { "Name": "OriginatingServer", "Description": "The name of the server from which the cmdlet was executed", "Type": "String", "Entity": null }, { "Name": "OrganizationName", "Description": "The name of the tenant", "Type": "String", "Entity": null }, { "Name": "Logon_Type", "Description": "Indicates the type of user who accessed the mailbox and performed the operation that was logged", "Type": "String", "Entity": null }, { "Name": "InternalLogonType", "Description": "Reserved for internal use", "Type": "Int32", "Entity": null }, { "Name": "MailboxGuid", "Description": "The Exchange GUID of the mailbox that was accessed", "Type": "String", "Entity": null }, { "Name": "MailboxOwnerUPN", "Description": "The email address of the person who owns the mailbox that was accessed", "Type": "String", "Entity": null }, { "Name": "MailboxOwnerSid", "Description": "The SID of the mailbox owner", "Type": "String", "Entity": null }, { "Name": "MailboxOwnerMasterAccountSid", "Description": "Mailbox owner account's master account SID", "Type": "String", "Entity": null }, { "Name": "LogonUserSid", "Description": "The SID of the user who performed the operation", "Type": "String", "Entity": null }, { "Name": "LogonUserDisplayName", "Description": "The user-friendly name of the user who performed the operation", "Type": "String", "Entity": null }, { "Name": "ClientInfoString", "Description": "Information about the email client that was used to perform the operation", "Type": "String", "Entity": null }, { "Name": "Client_IPAddress", "Description": "The IP address of the device that was used when the operation was logged", "Type": "String", "Entity": null }, { "Name": "ClientMachineName", "Description": "The machine name that hosts the Outlook client", "Type": "String", "Entity": null }, { "Name": "ClientProcessName", "Description": "The email client that was used to access the mailbox", "Type": "String", "Entity": null }, { "Name": "ClientVersion", "Description": "Version of the endpoint agent or sensor running on the machine", "Type": "String", "Entity": null }, { "Name": "Folder", "Description": "The folder where a group of items is located", "Type": "String", "Entity": null }, { "Name": "CrossMailboxOperations", "Description": "Indicates if the operation involved more than one mailbox", "Type": "Boolean", "Entity": null }, { "Name": "DestMailboxId", "Description": "Set only if the CrossMailboxOperations parameter is True", "Type": "String", "Entity": null }, { "Name": "DestMailboxOwnerUPN", "Description": "Set only if the CrossMailboxOperations parameter is True", "Type": "String", "Entity": null }, { "Name": "DestMailboxOwnerSid", "Description": "Set only if the CrossMailboxOperations parameter is True", "Type": "String", "Entity": null }, { "Name": "DestMailboxOwnerMasterAccountSid", "Description": "Set only if the CrossMailboxOperations parameter is True", "Type": "String", "Entity": null }, { "Name": "DestFolder", "Description": "The destination folder", "Type": "String", "Entity": null }, { "Name": "Folders", "Description": "Information about the source folders involved in an operation", "Type": "String", "Entity": null }, { "Name": "AffectedItems", "Description": "Information about each item in the group", "Type": "String", "Entity": null }, { "Name": "Item", "Description": "Represents the item upon which the operation was performed", "Type": "String", "Entity": null }, { "Name": "ModifiedProperties", "Description": "Indicates name of each attribute that changed", "Type": "String", "Entity": null }, { "Name": "SendAsUserSmtp", "Description": "SMTP address of the user who is being impersonated", "Type": "String", "Entity": null }, { "Name": "SendAsUserMailboxGuid", "Description": "The Exchange GUID of the mailbox that was accessed to send email as", "Type": "String", "Entity": null }, { "Name": "SendOnBehalfOfUserSmtp", "Description": "SMTP address of the user on whose behalf the email is sent", "Type": "String", "Entity": null }, { "Name": "SendonBehalfOfUserMailboxGuid", "Description": "The Exchange GUID of the mailbox that was accessed to send mail on behalf of", "Type": "String", "Entity": null }, { "Name": "ExtendedProperties", "Description": "The extended properties of the Azure AD event", "Type": "String", "Entity": null }, { "Name": "Client", "Description": "Details about the client device, device OS, and device browser that was used for the of the account login event", "Type": "String", "Entity": null }, { "Name": "LoginStatus", "Description": "This property is from OrgIdLogon.LoginStatus directly. The mapping of various interesting logon failures could be done by alerting algorithms", "Type": "Int32", "Entity": null }, { "Name": "Actor", "Description": "The user or service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "ActorContextId", "Description": "The GUID of the organization that the actor belongs to", "Type": "String", "Entity": null }, { "Name": "ActorIpAddress", "Description": "The actor's IP address in IPV4 or IPV6 address format", "Type": "String", "Entity": null }, { "Name": "InterSystemsId", "Description": "The GUID that track the actions across components within the Office 365 service", "Type": "String", "Entity": null }, { "Name": "IntraSystemId", "Description": "The GUID that's generated by Azure Active Directory to track the action", "Type": "String", "Entity": null }, { "Name": "SupportTicketId", "Description": "The customer support ticket ID for the action in 'act-on-behalf-of' situations", "Type": "String", "Entity": null }, { "Name": "TargetContextId", "Description": "The GUID of the organization that the targeted user belongs to", "Type": "String", "Entity": null }, { "Name": "DataCenterSecurityEventType", "Description": "The type of dmdlet event in lock box", "Type": "Int32", "Entity": null }, { "Name": "EffectiveOrganization", "Description": "The name of the tenant that the elevation/cmdlet was targeted at", "Type": "String", "Entity": null }, { "Name": "ElevationTime", "Description": "The start time of the elevation", "Type": "DateTime", "Entity": null }, { "Name": "ElevationApprover", "Description": "The name of a Microsoft manager", "Type": "String", "Entity": null }, { "Name": "ElevationApprovedTime", "Description": "The timestamp for when the elevation was approved", "Type": "DateTime", "Entity": null }, { "Name": "ElevationRequestId", "Description": "A unique identifier for the elevation request", "Type": "String", "Entity": null }, { "Name": "ElevationRole", "Description": "The role the elevation was requested for", "Type": "String", "Entity": null }, { "Name": "ElevationDuration", "Description": "The duration for which the elevation was active (in Hours)", "Type": "Int32", "Entity": null }, { "Name": "GenericInfo", "Description": "Used for comments and other generic information", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "The source system name", "Type": "String", "Entity": null }, { "Name": "OfficeId", "Description": "Unique identifier of an audit record", "Type": "String", "Entity": null }, { "Name": "SourceRecordId", "Description": "Unique identifier of an audit record", "Type": "String", "Entity": null }, { "Name": "AzureActiveDirectory_EventType", "Description": "The type of Azure AD event", "Type": "String", "Entity": null }, { "Name": "AADTarget", "Description": "The user that the action (identified by the Operation property) was performed on", "Type": "String", "Entity": null }, { "Name": "Start_Time", "Description": "The date and time at which the cmdlet was executed", "Type": "DateTime", "Entity": null }, { "Name": "OfficeTenantId", "Description": "The office tenant id", "Type": "String", "Entity": null }, { "Name": "TargetUserOrGroupName", "Description": "Stores the UPN or name of the target user or group that a resource was shared with", "Type": "String", "Entity": null }, { "Name": "TargetUserOrGroupType", "Description": "Identifies whether the target user or group is a Member, Guest, Group, or Partner", "Type": "String", "Entity": null }, { "Name": "MessageId", "Description": "Identifier for the message", "Type": "String", "Entity": null }, { "Name": "Members", "Description": "A list of users within a Team", "Type": "Object", "Entity": null }, { "Name": "TeamName", "Description": "The name of the team being audited", "Type": "String", "Entity": null }, { "Name": "TeamGuid", "Description": "A unique identifier for the team being audited", "Type": "String", "Entity": null }, { "Name": "ChannelType", "Description": "The type of channel being audited (Standard/Private)", "Type": "String", "Entity": null }, { "Name": "ChannelName", "Description": "The name of the channel being audited", "Type": "String", "Entity": null }, { "Name": "ChannelGuid", "Description": "A unique identifier for the channel being audited", "Type": "String", "Entity": null }, { "Name": "ExtraProperties", "Description": "A list of extra properties", "Type": "Object", "Entity": null }, { "Name": "AddOnType", "Description": "The type of add-on that generated this event", "Type": "String", "Entity": null }, { "Name": "AddonName", "Description": "The name of the add-on that generated this event", "Type": "String", "Entity": null }, { "Name": "TabType", "Description": "The type of tab that generated this event", "Type": "String", "Entity": null }, { "Name": "Name", "Description": "Display name of the agent.", "Type": "String", "Entity": null }, { "Name": "OldValue", "Description": "Only present for settings events. Old value of the setting", "Type": "String", "Entity": null }, { "Name": "NewValue", "Description": "Only present for settings events. New value of the setting", "Type": "String", "Entity": null }, { "Name": "ItemName", "Description": "The string in the Subject field of the email message", "Type": "String", "Entity": null }, { "Name": "ChatThreadId", "Description": "The Id of the chat thread", "Type": "String", "Entity": null }, { "Name": "ChatName", "Description": "The name of the chat", "Type": "String", "Entity": null }, { "Name": "CommunicationType", "Description": "The type of communications that was conducted", "Type": "String", "Entity": null }, { "Name": "AADGroupId", "Description": "Azure Active Directory group id", "Type": "String", "Entity": null }, { "Name": "AddOnGuid", "Description": "The unique identifier of the add-on generated this event", "Type": "String", "Entity": null }, { "Name": "AppDistributionMode", "Description": "Application distribution mode", "Type": "String", "Entity": null }, { "Name": "TargetUserId", "Description": "Target user id", "Type": "String", "Entity": null }, { "Name": "OperationScope", "Description": "The scope the operation was performed on", "Type": "String", "Entity": null }, { "Name": "AzureADAppId", "Description": "Teams Application Azure AD ID", "Type": "String", "Entity": null }, { "Name": "OperationProperties", "Description": "Additional operation properties", "Type": "Object", "Entity": null }, { "Name": "AppId", "Description": "Application ID", "Type": "String", "Entity": null }, { "Name": "ClientAppId", "Description": "Client application ID", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "String", "Entity": null }, { "Name": "SRPolicyId", "Description": "Policy ID", "Type": "String", "Entity": null }, { "Name": "SRPolicyName", "Description": "Policy name", "Type": "String", "Entity": null }, { "Name": "SRRuleMatchDetails", "Description": "Rule details", "Type": "Object", "Entity": null }, { "Name": "IsManagedDevice", "Description": "Indicates if the device is managed by the organization (True) or not (False)", "Type": "Boolean", "Entity": null }, { "Name": "AppPoolName", "Description": "The App pool name", "Type": "String", "Entity": null }, { "Name": "AppAccessContext", "Description": "The application context for the user or service principal that performed the action.", "Type": "Object", "Entity": null }, { "Name": "Attendees", "Description": "The list of attendees for the meeting.", "Type": "Object", "Entity": null }, { "Name": "ArtifactsShared", "Description": "The artifacts shared in the meeting.", "Type": "Object", "Entity": null }, { "Name": "IsJoinedFromLobby", "Description": "Indicates whether the user join from the lobby.", "Type": "Boolean", "Entity": null }, { "Name": "JoinTime", "Description": "The time the user joined the meeting.", "Type": "DateTime", "Entity": null }, { "Name": "LeaveTime", "Description": "The time the user left the meeting.", "Type": "DateTime", "Entity": null }, { "Name": "DeviceInformation", "Description": "The user device information.", "Type": "String", "Entity": null }, { "Name": "MeetingDetailId", "Description": "The meeting detail ID.", "Type": "String", "Entity": null }, { "Name": "ListItemUniqueId", "Description": "The Guid of uniquely an identifiable item of list. This information is present only if it is applicable.", "Type": "String", "Entity": null }, { "Name": "SensitivityLabelId", "Description": "The current Microsoft Information Protection sensitivity label ID associated with the item", "Type": "String", "Entity": null }, { "Name": "UniqueSharingId", "Description": "The unique sharing ID associated with the sharing operation.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "OktaSystemLogs", "TableSource": "sentinel", "Description": "Okta System Logs data connector provides the capability to ingest audit and event logs from the Okta Sysem Log API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform and uses the Okta System Log API to fetch the events. The connector supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "ActingAppName", "Description": "The name of the application initiating the action.", "Type": "String", "Entity": null }, { "Name": "ActingAppType", "Description": "The type of the application initiating the action (e.g., Browser, API client).", "Type": "String", "Entity": null }, { "Name": "ActorDetailEntry", "Description": "Detailed information about the actor performing the action, if available.", "Type": "Object", "Entity": null }, { "Name": "ActorDisplayName", "Description": "The display name of the actor performing the action.", "Type": "String", "Entity": null }, { "Name": "ActorSessionId", "Description": "The session ID associated with the actor performing the action.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "The user ID of the actor performing the action, if applicable.", "Type": "String", "Entity": null }, { "Name": "ActorUserIdType", "Description": "The type of user ID for the actor (e.g., OktaId).", "Type": "String", "Entity": null }, { "Name": "ActorUsername", "Description": "The username of the actor performing the action.", "Type": "String", "Entity": null }, { "Name": "ActorUsernameType", "Description": "The type of username for the actor (e.g., UPN).", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of the actor (e.g., Regular, System Principal).", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextAuthenticationProvider", "Description": "The authentication provider used in the context of the action.", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextAuthenticationStep", "Description": "The step in the authentication process when the action occurred.", "Type": "Int32", "Entity": null }, { "Name": "AuthenticationContextCredentialProvider", "Description": "The credential provider used during the authentication process.", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextInterface", "Description": "The interface used during the authentication process (e.g., web, mobile).", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextIssuerId", "Description": "The ID of the issuer involved in the authentication process.", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextIssuerType", "Description": "The type of the issuer involved in the authentication process.", "Type": "String", "Entity": null }, { "Name": "DebugData", "Description": "Additional debugging data related to the event.", "Type": "Object", "Entity": null }, { "Name": "DvcAction", "Description": "The result of the device action (e.g., Allow, Deny, Partial).", "Type": "String", "Entity": null }, { "Name": "EventMessage", "Description": "A descriptive message associated with the event.", "Type": "String", "Entity": null }, { "Name": "EventOriginalResultDetails", "Description": "Details of the original result of the event outcome.", "Type": "String", "Entity": null }, { "Name": "EventOriginalType", "Description": "The original type of the event before transformation.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "The unique identifier for the original event.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "The high-level result of the event (e.g., Success, Failure).", "Type": "String", "Entity": null }, { "Name": "EventSeverity", "Description": "The severity level of the event (e.g., Informational, High).", "Type": "String", "Entity": null }, { "Name": "HttpUserAgent", "Description": "The raw user-agent string of the client initiating the event.", "Type": "String", "Entity": null }, { "Name": "LegacyEventType", "Description": "The legacy type identifier for the event, if applicable.", "Type": "String", "Entity": null }, { "Name": "LogonMethod", "Description": "The method used for logging in (e.g., password, token).", "Type": "String", "Entity": null }, { "Name": "OriginalActorAlternateId", "Description": "The alternate ID of the actor in the original event data.", "Type": "String", "Entity": null }, { "Name": "OriginalClientDevice", "Description": "The type of client device initiating the event (e.g., Computer).", "Type": "String", "Entity": null }, { "Name": "OriginalOutcomeResult", "Description": "The raw outcome result of the original event.", "Type": "String", "Entity": null }, { "Name": "OriginalSeverity", "Description": "The raw severity level of the original event.", "Type": "String", "Entity": null }, { "Name": "OriginalTarget", "Description": "The original target(s) involved in the event.", "Type": "Object", "Entity": null }, { "Name": "OriginalUserId", "Description": "The original user ID in the event data.", "Type": "String", "Entity": null }, { "Name": "OriginalUserType", "Description": "The type of user in the original event data.", "Type": "String", "Entity": null }, { "Name": "Request", "Description": "Details of the request associated with the event.", "Type": "Object", "Entity": null }, { "Name": "SecurityContextAsNumber", "Description": "The autonomous system (AS) number in the security context.", "Type": "Int32", "Entity": null }, { "Name": "SecurityContextAsOrg", "Description": "The organization associated with the AS number in the security context.", "Type": "String", "Entity": null }, { "Name": "SecurityContextDomain", "Description": "The domain involved in the security context.", "Type": "String", "Entity": null }, { "Name": "SecurityContextIsProxy", "Description": "Indicates whether a proxy is used in the security context.", "Type": "Boolean", "Entity": null }, { "Name": "SrcDeviceType", "Description": "The type of the source device (e.g., Computer).", "Type": "String", "Entity": null }, { "Name": "SrcDvcId", "Description": "The unique identifier for the source device.", "Type": "String", "Entity": null }, { "Name": "SrcDvcOs", "Description": "The operating system of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCity", "Description": "The city of the source device's geographic location.", "Type": "String", "Entity": null }, { "Name": "SrcGeoCountry", "Description": "The country of the source device's geographic location.", "Type": "String", "Entity": null }, { "Name": "SrcGeoLatitude", "Description": "The latitude of the source device's geographic location.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoLongtitude", "Description": "The longitude of the source device's geographic location.", "Type": "Double", "Entity": null }, { "Name": "SrcGeoPostalCode", "Description": "The postal code of the source device's geographic location.", "Type": "String", "Entity": null }, { "Name": "SrcGeoRegion", "Description": "The region/state of the source device's geographic location.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcIsp", "Description": "The Internet Service Provider (ISP) of the source device.", "Type": "String", "Entity": null }, { "Name": "SrcZone", "Description": "The network zone of the source device.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "TransactionDetail", "Description": "Details about the transaction associated with the event.", "Type": "Object", "Entity": null }, { "Name": "TransactionId", "Description": "The unique identifier of the transaction.", "Type": "String", "Entity": null }, { "Name": "TransactionType", "Description": "The type of transaction associated with the event.", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "SrcDvcIdType", "Description": "The type of source device ID (e.g., OktaId).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "Operation", "TableSource": "sentinel", "Description": "Operational log of important activities affecting workspace. Includes both user-initiated activities and notifications from Log Analytics workspace services such as data-capping.", "Schema": [ { "Name": "SourceSystem", "Description": "Value is OpsManager for all records in this table.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time that the record was created.", "Type": "DateTime", "Entity": null }, { "Name": "OperationStatus", "Description": "Operation status description. Ccommon values include Warning Succeeded Failed Error.", "Type": "String", "Entity": null }, { "Name": "Detail", "Description": "User friendly string that describes further details about the operation", "Type": "String", "Entity": null }, { "Name": "OperationCategory", "Description": "Name of the area that produced the record.", "Type": "String", "Entity": null }, { "Name": "OperationKey", "Description": "Operation ID. Can be a GUID or string.", "Type": "String", "Entity": null }, { "Name": "ErrorId", "Description": "Deprecated.", "Type": "String", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "Name of the Operations Manager management group for System Center Operations Manager agents.", "Type": "String", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "Name of a physical or virtual machine having membership with Log Analytics agent.", "Type": "String", "Entity": null }, { "Name": "Solution", "Description": "Name of the managed solution that produced the record. Can also include other sources such as RestAPI.", "Type": "String", "Entity": null }, { "Name": "HelpLink", "Description": "Reference URL for additional contextual information.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "PowerAppsActivity", "TableSource": "sentinel", "Description": "Contains Microsoft Power Apps activity logs that track events like creation, deletion, updates, permission changes, and app launches.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in (UTC) when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. For example: Admin, System, Application, Service Principal, Guest or Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity. Also, for Azure Active Directory-related events, the IP address isn't logged and the value for the ClientIP property is null.", "Type": "String", "Entity": null }, { "Name": "TargetAppName", "Description": "The name of the app where the event occurred.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "AdditionalInfo", "Description": "Additional information if any (e.g. the environment name)", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "PowerAutomateActivity", "TableSource": "sentinel", "Description": "Contains Microsoft Power Automate audit logs. It's typically used to track Power Automate activities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in (UTC) when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. Possible types are: Admin, System, Application, Service Principal and Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity. Also, for Azure Active Directory-related events, the IP address isn't logged and the value for the ClientIP property is null.", "Type": "String", "Entity": null }, { "Name": "RecipientUpn", "Description": "If permission was updated, shows the UPN of the permission recipient.", "Type": "String", "Entity": null }, { "Name": "FlowConnectorNames", "Description": "Connector names listed in the flow.", "Type": "String", "Entity": null }, { "Name": "FlowDetailsUrl", "Description": "Link to the flow's details page.", "Type": "String", "Entity": null }, { "Name": "LicenseDisplayName", "Description": "Display name of the license.", "Type": "String", "Entity": null }, { "Name": "SharingPermission", "Description": "Type of permission shared with another user (3 = Owner/ReadWrite, 2 = Run-only user/Read).", "Type": "String", "Entity": null }, { "Name": "UserUpn", "Description": "Unique ID of the user. Always equivalent to UserKey.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "AdditionalInfo", "Description": "More information, for example, the environment name.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "PowerBIActivity", "TableSource": "sentinel", "Description": "Contains Microsoft PowerBI audit logs. It's typically used to track PowerBI activities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in (UTC) when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of user that performed the operation. Possible types are: Admin, System, Application, Service Principal and Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. Possible types are: Admin, System, Application, Service Principal and Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity. Also, for Azure Active Directory-related events, the IP address isn't logged and the value for the ClientIP property is null.", "Type": "String", "Entity": null }, { "Name": "Scope", "Description": "Event can be created by a hosted Office 365 service or an on-premises server. Possible values are online and onprem. Note that SharePoint is the only workload currently sending events from on-premises to Office 365.", "Type": "String", "Entity": null }, { "Name": "TargetAppName", "Description": "The name of the app where the event occurred.", "Type": "String", "Entity": null }, { "Name": "DashboardName", "Description": "The name of the dashboard where the event occurred.", "Type": "String", "Entity": null }, { "Name": "DataClassification", "Description": "The data classification, if exists, for the dashboard where the event occurred.", "Type": "String", "Entity": null }, { "Name": "DatasetName", "Description": "The name of the dataset where the event occurred.", "Type": "String", "Entity": null }, { "Name": "MembershipInformation", "Description": "Membership information about the group.", "Type": "String", "Entity": null }, { "Name": "OrgAppPermission", "Description": "Permissions list for an organizational app (entire organization, specific users, or specific groups).", "Type": "String", "Entity": null }, { "Name": "ReportName", "Description": "The name of the report where the event occurred.", "Type": "String", "Entity": null }, { "Name": "SharingInformation", "Description": "Information about the person to whom a sharing invitation is sent.", "Type": "String", "Entity": null }, { "Name": "SwitchState", "Description": "Information about the state of various tenant level switches.", "Type": "String", "Entity": null }, { "Name": "PbiWorkspaceName", "Description": "The name of the PowerBI workspace where the event occurred.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The Microsoft product name (PowerBI).", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "Service vendor name.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "Activity", "Description": "Sensor activity", "Type": "String", "Entity": null }, { "Name": "ItemName", "Description": "The name of the item that the activity was performed on.", "Type": "String", "Entity": null }, { "Name": "WorkspaceId", "Description": "The ID of the PowerBI workspace.", "Type": "String", "Entity": null }, { "Name": "DashboardId", "Description": "The ID of the dashboard that the activity was performed on.", "Type": "String", "Entity": null }, { "Name": "IsSuccess", "Description": "Indicates whether the action was successful or not.", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "ActivityId", "Description": "Unique identifier of the activity log", "Type": "String", "Entity": null }, { "Name": "DistributionMethod", "Description": "Indicates the distribution method of the content.", "Type": "String", "Entity": null }, { "Name": "FolderAccessRequests", "Description": "List of users that requested access to the folder.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "PowerPlatformAdminActivity", "TableSource": "sentinel", "Description": "Contains Microsoft Power Platform administrative activity logs that track events like creation, deletion, updates, to the Microsoft Power Platform environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in (UTC) when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. For example: Admin, System, Application, Service Principal, Guest or Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "PropertyCollection", "Description": "Additional information property bag for the event.", "Type": "Object", "Entity": null }, { "Name": "Properties", "Description": "Additional information properties with KQL friendly formatting.", "Type": "Object", "Entity": null }, { "Name": "EnvironmentId", "Description": "The identifier of the Microsoft Power Platform environment the agent resides in.", "Type": "String", "Entity": null }, { "Name": "RequiresCustomerKeyEncryption", "Description": "Status of the Customer Key Encryption requirement for the event.", "Type": "Boolean", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "PowerPlatformConnectorActivity", "TableSource": "sentinel", "Description": "Contains Microsoft Power Platform Connector audit logs. It's typically used to track Power Platform Connector activities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in (UTC) when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. Possible types are: Admin, System, Application, Service Principal and Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity. Also, for Azure Active Directory-related events, the IP address isn't logged and the value for the ClientIP property is null.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "ConnectorId", "Description": "The unique ID of the resource. Examples: custom api, and connection or gateway.", "Type": "String", "Entity": null }, { "Name": "AdditionalInfo", "Description": "More information, for example, the environment name.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "PowerPlatformDlpActivity", "TableSource": "sentinel", "Description": "Contains Microsoft Power Platform Data Loss Prevention (DLP) audit logs. It's typically used to track Power Platform DLP admin activities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in (UTC) when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. Possible types are: Admin, System, Application, Service Principal and Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity. Also, for Azure Active Directory-related events, the IP address isn't logged and the value for the ClientIP property is null.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "PolicyName", "Description": "Name of the policy", "Type": "String", "Entity": null }, { "Name": "AdditionalInfo", "Description": "More information, for example, the environment name.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ProjectActivity", "TableSource": "sentinel", "Description": "Contains your Microsoft Project audit logs in order to track your Project activities.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "EventOriginalUid", "Description": "Unique identifier of an audit record.", "Type": "String", "Entity": null }, { "Name": "RecordType", "Description": "The type of operation indicated by the record. See the AuditLogRecordType table for details on the types of audit log records.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time in UTC when the user performed the activity.", "Type": "DateTime", "Entity": null }, { "Name": "EventOriginalType", "Description": "The name of the user or admin activity that performed the activity. For a description of the most common operations/activities, see \"Search the audit log\" in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be \"DlpRuleMatch\", \"DlpRuleUndo\" or \"DlpInfo\", which are described under \"DLP schema\" below.", "Type": "String", "Entity": null }, { "Name": "OrganizationId", "Description": "The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs.", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "The type of user that performed the operation.", "Type": "String", "Entity": null }, { "Name": "ActorUserType", "Description": "The type of user that performed the operation. Possible types are: Admin, System, Application, Service Principal and Other.", "Type": "String", "Entity": null }, { "Name": "ActorUserId", "Description": "An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts.", "Type": "String", "Entity": null }, { "Name": "Workload", "Description": "The Microsoft 365 service where the event occurred", "Type": "String", "Entity": null }, { "Name": "EventResult", "Description": "Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceeded, or Failed.", "Type": "String", "Entity": null }, { "Name": "ObjectId", "Description": "Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension", "Type": "String", "Entity": null }, { "Name": "ActorName", "Description": "The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\\system or NT AUTHORITY\\SYSTEM) are also included. In SharePoint, another value display in the UserId property is app@sharepoint. This indicates that the \"user\" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. For more information, see the app@sharepoint user in audit records.", "Type": "String", "Entity": null }, { "Name": "SrcIpAddr", "Description": "The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity. Also, for Azure Active Directory-related events, the IP address isn't logged and the value for the ClientIP property is null.", "Type": "String", "Entity": null }, { "Name": "Scope", "Description": "Event can be created by a hosted Office 365 service or an on-premises server. Possible values are online and onprem. Note that SharePoint is the only workload currently sending events from on-premises to Office 365.", "Type": "String", "Entity": null }, { "Name": "ProjectEntity", "Description": "The project entity the audit was for.", "Type": "String", "Entity": null }, { "Name": "ProjectAction", "Description": "The project action that was taken.", "Type": "String", "Entity": null }, { "Name": "OnBehalfOfResId", "Description": "The resource ID the action was taken on behalf of.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The Microsoft service name.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor service name.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ProtectionStatus", "TableSource": "", "Description": "Antimalware installation info and security health status of the machine:", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": null }, { "Name": "DetectionId", "Description": "", "Type": "String", "Entity": null }, { "Name": "OSName", "Description": "", "Type": "String", "Entity": null }, { "Name": "Threat", "Description": "", "Type": "String", "Entity": null }, { "Name": "ThreatStatusRank", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "ThreatStatus", "Description": "", "Type": "String", "Entity": null }, { "Name": "ThreatStatusDetails", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProtectionStatusRank", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "ProtectionStatus", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProtectionStatusDetails", "Description": "", "Type": "String", "Entity": null }, { "Name": "SignatureVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "TypeofProtection", "Description": "", "Type": "String", "Entity": null }, { "Name": "ScanDate", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "AMProductVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "ComputerIP_Hidden", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ComputerEnvironment", "Description": "", "Type": "String", "Entity": null }, { "Name": "Resource", "Description": "", "Type": "String", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier of the cloud service subscription", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceProvider", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceType", "Description": "Type of cloud resource", "Type": "String", "Entity": null }, { "Name": "VMUUID", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "QualysKnowledgeBase", "TableSource": "sentinel", "Description": "QualysKnowledgeBase table contains vulnerabilities from Qualys KnowledgeBase.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was generated.", "Type": "DateTime", "Entity": null }, { "Name": "Qid", "Description": "The QID of the vulnerability.", "Type": "String", "Entity": null }, { "Name": "VulnTitle", "Description": "Title of the ingested vulnerability.", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Consequence", "Description": "Vulnerability Consequence.", "Type": "String", "Entity": null }, { "Name": "Diagnosis", "Description": "Diagnosis information for the vulnerability.", "Type": "String", "Entity": null }, { "Name": "LastServiceModificationDateTime", "Description": "Date and time when the vulnerability was last modified in the service.", "Type": "DateTime", "Entity": null }, { "Name": "Patchable", "Description": "Indicates whether the vulnerability is patchable.", "Type": "String", "Entity": null }, { "Name": "CveId", "Description": "Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system", "Type": "Object", "Entity": null }, { "Name": "CveUrl", "Description": "URL for the CVE entry.", "Type": "Object", "Entity": null }, { "Name": "VendorReferenceId", "Description": "Vendor-specific reference identifier.", "Type": "Object", "Entity": null }, { "Name": "VendorReferenceUrl", "Description": "URL for vendor-specific reference.", "Type": "Object", "Entity": null }, { "Name": "PciFlag", "Description": "PCI compliance flag indicator.", "Type": "String", "Entity": null }, { "Name": "PublishedDatetime", "Description": "Date and time when the vulnerability was published.", "Type": "DateTime", "Entity": null }, { "Name": "SeverityLevel", "Description": "Severity level of the vulnerability.", "Type": "String", "Entity": null }, { "Name": "SoftwareProduct", "Description": "Software product affected by the vulnerability.", "Type": "Object", "Entity": null }, { "Name": "SoftwareVendor", "Description": "Name of the software vendor", "Type": "Object", "Entity": null }, { "Name": "Solution", "Description": "Solution or remediation steps for the vulnerability.", "Type": "String", "Entity": null }, { "Name": "VulnType", "Description": "Type or classification of the vulnerability.", "Type": "String", "Entity": null }, { "Name": "DiscoveryAdditionalInfo", "Description": "Additional information about vulnerability discovery.", "Type": "String", "Entity": null }, { "Name": "DiscoveryAuthType", "Description": "Authentication type used for discovery.", "Type": "Object", "Entity": null }, { "Name": "DiscoveryRemote", "Description": "Remote discovery information.", "Type": "String", "Entity": null }, { "Name": "ThreatIntelligence", "Description": "Threat intelligence data associated with the vulnerability.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "Rapid7InsightVMCloudAssets", "TableSource": "sentinel", "Description": "Rapid7InsightVMCloudAssets table contains asset information from Rapid7 InsightVM Cloud.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the event was generated", "Type": "DateTime", "Entity": null }, { "Name": "AssessedForPolicies", "Description": "Whether an asset was assessed for policies", "Type": "Boolean", "Entity": null }, { "Name": "AssessedForVulnerabilities", "Description": "Whether an asset was assessed for vulnerabilities", "Type": "Boolean", "Entity": null }, { "Name": "CredentialAssessments", "Description": "The credential assessments for the asset", "Type": "String", "Entity": null }, { "Name": "CriticalVulnerabilities", "Description": "The count of critical vulnerability findings", "Type": "Double", "Entity": null }, { "Name": "Exploits", "Description": "The count of known unique exploits that can be used to exploit vulnerabilities on the asset", "Type": "Double", "Entity": null }, { "Name": "HostName", "Description": "The host name (local or FQDN)", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "Ip", "Description": "The IPv4 or IPv6 address", "Type": "String", "Entity": null }, { "Name": "LastAssessedForVulnerabilities", "Description": "The time at which an asset was assessed for vulnerabilities", "Type": "DateTime", "Entity": null }, { "Name": "LastScanEnd", "Description": "The time at which the last scan of the asset ended", "Type": "DateTime", "Entity": null }, { "Name": "LastScanStart", "Description": "The time at which the last scan of the asset started", "Type": "DateTime", "Entity": null }, { "Name": "Mac", "Description": "The Media Access Control (MAC) address with format specification", "Type": "String", "Entity": null }, { "Name": "MalwareKits", "Description": "The count of known unique malware kits that can be used to attack vulnerabilities", "Type": "Double", "Entity": null }, { "Name": "ModerateVulnerabilities", "Description": "The count of moderate vulnerability findings", "Type": "Double", "Entity": null }, { "Name": "New", "Description": "Vulnerabilities that are new in the latest version (when comparison time is supplied)", "Type": "String", "Entity": null }, { "Name": "OsArchitecture", "Description": "The architecture of the operating system", "Type": "String", "Entity": null }, { "Name": "OsDescription", "Description": "The description of the operating system (containing vendor, family, product, version and architecture)", "Type": "String", "Entity": null }, { "Name": "OsFamily", "Description": "The family of the operating system", "Type": "String", "Entity": null }, { "Name": "OsName", "Description": "The name of the operating system", "Type": "String", "Entity": null }, { "Name": "OsSystemName", "Description": "A combination of vendor and family (with redundancies removed), suitable for grouping", "Type": "String", "Entity": null }, { "Name": "OsType", "Description": "The type of operating system", "Type": "String", "Entity": null }, { "Name": "OsVendor", "Description": "The vendor of the operating system", "Type": "String", "Entity": null }, { "Name": "OsVersion", "Description": "The version of the operating system", "Type": "String", "Entity": null }, { "Name": "Remediated", "Description": "Vulnerabilities that were remediated in the latest version (when comparison time is supplied)", "Type": "String", "Entity": null }, { "Name": "RiskScore", "Description": "The risk score of the identity as calculated by Microsoft Defender", "Type": "Double", "Entity": null }, { "Name": "Same", "Description": "Vulnerabilities that are the same between current and comparison time (when comparison time is supplied and includeSame is true)", "Type": "String", "Entity": null }, { "Name": "SevereVulnerabilities", "Description": "The count of severe vulnerability findings", "Type": "Double", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "String", "Entity": null }, { "Name": "TotalVulnerabilities", "Description": "The total count of vulnerability findings", "Type": "Double", "Entity": null }, { "Name": "UniqueIdentifiers", "Description": "Unique identifiers found on the asset, such as hardware or operating system identifiers", "Type": "String", "Entity": null }, { "Name": "AssetType", "Description": "The type of asset", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "Rapid7InsightVMCloudVulnerabilities", "TableSource": "sentinel", "Description": "Rapid7InsightVMCloudVulnerabilities table contains vulnerability information from Rapid7 InsightVM Cloud.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time the event was generated", "Type": "DateTime", "Entity": null }, { "Name": "Added", "Description": "The date the vulnerability coverage was added (ISO 8601 YYYY-MM-DD)", "Type": "DateTime", "Entity": null }, { "Name": "Categories", "Description": "List of categories that the information belongs to, in JSON array format", "Type": "String", "Entity": null }, { "Name": "Cves", "Description": "All CVEs assigned to this vulnerability", "Type": "String", "Entity": null }, { "Name": "CvssV2AccessComplexity", "Description": "Enum: L/M/H. CVSS v2 Access Complexity — attack conditions required to exploit", "Type": "String", "Entity": null }, { "Name": "CvssV2AccessVector", "Description": "Enum: L/A/N. CVSS v2 Access Vector — how the vulnerability is exploited (Local/Adjacent/Network)", "Type": "String", "Entity": null }, { "Name": "CvssV2Authentication", "Description": "Enum: N/S/M. CVSS v2 Authentication — number of authentications required to exploit", "Type": "String", "Entity": null }, { "Name": "CvssV2AvailabilityImpact", "Description": "Enum: N/P/C. CVSS v2 Availability Impact — impact to availability", "Type": "String", "Entity": null }, { "Name": "CvssV2ConfidentialityImpact", "Description": "Enum: N/P/C. CVSS v2 Confidentiality Impact — impact on confidentiality", "Type": "String", "Entity": null }, { "Name": "CvssV2ExploitScore", "Description": "The CVSS v2 exploit score", "Type": "Double", "Entity": null }, { "Name": "CvssV2ImpactScore", "Description": "The CVSS v2 impact score", "Type": "Double", "Entity": null }, { "Name": "CvssV2IntegrityImpact", "Description": "Enum: N/P/C. CVSS v2 Integrity Impact — impact to integrity", "Type": "String", "Entity": null }, { "Name": "CvssV2Score", "Description": "The CVSS v2 score (0-10)", "Type": "Double", "Entity": null }, { "Name": "CvssV2Vector", "Description": "The CVSS v2 vector", "Type": "String", "Entity": null }, { "Name": "CvssV3AttackComplexity", "Description": "Enum: L/H. CVSS v3 Attack Complexity — conditions beyond attacker control required", "Type": "String", "Entity": null }, { "Name": "CvssV3AttackVector", "Description": "Enum: N/A/L/P. CVSS v3 Attack Vector — context of exploitation", "Type": "String", "Entity": null }, { "Name": "CvssV3AvailabilityImpact", "Description": "Enum: N/L/H. CVSS v3 Availability Impact — impact to availability", "Type": "String", "Entity": null }, { "Name": "CvssV3ConfidentialityImpact", "Description": "Enum: N/L/H. CVSS v3 Confidentiality Impact — impact on confidentiality", "Type": "String", "Entity": null }, { "Name": "CvssV3ExploitScore", "Description": "The CVSS v3 exploit score", "Type": "Double", "Entity": null }, { "Name": "CvssV3ImpactScore", "Description": "The CVSS v3 impact score", "Type": "Double", "Entity": null }, { "Name": "CvssV3IntegrityImpact", "Description": "Enum: N/L/H. CVSS v3 Integrity Impact — impact to integrity", "Type": "String", "Entity": null }, { "Name": "CvssV3PrivilegesRequired", "Description": "Enum: N/L/H. CVSS v3 Privileges Required — level of privileges needed before exploit", "Type": "String", "Entity": null }, { "Name": "CvssV3Scope", "Description": "Enum: U/C. CVSS v3 Scope — impact remains in same authority or crosses", "Type": "String", "Entity": null }, { "Name": "CvssV3Score", "Description": "The CVSS v3 score (0-10)", "Type": "Double", "Entity": null }, { "Name": "CvssV3UserInteraction", "Description": "Enum: N/R. CVSS v3 User Interaction — whether user action is required", "Type": "String", "Entity": null }, { "Name": "CvssV3Vector", "Description": "The CVSS v3 vector", "Type": "String", "Entity": null }, { "Name": "DenialOfService", "Description": "Whether the vulnerability can lead to Denial of Service (DoS)", "Type": "Boolean", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Exploits", "Description": "The exploits that can be used to exploit a vulnerability", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "Links", "Description": "References to security standards this vulnerability is a part of", "Type": "String", "Entity": null }, { "Name": "MalwareKits", "Description": "The malware kits that are known to be used to exploit the vulnerability", "Type": "String", "Entity": null }, { "Name": "Modified", "Description": "The last date the vulnerability was modified (ISO 8601 YYYY-MM-DD)", "Type": "DateTime", "Entity": null }, { "Name": "PciCvssScore", "Description": "The CVSS score adjusted for PCI rules (0-10)", "Type": "Double", "Entity": null }, { "Name": "PciFail", "Description": "Whether presence on a host would cause a PCI failure", "Type": "Boolean", "Entity": null }, { "Name": "PciSeverityScore", "Description": "The severity score adjusted for PCI rules (0-10)", "Type": "Double", "Entity": null }, { "Name": "PciSpecialNotes", "Description": "Special notes or remarks about the vulnerability pertaining to PCI compliance", "Type": "String", "Entity": null }, { "Name": "PciStatus", "Description": "The PCI compliance status", "Type": "String", "Entity": null }, { "Name": "Published", "Description": "The date the vulnerability was first published (ISO 8601 YYYY-MM-DD)", "Type": "DateTime", "Entity": null }, { "Name": "References", "Description": "Condensed references to security standards: [:,...]", "Type": "String", "Entity": null }, { "Name": "RiskScore", "Description": "The risk score of the identity as calculated by Microsoft Defender", "Type": "Double", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "SeverityScore", "Description": "The severity score of the vulnerability (0-10)", "Type": "Double", "Entity": null }, { "Name": "VulnerabilityTitle", "Description": "The title (summary) of the vulnerability", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SalesforceAuditTrail", "TableSource": "sentinel", "Description": "The Setup Audit Trail table contains logs from the Salesforce Audit Trail API that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (in UTC) when the log entry was generated.", "Type": "DateTime", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "Section", "Description": "The section of the Salesforce setup that was changed.", "Type": "String", "Entity": null }, { "Name": "Display", "Description": "A user-friendly display name for the change.", "Type": "String", "Entity": null }, { "Name": "CreatedDate", "Description": "The date and time when the change was made.", "Type": "DateTime", "Entity": null }, { "Name": "CreatedById", "Description": "The ID of the user who made the change.", "Type": "String", "Entity": null }, { "Name": "CreatedByName", "Description": "The name of the user who made the change.", "Type": "String", "Entity": null }, { "Name": "CreatedByEmail", "Description": "The email of the user who made the change.", "Type": "String", "Entity": null }, { "Name": "CreatedByUsername", "Description": "The username of the user who made the change.", "Type": "String", "Entity": null }, { "Name": "CreatedByContext", "Description": "The context in which the user made the change.", "Type": "String", "Entity": null }, { "Name": "CreatedByIssuer", "Description": "The issuer of the user's identity.", "Type": "String", "Entity": null }, { "Name": "DelegateUser", "Description": "The user who delegated the change.", "Type": "String", "Entity": null }, { "Name": "SalesforceDomain", "Description": "Salesforce host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SalesforceLoginHistory", "TableSource": "sentinel", "Description": "The Login History table contains login event logs from Salesforce that have been ingested into Microsoft Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (in UTC) when the log entry was generated.", "Type": "DateTime", "Entity": null }, { "Name": "ApiType", "Description": "Indicates the API type, for example Soap Enterprise.", "Type": "String", "Entity": null }, { "Name": "ApiVersion", "Description": "The API version of the event", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "AuthMethodReference", "Description": "The authentication method used by a third-party identification provider for an OpenID Connect single sign-on protocol.", "Type": "String", "Entity": null }, { "Name": "AuthenticationServiceId", "Description": "The 18-character ID for an authentication service for a login event.", "Type": "String", "Entity": null }, { "Name": "Browser", "Description": "Details about the version of the browser used to sign in", "Type": "String", "Entity": null }, { "Name": "CipherSuite", "Description": "The TLS cipher suite used for the login.", "Type": "String", "Entity": null }, { "Name": "ClientVersion", "Description": "Version of the endpoint agent or sensor running on the machine", "Type": "String", "Entity": null }, { "Name": "CountryIso", "Description": "The ISO 3166 code for the country where the user's IP address is physically located.", "Type": "String", "Entity": null }, { "Name": "ForwardedForIp", "Description": "The value in the X-Forwarded-For header of HTTP requests sent by the client.", "Type": "String", "Entity": null }, { "Name": "LoginGeoId", "Description": "The 18-character ID for the record of the geographic location of the user for a successful or unsuccessful login event.", "Type": "String", "Entity": null }, { "Name": "LoginSubType", "Description": "The type of login flow used.", "Type": "String", "Entity": null }, { "Name": "LoginTime", "Description": "Time zone is based on GMT.", "Type": "DateTime", "Entity": null }, { "Name": "LoginType", "Description": "The type of login used to access the session.", "Type": "String", "Entity": null }, { "Name": "LoginUrl", "Description": "URL from which the login request is coming.", "Type": "String", "Entity": null }, { "Name": "NetworkId", "Description": "The ID of the Experience Cloud site that the user is logging in to.", "Type": "String", "Entity": null }, { "Name": "OptionsIsGet", "Description": "The HTTP method used for the session login is a GET request.", "Type": "Boolean", "Entity": null }, { "Name": "OptionsIsPost", "Description": "The HTTP method used for the session login is a POST request.", "Type": "Boolean", "Entity": null }, { "Name": "Platform", "Description": "The platform that provided the information about the agents; possible values: Copilot Studio", "Type": "String", "Entity": null }, { "Name": "SourceIp", "Description": "The IP address of the incoming client request that first reaches Salesforce during a login.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "TlsProtocol", "Description": "The TLS protocol used for the login.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "ID of the user logging in.", "Type": "String", "Entity": null }, { "Name": "SalesforceDomain", "Description": "Salesforce host/domain configured for this connection; hard-coded on every record so hosts can be differentiated.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SecureScoreControls", "TableSource": "", "Description": "Azure Security Center Secure Score per control. A control is a logical group of related security recommendations, its secure score reflects the security posture per the control.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The (UTC) date and time the control score was generated", "Type": "DateTime", "Entity": null }, { "Name": "SecureScoresSubscriptionId", "Description": "The ID of the subscription", "Type": "String", "Entity": null }, { "Name": "AssessedResourceId", "Description": "The ID of the assessed resource", "Type": "String", "Entity": null }, { "Name": "ControlId", "Description": "The ID of the assessed control", "Type": "String", "Entity": null }, { "Name": "ControlName", "Description": "The display name of the control", "Type": "String", "Entity": null }, { "Name": "CurrentScore", "Description": "The current secure score per control", "Type": "Double", "Entity": null }, { "Name": "MaxScore", "Description": "The maximum control score", "Type": "Int32", "Entity": null }, { "Name": "PercentageScore", "Description": "The percentage of the score (current score divided by max score)", "Type": "Double", "Entity": null }, { "Name": "Weight", "Description": "The weight for calculation of an aggregated score for several scopes", "Type": "Int64", "Entity": null }, { "Name": "HealthyResources", "Description": "The number of healthy resources", "Type": "Int32", "Entity": null }, { "Name": "UnhealthyResources", "Description": "The number of unhealthy resources", "Type": "Int32", "Entity": null }, { "Name": "NotApplicableResources", "Description": "The number of not applicable resources", "Type": "Int32", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "RecommendationResourceIds", "Description": "The recommendation resource IDs for the recommendations assessed in the control", "Type": "Object", "Entity": null }, { "Name": "ControlType", "Description": "The type of security control (for example, BuiltIn)", "Type": "String", "Entity": null }, { "Name": "ResourceProviderType", "Description": "Resource provider type of the assessed resource", "Type": "String", "Entity": null }, { "Name": "IsSnapshot", "Description": "Indicates whether the data was exported as part of a snapshot when 'true', or streamed in real-time when 'false'.", "Type": "Boolean", "Entity": null }, { "Name": "Environment", "Description": "Data source environment.", "Type": "String", "Entity": null }, { "Name": "Properties", "Description": "The complete set of metadata.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecureScores", "TableSource": "", "Description": "Azure Security Center overall Secure Scores per subscription.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The (UTC) date and time the control score was generated", "Type": "DateTime", "Entity": null }, { "Name": "SecureScoresSubscriptionId", "Description": "The ID of the subscription", "Type": "String", "Entity": null }, { "Name": "AssessedResourceId", "Description": "The ID of the assessed resource", "Type": "String", "Entity": null }, { "Name": "DisplayName", "Description": "Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.", "Type": "String", "Entity": null }, { "Name": "CurrentScore", "Description": "The current secure score per control", "Type": "Double", "Entity": null }, { "Name": "MaxScore", "Description": "The maximum control score", "Type": "Int32", "Entity": null }, { "Name": "PercentageScore", "Description": "The percentage of the score (current score divided by max score)", "Type": "Double", "Entity": null }, { "Name": "Weight", "Description": "The weight for calculation of an aggregated score for several scopes", "Type": "Int64", "Entity": null }, { "Name": "ResourceProviderType", "Description": "Resource provider type of the assessed resource", "Type": "String", "Entity": null }, { "Name": "IsSnapshot", "Description": "Indicates whether the data was exported as part of a snapshot when 'true', or streamed in real-time when 'false'.", "Type": "Boolean", "Entity": null }, { "Name": "Environment", "Description": "Data source environment.", "Type": "String", "Entity": null }, { "Name": "Properties", "Description": "The complete set of metadata.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecurityAlert", "TableSource": "sentinel", "Description": "Alerts that been generated by security products.", "Schema": [ { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "DisplayName", "Description": "Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.", "Type": "String", "Entity": null }, { "Name": "AlertName", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertSeverity", "Description": "", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "ProviderName", "Description": "", "Type": "String", "Entity": null }, { "Name": "VendorName", "Description": "", "Type": "String", "Entity": null }, { "Name": "VendorOriginalId", "Description": "", "Type": "String", "Entity": null }, { "Name": "SystemAlertId", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "AlertType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ConfidenceLevel", "Description": "List of confidence levels of any spam or phishing verdicts. For spam, this column shows the spam confidence level (SCL), indicating if the email was skipped (-1), found to be not spam (0,1), found to be spam with moderate confidence (5,6), or found to be spam with high confidence (9). For phishing, this column displays whether the confidence level is \"High\" or \"Low\".", "Type": "String", "Entity": null }, { "Name": "ConfidenceScore", "Description": "", "Type": "Double", "Entity": null }, { "Name": "IsIncident", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "ProcessingEndTime", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "RemediationSteps", "Description": "", "Type": "String", "Entity": null }, { "Name": "ExtendedProperties", "Description": "", "Type": "String", "Entity": null }, { "Name": "Entities", "Description": "", "Type": "String", "Entity": null }, { "Name": "WorkspaceSubscriptionId", "Description": "", "Type": "String", "Entity": null }, { "Name": "WorkspaceResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ExtendedLinks", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProductName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProductComponentName", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertLink", "Description": "", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "CompromisedEntity", "Description": "", "Type": "String", "Entity": null }, { "Name": "Tactics", "Description": "", "Type": "String", "Entity": null }, { "Name": "Techniques", "Description": "", "Type": "String", "Entity": null }, { "Name": "SubTechniques", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SecurityAttackPathData", "TableSource": "", "Description": "This tables contains attack paths that are being generated by Microsoft Defender for Cloud in order to detect potential breach paths of attackers to your cloud environment.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time the attack path was exported.", "Type": "DateTime", "Entity": null }, { "Name": "AttackPathId", "Description": "The ID of the attack path.", "Type": "String", "Entity": null }, { "Name": "DisplayName", "Description": "Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "EntrypointId", "Description": "The ID of the attack path enry point.", "Type": "String", "Entity": null }, { "Name": "TargetId", "Description": "The ID of the attack path target.", "Type": "String", "Entity": null }, { "Name": "AdditionalRemediationSteps", "Description": "The manual remediation steps of the attack path.", "Type": "String", "Entity": null }, { "Name": "Path", "Description": "The location of the certificate", "Type": "Object", "Entity": null }, { "Name": "Assessments", "Description": "The assessments mapped to the attack path.", "Type": "Object", "Entity": null }, { "Name": "RiskLevel", "Description": "The AAD risk level (Low/Medium/High) of the user account", "Type": "String", "Entity": null }, { "Name": "RiskFactors", "Description": "The risk factors of the attack path.", "Type": "Object", "Entity": null }, { "Name": "PotentialImpact", "Description": "The potenrial impact of the attack path.", "Type": "String", "Entity": null }, { "Name": "Mitre", "Description": "MITRE mapping of the path.", "Type": "String", "Entity": null }, { "Name": "AttackStory", "Description": "The attack story.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecurityBaseline", "TableSource": "", "Description": "", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier of the cloud service subscription", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceProvider", "Description": "", "Type": "String", "Entity": null }, { "Name": "Resource", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceType", "Description": "Type of cloud resource", "Type": "String", "Entity": null }, { "Name": "ComputerEnvironment", "Description": "", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "BaselineType", "Description": "", "Type": "String", "Entity": null }, { "Name": "OSName", "Description": "", "Type": "String", "Entity": null }, { "Name": "AssessmentId", "Description": "", "Type": "String", "Entity": null }, { "Name": "CceId", "Description": "", "Type": "String", "Entity": null }, { "Name": "AzId", "Description": "", "Type": "String", "Entity": null }, { "Name": "RuleSeverity", "Description": "", "Type": "String", "Entity": null }, { "Name": "BaselineRuleType", "Description": "", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "RuleSetting", "Description": "", "Type": "String", "Entity": null }, { "Name": "ExpectedResult", "Description": "", "Type": "String", "Entity": null }, { "Name": "ActualResult", "Description": "", "Type": "String", "Entity": null }, { "Name": "AnalyzeResult", "Description": "", "Type": "String", "Entity": null }, { "Name": "SitePath", "Description": "", "Type": "String", "Entity": null }, { "Name": "AnalyzeOperation", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecurityBaselineSummary", "TableSource": "", "Description": "", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier of the cloud service subscription", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceProvider", "Description": "", "Type": "String", "Entity": null }, { "Name": "Resource", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceType", "Description": "Type of cloud resource", "Type": "String", "Entity": null }, { "Name": "ComputerEnvironment", "Description": "", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "BaselineType", "Description": "", "Type": "String", "Entity": null }, { "Name": "OSName", "Description": "", "Type": "String", "Entity": null }, { "Name": "AssessmentId", "Description": "", "Type": "String", "Entity": null }, { "Name": "TotalAssessedRules", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "PercentageOfPassedRules", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "CriticalFailedRules", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "WarningFailedRules", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "InformationalFailedRules", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecurityCaseEvent", "TableSource": "sentinel", "Description": "Audit log table tracking all field-level changes to Case Management entities including cases, tasks, comments, attachments, and relations.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp when the record was ingested into Log Analytics.", "Type": "DateTime", "Entity": null }, { "Name": "RecordId", "Description": "Unique identifier for this audit record.", "Type": "String", "Entity": null }, { "Name": "AadTenantId", "Description": "Azure AD tenant GUID where the change occurred.", "Type": "String", "Entity": null }, { "Name": "EntityType", "Description": "Type of object, such as a file, a process, a device, or a user", "Type": "String", "Entity": null }, { "Name": "EntityId", "Description": "Unique identifier of the changed entity.", "Type": "String", "Entity": null }, { "Name": "ParentEntityId", "Description": "Parent entity ID. Null for Case entities, contains Case ID for child entities like CaseTask, Comment, Attachment, etc.", "Type": "String", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "PropertyNames", "Description": "Property name(s) that changed.", "Type": "Object", "Entity": null }, { "Name": "PreviousValues", "Description": "Previous value(s) before the change. Null for Create operations. Can be a simple value or JSON object.", "Type": "Object", "Entity": null }, { "Name": "NewValues", "Description": "New value(s) after the change. Null for Delete operations. Can be a simple value or JSON object.", "Type": "Object", "Entity": null }, { "Name": "EventTime", "Description": "Indicates the timestamp of when the event occurred", "Type": "DateTime", "Entity": null }, { "Name": "ModifiedBy", "Description": "User principal name (UPN) of the user who made the change.", "Type": "String", "Entity": null }, { "Name": "IsDeleted", "Description": "Indicates if the entity was deleted.", "Type": "Boolean", "Entity": null }, { "Name": "EntityCreatedTime", "Description": "Original creation timestamp of the entity.", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "SecurityDetection", "TableSource": "", "Description": "", "Schema": [ { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "Provider", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertTitle", "Description": "", "Type": "String", "Entity": null }, { "Name": "AlertSeverity", "Description": "", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "RemediationSteps", "Description": "", "Type": "String", "Entity": null }, { "Name": "OriginalSeverity", "Description": "", "Type": "String", "Entity": null }, { "Name": "DetectionID", "Description": "", "Type": "String", "Entity": null }, { "Name": "SubjectUserName", "Description": "", "Type": "String", "Entity": null }, { "Name": "SubjectDomainName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProcessName", "Description": "The name of the process", "Type": "String", "Entity": null }, { "Name": "CommandLine", "Description": "", "Type": "String", "Entity": null }, { "Name": "LogChannel", "Description": "", "Type": "String", "Entity": null }, { "Name": "Duration", "Description": "", "Type": "String", "Entity": null }, { "Name": "InvalidAccountsSeen", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "ValidAccountsSeen", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "SuccessfulLogins", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "FailedAttempts", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "AccountsSeen", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "SuspiciousProcess", "Description": "", "Type": "String", "Entity": null }, { "Name": "FullPath", "Description": "", "Type": "String", "Entity": null }, { "Name": "ChildProcess", "Description": "", "Type": "String", "Entity": null }, { "Name": "ParentProcess", "Description": "", "Type": "String", "Entity": null }, { "Name": "ExtendedProperties", "Description": "", "Type": "String", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier of the cloud service subscription", "Type": "String", "Entity": null }, { "Name": "ServiceId", "Description": "", "Type": "String", "Entity": null }, { "Name": "IsFirstParty", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "ReportingSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "OccuringDatacenter", "Description": "", "Type": "String", "Entity": null }, { "Name": "AssociatedResource", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecurityEvent", "TableSource": "sentinel", "Description": "Security events collected from windows machines by Azure Security Center or Azure Sentinel.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time stamp when the event was generated on the computer.", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "The Log Analytics source system. Value is always 'OpsManager'.", "Type": "String", "Entity": null }, { "Name": "Account", "Description": "An identifier for the account as found by Microsoft Defender for Cloud. Could be Microsoft Entra ID, user principal name, IaM role or other identifiers", "Type": "String", "Entity": null }, { "Name": "AccountType", "Description": "Type of user account, indicating its general role and access levels, such as Regular, System, Admin, Application", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "The name of the computer on which the event occurred.", "Type": "String", "Entity": null }, { "Name": "EventSourceName", "Description": "The name of the software that logs the event (applicationor a succomponent).", "Type": "String", "Entity": null }, { "Name": "Channel", "Description": "The channel to which the event was logged.", "Type": "String", "Entity": null }, { "Name": "Task", "Description": "The task defined in the event.", "Type": "Int32", "Entity": null }, { "Name": "Level", "Description": "Windows categorizes every event with a severity level. The levels in order of severity are information, verbose, warning, error and critical expressed in numbers.", "Type": "String", "Entity": null }, { "Name": "EventData", "Description": "Event specific data associated with the event.", "Type": "String", "Entity": null }, { "Name": "EventID", "Description": "The identifier that the provider used to identify the event.", "Type": "Int32", "Entity": null }, { "Name": "Activity", "Description": "Sensor activity", "Type": "String", "Entity": null }, { "Name": "StorageAccount", "Description": "Sets the storage account access key.", "Type": "String", "Entity": null }, { "Name": "AzureDeploymentID", "Description": "Azure deployment ID of the cloud service the log belongs to.", "Type": "String", "Entity": null }, { "Name": "AccessMask", "Description": "Hexadecimal mask for the requested or performed operation.", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountExpires", "Description": "The date when the account expires.", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountSessionIdentifier", "Description": "A unique identifier that is generated by the machine when the session is created.", "Type": "String", "Entity": null }, { "Name": "AdditionalInfo", "Description": "Additional information that is provided by the source, which do not mapped to other fields, represented by list.", "Type": "String", "Entity": null }, { "Name": "AdditionalInfo2", "Description": "Additional information that is provided by the source, which do not mapped to other fields, represented by list.", "Type": "String", "Entity": null }, { "Name": "AllowedToDelegateTo", "Description": "The list of SPNs to which this account can present delegated credentials.", "Type": "String", "Entity": null }, { "Name": "Attributes", "Description": "Additional information about the event.", "Type": "String", "Entity": null }, { "Name": "AuditPolicyChanges", "Description": "Events that are generated when changes are made to the system audit policy or audit settings on a file or registry key.", "Type": "String", "Entity": null }, { "Name": "AuditsDiscarded", "Description": "Number of audit messages that were discarded.", "Type": "Int32", "Entity": null }, { "Name": "AuthenticationLevel", "Description": "Number of audit messages that were discarded.", "Type": "Int32", "Entity": null }, { "Name": "AuthenticationPackageName", "Description": "the name of loaded Authentication Package. The format is: DLL\\_PATH\\_AND\\_NAME: AUTHENTICATION\\_PACKAGE\\_NAME.", "Type": "String", "Entity": null }, { "Name": "AuthenticationProvider", "Description": "The identity of the provider responsible for the authentication process (can include a certificate authority, a username, a password authentication system, etc).", "Type": "String", "Entity": null }, { "Name": "AuthenticationServer", "Description": "The server in which located the authentication provider.", "Type": "String", "Entity": null }, { "Name": "AuthenticationService", "Description": "The service in which located the authentication provider.", "Type": "Int32", "Entity": null }, { "Name": "AuthenticationType", "Description": "the type of authentication that was used for the event (two-factor authentication, biometric authentication, etc).", "Type": "String", "Entity": null }, { "Name": "CACertificateHash", "Description": "The hash value of the certificate authority's (CA) certificate that was used to authenticate the user who performed the event.", "Type": "String", "Entity": null }, { "Name": "CalledStationID", "Description": "Information about the ID of the station that initiated the action that led to the security event.", "Type": "String", "Entity": null }, { "Name": "CallerProcessId", "Description": "Hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process.", "Type": "String", "Entity": null }, { "Name": "CallerProcessName", "Description": "Full path and the name of the executable for the process.", "Type": "String", "Entity": null }, { "Name": "CallingStationID", "Description": "Information about the ID of the station that initiated the action that led to the security event.", "Type": "String", "Entity": null }, { "Name": "CAPublicKeyHash", "Description": "Hash value that identifies the public key of a certification authority (CA) that issued a certificate.", "Type": "String", "Entity": null }, { "Name": "CategoryId", "Description": "The category of the security event that occurred (login attempt, data breach, etc).", "Type": "String", "Entity": null }, { "Name": "CertificateDatabaseHash", "Description": "Hash value that identifies the database that issued a certificate.", "Type": "String", "Entity": null }, { "Name": "ClassId", "Description": "'Class Guid' attribute of device.", "Type": "String", "Entity": null }, { "Name": "ClassName", "Description": "'Class' attribute of device.", "Type": "String", "Entity": null }, { "Name": "ClientAddress", "Description": "IP address of the computer from which the TGT request was received.", "Type": "String", "Entity": null }, { "Name": "ClientIPAddress", "Description": "IP address of the computer that initiated the action that led to the event.", "Type": "String", "Entity": null }, { "Name": "ClientName", "Description": "computer name from which the user was reconnected. Has 'Unknown' value for console session.", "Type": "String", "Entity": null }, { "Name": "CommandLine", "Description": "The command line arguments that were passed to an application or process that was involved in the event.", "Type": "String", "Entity": null }, { "Name": "CompatibleIds", "Description": "'Compatible Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':", "Type": "String", "Entity": null }, { "Name": "DCDNSName", "Description": "The DNS name of the domain controller that was involved in the event.", "Type": "String", "Entity": null }, { "Name": "DeviceDescription", "Description": "the description of the device that was involved in the event.", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "DisplayName", "Description": "Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.", "Type": "String", "Entity": null }, { "Name": "Disposition", "Description": "The event outcome/ resolution, such as whether the event was resolved or whether any action was taken in response to the event.", "Type": "String", "Entity": null }, { "Name": "DomainBehaviorVersion", "Description": "msDS-Behavior-Version domain attribute was modified. Numeric value.", "Type": "String", "Entity": null }, { "Name": "DomainName", "Description": "Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack", "Type": "String", "Entity": null }, { "Name": "DomainPolicyChanged", "Description": "Indicates whether any domain policies have been changed as part of the event (password policies, security policies, etc).", "Type": "String", "Entity": null }, { "Name": "DomainSid", "Description": "SID of the trust partner. This parameter might not be captured in the event, and in that case appears as 'NULL SID'.", "Type": "String", "Entity": null }, { "Name": "EAPType", "Description": "The type of Extensible Authentication Protocol (EAP) that was used for the event authentication process.", "Type": "String", "Entity": null }, { "Name": "ElevatedToken", "Description": "A 'Yes' or 'No' flag. If 'Yes', then the session this event represents is elevated and has administrator privileges.", "Type": "String", "Entity": null }, { "Name": "ErrorCode", "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Type": "Int32", "Entity": null }, { "Name": "ExtendedQuarantineState", "Description": "The state of the network quarantine process, if applicable. Network quarantine is a process by which unauthorized devices are prevented from accessing a network until they meet certain security requirements or have been checked for malware.", "Type": "String", "Entity": null }, { "Name": "FailureReason", "Description": "Information explaining why the recorded action failed", "Type": "String", "Entity": null }, { "Name": "FileHash", "Description": "The hash value for any files that are were accessed or modified as part of the event, or any files that were used in the authentication or authorization process.", "Type": "String", "Entity": null }, { "Name": "FilePath", "Description": "Full path and filename of the key file on which the operation was performed.", "Type": "String", "Entity": null }, { "Name": "FilePathNoUser", "Description": "The path of any files that are related to the event, excluding the username or other user-specific information.", "Type": "String", "Entity": null }, { "Name": "Filter", "Description": "Filters that are used in the performed event.", "Type": "String", "Entity": null }, { "Name": "ForceLogoff", "Description": "'\\Security Settings\\Local Policies\\Security Options\\Network security: Force logoff when logon hours expire' group policy.", "Type": "String", "Entity": null }, { "Name": "Fqbn", "Description": "The fully qualified binary name (FQBN) for any files that are related to the event.", "Type": "String", "Entity": null }, { "Name": "FullyQualifiedSubjectMachineName", "Description": "The fully qualified domain name (FQDN) of the machine that initiated the event.", "Type": "String", "Entity": null }, { "Name": "FullyQualifiedSubjectUserName", "Description": "The username of the user or service that initiated the event in FQDN format.", "Type": "String", "Entity": null }, { "Name": "GroupMembership", "Description": "Account's group membership description", "Type": "String", "Entity": null }, { "Name": "HandleId", "Description": "Hexadecimal value of a handle to Object Name. This field can be used for correlation with other events.", "Type": "String", "Entity": null }, { "Name": "HardwareIds", "Description": "'Hardware Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':", "Type": "String", "Entity": null }, { "Name": "HomeDirectory", "Description": "User's home directory. If homeDrive attribute is set and specifies a drive letter, homeDirectory should be a UNC path. The path must be a network UNC of the form \\\\Server\\Share\\Directory.", "Type": "String", "Entity": null }, { "Name": "HomePath", "Description": "User's home path. The path must be a network UNC of the form \\\\Server\\Share\\Directory.", "Type": "String", "Entity": null }, { "Name": "InterfaceUuid", "Description": "Unique identifier (UUID) for the Remote Procedure Call (RPC) interface that the attacker attempted to access", "Type": "String", "Entity": null }, { "Name": "IpAddress", "Description": "IP address that the attacker attempted to access", "Type": "String", "Entity": null }, { "Name": "IpPort", "Description": "The network port number associated with the event.", "Type": "String", "Entity": null }, { "Name": "KeyLength", "Description": "The length of NTLM Session Security key. Typically it has 128 bit or 56 bit length.", "Type": "Int32", "Entity": null }, { "Name": "LmPackageName", "Description": "The name of the package or software component that is currently using the Local Security Authority (LSA) on the machine where the event is being generated.", "Type": "String", "Entity": null }, { "Name": "LocationInformation", "Description": "'Location information' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':", "Type": "String", "Entity": null }, { "Name": "LockoutDuration", "Description": "'\\Security Settings\\Account Policies\\Account Lockout Policy\\Account lockout duration' group policy. Numeric value.", "Type": "String", "Entity": null }, { "Name": "LockoutObservationWindow", "Description": "'\\Security Settings\\Account Policies\\Account Lockout Policy\\Reset account lockout counter after' group policy. Numeric value.", "Type": "String", "Entity": null }, { "Name": "LockoutThreshold", "Description": "'\\Security Settings\\Account Policies\\Account Lockout Policy\\Account lockout threshold' group policy. Numeric value.", "Type": "String", "Entity": null }, { "Name": "LoggingResult", "Description": "The result of the logon process.", "Type": "String", "Entity": null }, { "Name": "LogonGuid", "Description": "A GUID that can help you correlate this event with another event that can contain the same Logon GUID.", "Type": "String", "Entity": null }, { "Name": "LogonHours", "Description": "Hours that the account is allowed to logon to the domain.", "Type": "String", "Entity": null }, { "Name": "LogonID", "Description": "Hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID.", "Type": "String", "Entity": null }, { "Name": "LogonProcessName", "Description": "The name of registered logon process.", "Type": "String", "Entity": null }, { "Name": "LogonType", "Description": "Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service", "Type": "Int32", "Entity": null }, { "Name": "LogonTypeName", "Description": "The type of logon or authentication event that is being captured by the event log (common values:Interactive, Network, RemoteInteractive, Unlock).", "Type": "String", "Entity": null }, { "Name": "MachineAccountQuota", "Description": "ms-DS-MachineAccountQuota domain attribute was modified. Numeric value.", "Type": "String", "Entity": null }, { "Name": "MachineInventory", "Description": "Information about the hardware configuration and software environment of the computer where the event is being generated. It can include different data points, for instance: the make and model of the computer, the amount of RAM or storage space available, the version numbers of various software applications, etc).", "Type": "String", "Entity": null }, { "Name": "MachineLogon", "Description": "Information about a successful logon event in the machine.", "Type": "String", "Entity": null }, { "Name": "MandatoryLabel", "Description": "ID of integrity label which was assigned to the new process.", "Type": "String", "Entity": null }, { "Name": "MaxPasswordAge", "Description": "The period of time (in days) that a password can be used before the system requires the user to change it.", "Type": "String", "Entity": null }, { "Name": "MemberName", "Description": "The user account that was involved in the event.", "Type": "String", "Entity": null }, { "Name": "MemberSid", "Description": "The security identifier (SID) associated with the user account that was involved in the event.", "Type": "String", "Entity": null }, { "Name": "MinPasswordAge", "Description": "The period of time (in days) that a password must be used before the system requires the user to change it.", "Type": "String", "Entity": null }, { "Name": "MinPasswordLength", "Description": "The least number of characters that can make up a password for a user account.", "Type": "String", "Entity": null }, { "Name": "MixedDomainMode", "Description": "The domain mode of a system or domain controller.", "Type": "String", "Entity": null }, { "Name": "NASIdentifier", "Description": "The identifier of the network access server (NAS) that was involved in the event.", "Type": "String", "Entity": null }, { "Name": "NASIPv4Address", "Description": "The IPv4Address of the network access server (NAS) that was involved in the event, if applicable.", "Type": "String", "Entity": null }, { "Name": "NASIPv6Address", "Description": "The IPv6Address of the network access server (NAS) that was involved in the event, if applicable.", "Type": "String", "Entity": null }, { "Name": "NASPort", "Description": "the port on the network access server that was used in the event.", "Type": "String", "Entity": null }, { "Name": "NASPortType", "Description": "the type of network access server (NAS) used in the event.", "Type": "String", "Entity": null }, { "Name": "NetworkPolicyName", "Description": "The name of the network policy associated with the event.", "Type": "String", "Entity": null }, { "Name": "NewDate", "Description": "New date in UTC time zone. The format is YYYY-MM-DD.", "Type": "String", "Entity": null }, { "Name": "NewMaxUsers", "Description": "The new maximum number of users allowed for a resource in the event.", "Type": "String", "Entity": null }, { "Name": "NewProcessId", "Description": "Hexadecimal Process ID of the new process. Process ID (PID) is a number used by the operating system to uniquely identify an active process.", "Type": "String", "Entity": null }, { "Name": "NewProcessName", "Description": "Full path and the name of the executable for the new process.", "Type": "String", "Entity": null }, { "Name": "NewRemark", "Description": "The new value of network share 'Comments:' field. Has 'N/A' value if it isn't set.", "Type": "String", "Entity": null }, { "Name": "NewShareFlags", "Description": "The share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.", "Type": "String", "Entity": null }, { "Name": "NewTime", "Description": "New time that was set in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ", "Type": "String", "Entity": null }, { "Name": "NewUacValue", "Description": "Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account.", "Type": "String", "Entity": null }, { "Name": "NewValue", "Description": "New value for changed registry key value.", "Type": "String", "Entity": null }, { "Name": "NewValueType", "Description": "New type of changed registry key value.", "Type": "String", "Entity": null }, { "Name": "ObjectName", "Description": "Name of the object that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "ObjectServer", "Description": "Contains the name of the Windows subsystem calling the routine.", "Type": "String", "Entity": null }, { "Name": "ObjectType", "Description": "The type of object, such as a file or a folder, that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "ObjectValueName", "Description": "The name of modified registry key value.", "Type": "String", "Entity": null }, { "Name": "OemInformation", "Description": "The original equipment manufacturer (OEM) associated with a device or system in the event.", "Type": "String", "Entity": null }, { "Name": "OldMaxUsers", "Description": "The previous maximum number of users allowed for a resource in the event.", "Type": "String", "Entity": null }, { "Name": "OldRemark", "Description": "the old value of network share 'Comments:' field. Has 'N/A' value if it isn't set.", "Type": "String", "Entity": null }, { "Name": "OldShareFlags", "Description": "The previous share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.", "Type": "String", "Entity": null }, { "Name": "OldUacValue", "Description": "Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the previous value of userAccountControl attribute of user object.", "Type": "String", "Entity": null }, { "Name": "OldValue", "Description": "Old value for changed registry key value.", "Type": "String", "Entity": null }, { "Name": "OldValueType", "Description": "Old type of changed registry key value.", "Type": "String", "Entity": null }, { "Name": "OperationType", "Description": "The type of operation which was performed on an object", "Type": "String", "Entity": null }, { "Name": "PackageName", "Description": "The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon.", "Type": "String", "Entity": null }, { "Name": "ParentProcessName", "Description": "The name of the parent process", "Type": "String", "Entity": null }, { "Name": "PasswordHistoryLength", "Description": "\\Security Settings\\Account Policies\\Password Policy\\Enforce password history” group policy. Numeric value.", "Type": "String", "Entity": null }, { "Name": "PasswordLastSet", "Description": "Last time the account’s password was modified.", "Type": "String", "Entity": null }, { "Name": "PasswordProperties", "Description": "The password policies or properties associated with the event, for example: password length, complexity and expiration date.", "Type": "String", "Entity": null }, { "Name": "PreviousDate", "Description": "The previous date associated with the event.", "Type": "String", "Entity": null }, { "Name": "PreviousTime", "Description": "Previous time in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ.", "Type": "String", "Entity": null }, { "Name": "PrimaryGroupId", "Description": "Relative Identifier (RID) of user’s object primary group.", "Type": "String", "Entity": null }, { "Name": "PrivateKeyUsageCount", "Description": "The number of times a private key has been used.", "Type": "String", "Entity": null }, { "Name": "PrivilegeList", "Description": "The privileges, including user, group, or system privileges associated with the event.", "Type": "String", "Entity": null }, { "Name": "Process", "Description": "The name of the process that generates the event.", "Type": "String", "Entity": null }, { "Name": "ProcessId", "Description": "Process ID (PID) of the newly created process", "Type": "String", "Entity": null }, { "Name": "ProcessName", "Description": "The name of the process", "Type": "String", "Entity": null }, { "Name": "Properties", "Description": "Depends on Object Type. This field can be empty or contain the list of the object properties that were accessed.", "Type": "String", "Entity": null }, { "Name": "ProfilePath", "Description": "Specifies a path to the account's profile. This value can be a null string, a local absolute path, or a UNC path.", "Type": "String", "Entity": null }, { "Name": "ProtocolSequence", "Description": "Information about the protocol used for an authentication attempt.", "Type": "String", "Entity": null }, { "Name": "ProxyPolicyName", "Description": "Name of the policy that was used to configure the proxy server for connecting to the network.", "Type": "String", "Entity": null }, { "Name": "QuarantineHelpURL", "Description": "URL that provides help with troubleshooting a network quarantine issue.", "Type": "String", "Entity": null }, { "Name": "QuarantineSessionID", "Description": "Identifier of the session where the file was assessed for quarantine.", "Type": "String", "Entity": null }, { "Name": "QuarantineSessionIdentifier", "Description": "Identifier of the session where the file was assessed for quarantine.", "Type": "String", "Entity": null }, { "Name": "QuarantineState", "Description": "It shows whether the file is quarantined.", "Type": "String", "Entity": null }, { "Name": "QuarantineSystemHealthResult", "Description": "Report that shows the status of the files that have been quarantined.", "Type": "String", "Entity": null }, { "Name": "RelativeTargetName", "Description": "Relative name of the accessed target file or folder. This file-path is relative to the network share. If access was requested for the share itself, then this field appears as “\\”.", "Type": "String", "Entity": null }, { "Name": "RemoteIpAddress", "Description": "The IP address of the computer that initiated a remote connection.", "Type": "String", "Entity": null }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "String", "Entity": null }, { "Name": "Requester", "Description": "The event requester identifier.", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "RestrictedAdminMode", "Description": "Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.", "Type": "String", "Entity": null }, { "Name": "RowsDeleted", "Description": "The number of rows that were deleted as a part of a particular operation.", "Type": "String", "Entity": null }, { "Name": "SamAccountName", "Description": "logon name for account used to support clients and servers from previous versions of Windows (pre-Windows 2000 logon name).", "Type": "String", "Entity": null }, { "Name": "ScriptPath", "Description": "Specifies the path of the account’s logon script.", "Type": "String", "Entity": null }, { "Name": "SecurityDescriptor", "Description": "Information about the security settings and permissions of a particular object or resource.", "Type": "String", "Entity": null }, { "Name": "ServiceAccount", "Description": "The security context that the service will run as when started.", "Type": "String", "Entity": null }, { "Name": "ServiceFileName", "Description": "Indicates the type of service that was registered with the Service Control Manager.", "Type": "String", "Entity": null }, { "Name": "ServiceName", "Description": "The name of installed service.", "Type": "String", "Entity": null }, { "Name": "ServiceStartType", "Description": "Contains information about how a particular service should be started, whether it should be started automatically or manually.", "Type": "Int32", "Entity": null }, { "Name": "ServiceType", "Description": "Indicates the type of service that was registered with the Service Control Manager.", "Type": "String", "Entity": null }, { "Name": "SessionName", "Description": "The name of the session to which the user was reconnected.", "Type": "String", "Entity": null }, { "Name": "ShareLocalPath", "Description": "The local path of accessed network share.", "Type": "String", "Entity": null }, { "Name": "ShareName", "Description": "Name of shared folder containing the file", "Type": "String", "Entity": null }, { "Name": "SidHistory", "Description": "Contains previous SIDs used for the object if the object was moved from another domain.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "SubjectAccount", "Description": "Information about the account that is initiating the event.", "Type": "String", "Entity": null }, { "Name": "SubcategoryGuid", "Description": "The unique GUID of changed subcategory.", "Type": "String", "Entity": null }, { "Name": "SubcategoryId", "Description": "A unique identifier for a specific type of the event.", "Type": "String", "Entity": null }, { "Name": "Subject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "SubjectDomainName", "Description": "Information about the domain or workgroup to which the subject account belongs.", "Type": "String", "Entity": null }, { "Name": "SubjectKeyIdentifier", "Description": "A unique identifier for a particular certificate subject.", "Type": "String", "Entity": null }, { "Name": "SubjectLogonId", "Description": "A unique identifier for the logon session associated with the subject account.", "Type": "String", "Entity": null }, { "Name": "SubjectMachineName", "Description": "Information about the machine or system from which the event was created.", "Type": "String", "Entity": null }, { "Name": "SubjectMachineSID", "Description": "The security identifier (SID) for the machine that generated the event.", "Type": "String", "Entity": null }, { "Name": "SubjectUserName", "Description": "The name of the user account that generated the event.", "Type": "String", "Entity": null }, { "Name": "SubjectUserSid", "Description": "The security identifier (SID) for the user account that generated the event.", "Type": "String", "Entity": null }, { "Name": "SubStatus", "Description": "Additional information about logon failure. The most common substatus codes listed in the 'Table 12. Windows logon status codes'.", "Type": "String", "Entity": null }, { "Name": "TableId", "Description": "The specific data table identifier the event data is stored in.", "Type": "String", "Entity": null }, { "Name": "TargetAccount", "Description": "The account targeted by the event (user name, computer name, etc).", "Type": "String", "Entity": null }, { "Name": "TargetDomainName", "Description": "Domain name of the device that was targeted or attacked", "Type": "String", "Entity": null }, { "Name": "TargetInfo", "Description": "Additional information about the event target (for example: the path to a file or folder, the name of a registry key, etc).", "Type": "String", "Entity": null }, { "Name": "TargetLinkedLogonId", "Description": "Information that helps to link related events together by their logon attempt IDs. It can be useful in keeping all relevant events organized, tracking activity across multiple sessions, and identifying the attack source.", "Type": "String", "Entity": null }, { "Name": "TargetLogonGuid", "Description": "A globally unique identifier (GUID) associated with the logon session related to the event.", "Type": "String", "Entity": null }, { "Name": "TargetLogonId", "Description": "A unique identifier associated with the logon session related to the event.", "Type": "String", "Entity": null }, { "Name": "TargetOutboundDomainName", "Description": "The domain that the account specified in the TargetAccount field was authenticated against during an outbound authentication attempt.", "Type": "String", "Entity": null }, { "Name": "TargetOutboundUserName", "Description": "The name of the user account that was authenticated during an outbound authentication attempt.", "Type": "String", "Entity": null }, { "Name": "TargetServerName", "Description": "The name of the server on which the new process was run. Has “localhost” value if the process was run locally.", "Type": "String", "Entity": null }, { "Name": "TargetSid", "Description": "The security identifier (SID) of the server on which the new process was run.", "Type": "String", "Entity": null }, { "Name": "TargetUser", "Description": "The user account identifier that generated the new process.", "Type": "String", "Entity": null }, { "Name": "TargetUserName", "Description": "The name of the user account that generated the new process.", "Type": "String", "Entity": null }, { "Name": "TargetUserSid", "Description": "The security identifier (SID) associated with the user or resource involved in the event.", "Type": "String", "Entity": null }, { "Name": "TemplateContent", "Description": "The content of the event message or notification in a structured form.", "Type": "String", "Entity": null }, { "Name": "TemplateDSObjectFQDN", "Description": "FQDN of the DS object that represents the GPO template.", "Type": "String", "Entity": null }, { "Name": "TemplateInternalName", "Description": "The internal name of the GPO template.", "Type": "String", "Entity": null }, { "Name": "TemplateOID", "Description": "the unique identifier for the template that was used to create the event.", "Type": "String", "Entity": null }, { "Name": "TemplateSchemaVersion", "Description": "Version of the template schema that defines the data to include with an event.", "Type": "String", "Entity": null }, { "Name": "TemplateVersion", "Description": "Version of the template that defines the data to include with an event.", "Type": "String", "Entity": null }, { "Name": "TokenElevationType", "Description": "Type of token that was assigned to a new process in accordance with User Account Control Policy.", "Type": "String", "Entity": null }, { "Name": "TransmittedServices", "Description": "The list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see https://msdn.microsoft.com/library/cc246072.aspx.", "Type": "String", "Entity": null }, { "Name": "UserAccountControl", "Description": "Security attributes of the user account in the AD domain.", "Type": "String", "Entity": null }, { "Name": "UserParameters", "Description": "If you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see in this field. For local accounts, this field is not applicable and always has value.", "Type": "String", "Entity": null }, { "Name": "UserPrincipalName", "Description": "Internet-style login name for the account, based on the Internet standard RFC 822. By convention this should map to the account's email name.", "Type": "String", "Entity": null }, { "Name": "UserWorkstations", "Description": "Contains the list of NetBIOS or DNS names of the computers from which the user can logon. Each computer name is separated by a comma. The name of a computer is the sAMAccountName property of a computer object.", "Type": "String", "Entity": null }, { "Name": "VirtualAccount", "Description": "A 'Yes' or 'No' flag, which indicates if the account is a virtual account (e.g., 'Managed Service Account'), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using 'NetworkService'.", "Type": "String", "Entity": null }, { "Name": "VendorIds", "Description": "'Hardware Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details'.", "Type": "String", "Entity": null }, { "Name": "Workstation", "Description": "The name of the machine that was used to perform the event.", "Type": "String", "Entity": null }, { "Name": "WorkstationName", "Description": "Machine name from which a logon attempt was performed.", "Type": "String", "Entity": null }, { "Name": "EventLevelName", "Description": "The rendered message string of the level specified in the event.", "Type": "String", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "Additional information based on the resource type.", "Type": "String", "Entity": null }, { "Name": "SystemUserId", "Description": "The ID of the user who is responsible for the event.", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "Int32", "Entity": null }, { "Name": "Opcode", "Description": "The opcode element is defined by the SystemPropertiesType complex type.", "Type": "String", "Entity": null }, { "Name": "Keywords", "Description": "A bitmask of the keywords defined in the event.", "Type": "String", "Entity": null }, { "Name": "Correlation", "Description": "The activity identifiers that consumers can use to group related events together.", "Type": "String", "Entity": null }, { "Name": "SystemProcessId", "Description": "Identifies the process that generated the event.", "Type": "Int32", "Entity": null }, { "Name": "SystemThreadId", "Description": "Identifies the thread that generated the event.", "Type": "Int32", "Entity": null }, { "Name": "EventRecordId", "Description": "The record number assigned to the event when it was logged.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SecurityIncident", "TableSource": "sentinel", "Description": "Incidents generated by security products.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp (UTC) of when the incident was ingested", "Type": "DateTime", "Entity": null }, { "Name": "IncidentName", "Description": "The resource name of the incident", "Type": "String", "Entity": null }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Classification", "Description": "The classification the incident was given when closed", "Type": "String", "Entity": null }, { "Name": "ClassificationComment", "Description": "Description of the reason the incident was closed", "Type": "String", "Entity": null }, { "Name": "ClassificationReason", "Description": "The classification reason the incident was given when closed", "Type": "String", "Entity": null }, { "Name": "Owner", "Description": "The user the incident is assigned to", "Type": "Object", "Entity": null }, { "Name": "ProviderName", "Description": "The name of the source provider that generated the incident", "Type": "String", "Entity": null }, { "Name": "ProviderIncidentId", "Description": "The incident ID assigned by the incident provider", "Type": "String", "Entity": null }, { "Name": "FirstActivityTime", "Description": "Timestamp (UTC) of when the first activity in the incident occured", "Type": "DateTime", "Entity": null }, { "Name": "LastActivityTime", "Description": "Timestamp (UTC) of when the last activity in the incident occured", "Type": "DateTime", "Entity": null }, { "Name": "FirstModifiedTime", "Description": "Timestamp (UTC) of when the incident was first modified", "Type": "DateTime", "Entity": null }, { "Name": "LastModifiedTime", "Description": "Date and time the item or related metadata was last modified", "Type": "DateTime", "Entity": null }, { "Name": "CreatedTime", "Description": "Timestamp (UTC) of when the incident was created", "Type": "DateTime", "Entity": null }, { "Name": "ClosedTime", "Description": "Timestamp (UTC) of when the incident was last closed", "Type": "DateTime", "Entity": null }, { "Name": "IncidentNumber", "Description": "The sequential number of the incident", "Type": "Int32", "Entity": null }, { "Name": "RelatedAnalyticRuleIds", "Description": "The IDs of the Analytic rules associated with the incident", "Type": "Object", "Entity": null }, { "Name": "AlertIds", "Description": "The IDs of the alerts related to the incident", "Type": "Object", "Entity": null }, { "Name": "BookmarkIds", "Description": "The IDs of the bookmarks related to the incident", "Type": "Object", "Entity": null }, { "Name": "Comments", "Description": "The comments added to the incident", "Type": "Object", "Entity": null }, { "Name": "Tasks", "Description": "The tasks added to the incident", "Type": "Object", "Entity": null }, { "Name": "Labels", "Description": "The labels added to the incident", "Type": "Object", "Entity": null }, { "Name": "IncidentUrl", "Description": "The URI to open the incident in Azure Sentinel portal", "Type": "String", "Entity": null }, { "Name": "AdditionalData", "Description": "Additional data on the incident", "Type": "Object", "Entity": null }, { "Name": "ModifiedBy", "Description": "The source of the change in the incident", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SecurityNestedRecommendation", "TableSource": "", "Description": "Nested recommendations can be thought of as 'sub' recommendations grouped into a 'parent' recommendation. To view nested recommendations, open the 'parent' from the recommendations page in Security Center. For example, if a vulnerability scan of your SQL databases returns 100 findings, each finding will be available as a nested recommendation within the parent recommendation 'Vulnerabilities on your SQL databases should be remediated'.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time the sub-assessment was exported", "Type": "DateTime", "Entity": null }, { "Name": "SubAssessmentTimeGeneration", "Description": "The date and time the sub-assessment was generated", "Type": "DateTime", "Entity": null }, { "Name": "RecommendationSubscriptionId", "Description": "Recommendation's subscription Id", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "Resource group name", "Type": "String", "Entity": null }, { "Name": "AssessedResourceId", "Description": "Id of the assessed resource", "Type": "String", "Entity": null }, { "Name": "ParentRecommendationId", "Description": "Id of the parent recommendation", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "RecommendationName", "Description": "Display name of the sub-assessment", "Type": "String", "Entity": null }, { "Name": "NestedRecommendationId", "Description": "Id of the nested-recommendation", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "RecommendationSeverity", "Description": "The sub-assessment severity level", "Type": "String", "Entity": null }, { "Name": "RecommendationState", "Description": "The sub-assessment state", "Type": "String", "Entity": null }, { "Name": "RemediationDescription", "Description": "Information on how to remediate this sub-assessment", "Type": "String", "Entity": null }, { "Name": "AdditionalData", "Description": "Additional details of the sub-assessment", "Type": "Object", "Entity": null }, { "Name": "ResourceProviderType", "Description": "Resource provider type of the assessed resource", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ResourceDetails", "Description": "Details of the resource that was assessed", "Type": "Object", "Entity": null }, { "Name": "Impact", "Description": "Description of the impact of this sub-assessment", "Type": "String", "Entity": null }, { "Name": "Cause", "Description": "Cause of the assessment status", "Type": "String", "Entity": null }, { "Name": "VulnerabilityId", "Description": "Vulnerability Id", "Type": "String", "Entity": null }, { "Name": "IsSnapshot", "Description": "Indicates whether the data was exported as part of a snapshot when 'true', or streamed in real-time when 'false'.", "Type": "Boolean", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "RemidiationDescription", "Description": "Information on how to remediate this sub-assessment", "Type": "String", "Entity": null }, { "Name": "RecommendationLink", "Description": "Recommendation link URL", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecurityRecommendation", "TableSource": "", "Description": "", "Schema": [ { "Name": "RecommendationId", "Description": "", "Type": "String", "Entity": null }, { "Name": "RecommendationName", "Description": "", "Type": "String", "Entity": null }, { "Name": "RecommendationDisplayName", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProviderName", "Description": "", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "RecommendationState", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "DiscoveredTimeUTC", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "ResolvedTimeUTC", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "PolicyDefinitionId", "Description": "", "Type": "String", "Entity": null }, { "Name": "RecommendationSeverity", "Description": "", "Type": "String", "Entity": null }, { "Name": "AssessedResourceId", "Description": "", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "ResourceRegion", "Description": "", "Type": "String", "Entity": null }, { "Name": "IsSnapshot", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "RecommendationAdditionalData", "Description": "", "Type": "Object", "Entity": null }, { "Name": "FirstEvaluationDate", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "StatusChangeDate", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "Environment", "Description": "", "Type": "String", "Entity": null }, { "Name": "Properties", "Description": "", "Type": "Object", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SecurityRegulatoryCompliance", "TableSource": "", "Description": "Azure Security Center regulatory compliance assessments state.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The (UTC) date and time the assessment was generated", "Type": "DateTime", "Entity": null }, { "Name": "RegulatoryComplianceSubscriptionId", "Description": "The subscription ID of the assessed resource", "Type": "String", "Entity": null }, { "Name": "AssessedResourceId", "Description": "The ID of the assessed resource", "Type": "String", "Entity": null }, { "Name": "RecommendationId", "Description": "The ID of the assessed recommendation", "Type": "String", "Entity": null }, { "Name": "RecommendationName", "Description": "Recommendation display name", "Type": "String", "Entity": null }, { "Name": "ComplianceStandard", "Description": "The name of compliance standard", "Type": "String", "Entity": null }, { "Name": "ComplianceControl", "Description": "The name of regulatory compliance control", "Type": "String", "Entity": null }, { "Name": "SkippedResources", "Description": "The number of resources that passed this assessment", "Type": "Int32", "Entity": null }, { "Name": "PassedResources", "Description": "The number of resources that passed this assessment", "Type": "Int32", "Entity": null }, { "Name": "FailedResources", "Description": "The number of resources that failed this assessment", "Type": "Int32", "Entity": null }, { "Name": "State", "Description": "State where the sign-in occurred, if available", "Type": "String", "Entity": null }, { "Name": "ResourceProviderType", "Description": "Resource provider type of the assessed resource", "Type": "String", "Entity": null }, { "Name": "RecommendationLink", "Description": "A link for more details on the assessment result", "Type": "String", "Entity": null }, { "Name": "IsSnapshot", "Description": "Indicates whether the data was exported as part of a snapshot when 'true', or streamed in real-time when 'false'.", "Type": "Boolean", "Entity": null }, { "Name": "Properties", "Description": "The complete set of metadata.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "SentinelAlibabaCloudAPIGatewayLogs", "TableSource": "sentinel", "Description": "Alibaba Cloud API Gateway Logs data.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time when the log entry was generated", "Type": "DateTime", "Entity": null }, { "Name": "ApiGroupUid", "Description": "The ID of the group to which the API belongs.", "Type": "String", "Entity": null }, { "Name": "ApiGroupName", "Description": "The name of the group to which the API belongs.", "Type": "String", "Entity": null }, { "Name": "ApiUid", "Description": "The API ID.", "Type": "String", "Entity": null }, { "Name": "ApiName", "Description": "The API name.", "Type": "String", "Entity": null }, { "Name": "ApiStageUid", "Description": "The ID of the environment in which the API was called.", "Type": "String", "Entity": null }, { "Name": "ApiStageName", "Description": "The environment name.", "Type": "String", "Entity": null }, { "Name": "HttpMethod", "Description": "The HTTP method that was used by the API request.", "Type": "String", "Entity": null }, { "Name": "Path", "Description": "The location of the certificate", "Type": "String", "Entity": null }, { "Name": "Domain", "Description": "The domain name that was used for the API call.", "Type": "String", "Entity": null }, { "Name": "StatusCode", "Description": "HttpStatusCode", "Type": "String", "Entity": null }, { "Name": "ErrorMessage", "Description": "The returned error message.", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "The ID of the application that was used to call the API.", "Type": "String", "Entity": null }, { "Name": "AppName", "Description": "The application's display name as exposed by the associated service principal", "Type": "String", "Entity": null }, { "Name": "ClientIp", "Description": "The IP address of the client that initiated the API call.", "Type": "String", "Entity": null }, { "Name": "Exception", "Description": "The specific error message that was returned by the backend service of the API.", "Type": "String", "Entity": null }, { "Name": "ExchangeTimestamp", "Description": "The I/O points in time in the request link. FrontRequestStart: the point in time when API Gateway started to receive the request from the client. FrontRequestEnd: the point in time when API Gateway completed receiving the request from the client. BackendRequestStart: the point in time when API Gateway started to forward the request to the backend service. BackendRequestEnd: the point in time when API Gateway completed forwarding the request to the backend service. BackendResponseStart: the point in time when API Gateway started to receive the response from the backend service. BackendResponseEnd: the point in time when API Gateway completed receiving the response from the backend service. FrontResponseStart: the point in time when API Gateway started to send the response to the client. FrontResponseEnd: the point in time when API Gateway completed sending the response to the client.", "Type": "String", "Entity": null }, { "Name": "ProviderAliUid", "Description": "The ID of the account that provides the API.", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The region where the API resides, for example, cn-hangzhou, which indicates the China (Hangzhou) region.", "Type": "String", "Entity": null }, { "Name": "RequestHandleTime", "Description": "The time point in UTC at which the API request was received by API Gateway.", "Type": "DateTime", "Entity": null }, { "Name": "RequestId", "Description": "Unique identifier of the request", "Type": "String", "Entity": null }, { "Name": "RequestSize", "Description": "The request size. Unit: bytes.", "Type": "String", "Entity": null }, { "Name": "ResponseSize", "Description": "The size of the response in bytes.", "Type": "String", "Entity": null }, { "Name": "ServiceLatency", "Description": "The total time consumed to access the backend resources. The total time includes the time consumed to request a connection to the resources, the time consumed to establish the connection, and the time consumed to call the backend service. Unit: milliseconds.", "Type": "Double", "Entity": null }, { "Name": "ErrorCode", "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Type": "String", "Entity": null }, { "Name": "RequestProtocol", "Description": "Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS", "Type": "String", "Entity": null }, { "Name": "InstanceId", "Description": "The ID of the API Gateway instance to which the API belongs.", "Type": "String", "Entity": null }, { "Name": "InitialRequestId", "Description": "If an API calls another API, for example, API-1 calls API-2, initialRequestId is used to record the request ID of API-1 in the logs of API-2.", "Type": "String", "Entity": null }, { "Name": "ClientNonce", "Description": "The X-Ca-Nonce header in the request initiated from the client.", "Type": "String", "Entity": null }, { "Name": "RequestQueryString", "Description": "The queryString in the request initiated from the client. This field is for dedicated instances only.", "Type": "String", "Entity": null }, { "Name": "RequestHeaders", "Description": "The header content in the request initiated from the client. This field is for dedicated instances only.", "Type": "String", "Entity": null }, { "Name": "RequestBody", "Description": "The body of the request sent by the client. The body can contain up to 1,024 bytes in length. This field is for dedicated instances only.", "Type": "String", "Entity": null }, { "Name": "ResponseHeaders", "Description": "The header content of the API response. This field is for dedicated instances only.", "Type": "String", "Entity": null }, { "Name": "ResponseBody", "Description": "The response content. The response can contain up to 1,024 bytes in length. This field is for dedicated instances only.", "Type": "String", "Entity": null }, { "Name": "ConsumerAppKey", "Description": "The AppKey that was used in the request.", "Type": "String", "Entity": null }, { "Name": "TotalLatency", "Description": "The total latency of the API request. Unit: milliseconds.", "Type": "Double", "Entity": null }, { "Name": "CustomTraceId", "Description": "The traceId of the end-to-end log.", "Type": "String", "Entity": null }, { "Name": "JwtClaims", "Description": "The JSON web token (JWT) claims. The claims can be configured at the group level.", "Type": "String", "Entity": null }, { "Name": "Plugin", "Description": "The plug-in hit by the request and the relevant context.", "Type": "String", "Entity": null }, { "Name": "LogStore", "Description": "The name of the log store where the logs are stored.", "Type": "String", "Entity": null }, { "Name": "LogRegion", "Description": "The region where the log store is located.", "Type": "String", "Entity": null }, { "Name": "LogProject", "Description": "The name of the log project where the logs are stored.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SentinelAlibabaCloudVPCFlowLogs", "TableSource": "sentinel", "Description": "Alibaba Cloud VPC Flow Logs data.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time when the log entry was generated", "Type": "DateTime", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "String", "Entity": null }, { "Name": "VswitchId", "Description": "The ID of the vSwitch to which the elastic network interface (ENI) is attached", "Type": "String", "Entity": null }, { "Name": "VmId", "Description": "The ID of the ECS instance to which the ENI is attached", "Type": "String", "Entity": null }, { "Name": "VpcId", "Description": "The ID of the VPC to which the ENI belongs", "Type": "String", "Entity": null }, { "Name": "AccountId", "Description": "An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.", "Type": "String", "Entity": null }, { "Name": "EniId", "Description": "The ID of the ENI", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The region where the VPC resides, Not included in all records", "Type": "String", "Entity": null }, { "Name": "SrcAddr", "Description": "The source IP address", "Type": "String", "Entity": null }, { "Name": "SrcPort", "Description": "The source port", "Type": "String", "Entity": null }, { "Name": "DstAddr", "Description": "The destination IP address", "Type": "String", "Entity": null }, { "Name": "DstPort", "Description": "The destination port", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "Direction", "Description": "The direction of the traffic: in (Inbound traffic to the ENI) or out (Outbound traffic from the ENI)", "Type": "String", "Entity": null }, { "Name": "Packets", "Description": "The number of packets", "Type": "String", "Entity": null }, { "Name": "Bytes", "Description": "The number of bytes", "Type": "String", "Entity": null }, { "Name": "Start", "Description": "The time when the first packet was received in the capture window. The value is a Unix timestamp", "Type": "String", "Entity": null }, { "Name": "End", "Description": "For a persistent connection, this is the end time of the capture window. For a short-lived connection, this is the time when the connection was closed. The value is a Unix timestamp", "Type": "String", "Entity": null }, { "Name": "LogStatus", "Description": "The logging status of the flow log: OK (Data is recorded normally), NODATA (No network traffic), SKIPDATA (Some flow log records are skipped)", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "TcpFlags", "Description": "The TCP flag, represented in decimal, which reflects a combination of flags from the TCP protocol, such as SYN, ACK, and FIN", "Type": "String", "Entity": null }, { "Name": "TrafficPath", "Description": "The scenario where the traffic occurs (0-22): 0=Other scenarios, 1=Traffic through other resources in same VPC, 2=Private traffic to ECS instance in same VPC, etc.", "Type": "String", "Entity": null }, { "Name": "SrcType", "Description": "The CIDR block information of the source IP address after enabling the inter-domain analysis feature. This field is included only if you enable the inter-domain analysis feature.", "Type": "String", "Entity": null }, { "Name": "DstType", "Description": "The CIDR block information of the destination IP address after enabling the inter-domain analysis feature. This field is included only if you enable the inter-domain analysis feature.", "Type": "String", "Entity": null }, { "Name": "LogStore", "Description": "The name of the log store where the logs are stored.", "Type": "String", "Entity": null }, { "Name": "LogRegion", "Description": "The region where the log store is located.", "Type": "String", "Entity": null }, { "Name": "LogProject", "Description": "The name of the log project where the logs are stored.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SentinelAlibabaCloudWAFLogs", "TableSource": "sentinel", "Description": "Alibaba Cloud WAF Logs data.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time when the log entry was generated", "Type": "DateTime", "Entity": null }, { "Name": "OwnerId", "Description": "The ID of the Alibaba Cloud account", "Type": "String", "Entity": null }, { "Name": "AccountAction", "Description": "The action that is performed on the client request after an account security rule is triggered. The value is fixed as block", "Type": "String", "Entity": null }, { "Name": "AccountRuleId", "Description": "The ID of the account security rule that is triggered", "Type": "String", "Entity": null }, { "Name": "AccountTest", "Description": "The protection mode that is used for the client request after an account security rule is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "AclAction", "Description": "The action that is performed on the client request after a rule created for the blacklist or custom protection policy (ACL) feature is triggered. Valid values: block, captcha_strict, captcha, js, captcha_strict_pass, captcha_pass, and js_pass", "Type": "String", "Entity": null }, { "Name": "AclRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the blacklist or ACL feature", "Type": "String", "Entity": null }, { "Name": "AclRuleType", "Description": "The type of the rule that is triggered. The rule is created for the blacklist or ACL feature. Valid values: custom (ACL feature), blacklist (blacklist feature)", "Type": "String", "Entity": null }, { "Name": "AclTest", "Description": "The protection mode that is used for the client request after a rule created for the blacklist or ACL feature is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "AlgorithmRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the typical bot behavior identification feature", "Type": "String", "Entity": null }, { "Name": "AntiscanAction", "Description": "The action that is performed on the client request after a rule created for the scan protection feature is triggered. The value is fixed as block", "Type": "String", "Entity": null }, { "Name": "AntiscanRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the scan protection feature", "Type": "String", "Entity": null }, { "Name": "AntiscanRuleType", "Description": "The type of the rule that is triggered. The rule is created for the scan protection feature. Valid values: highfreq, dirscan, scantools, collaborative", "Type": "String", "Entity": null }, { "Name": "AntiscanTest", "Description": "The protection mode that is used for the client request after a rule created for the scan protection feature is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "BlockAction", "Description": "The WAF protection feature that is triggered to block the request. Valid values: tmd, waf, acl, deeplearning, antiscan, antifraud, antibot", "Type": "String", "Entity": null }, { "Name": "BodyBytesSent", "Description": "The number of bytes in the request body", "Type": "Int64", "Entity": null }, { "Name": "BypassMatchedIds", "Description": "The ID of the rule that is triggered to allow the client request. Multiple IDs are separated with commas", "Type": "String", "Entity": null }, { "Name": "CcAction", "Description": "The action that is performed on the client request after a rule created for the HTTP flood protection or custom protection policy (HTTP Flood Protection) feature is triggered. Valid values: block, captcha, js, captcha_pass, and js_pass", "Type": "String", "Entity": null }, { "Name": "CcBlocks", "Description": "Indicates whether the client request is blocked by the HTTP flood protection feature. 1: The request is blocked, A different value: The request is allowed", "Type": "String", "Entity": null }, { "Name": "CcRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the HTTP flood protection or custom protection policy (HTTP Flood Protection) feature", "Type": "String", "Entity": null }, { "Name": "CcRuleType", "Description": "The type of the rule that is triggered. The rule is created for the HTTP flood protection or custom protection policy (HTTP Flood Protection) feature. Valid values: custom (custom protection rule), system (HTTP flood protection rule)", "Type": "String", "Entity": null }, { "Name": "CcTest", "Description": "The protection mode that is used for the client request after a rule created for the HTTP flood protection or custom protection policy (HTTP Flood Protection) feature is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "ContentType", "Description": "The type of the requested content", "Type": "String", "Entity": null }, { "Name": "DeeplearningAction", "Description": "The action that is performed on the client request after a rule created for the Deep Learning Engine is triggered. The value is fixed as block", "Type": "String", "Entity": null }, { "Name": "DeeplearningRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the Deep Learning Engine", "Type": "String", "Entity": null }, { "Name": "DeeplearningRuleType", "Description": "The type of the rule that is triggered. The rule is created for the Deep Learning Engine. Valid values: xss, code_exec, webshell, sqli, lfilei, rfilei, crlf, other", "Type": "String", "Entity": null }, { "Name": "DeeplearningTest", "Description": "The protection mode that is used for the client request after a rule created for the Deep Learning Engine is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "DlpRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the data leakage prevention feature", "Type": "String", "Entity": null }, { "Name": "DlpTest", "Description": "The protection mode that is used for the client request after a rule created for the data leakage prevention feature is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "FinalRuleType", "Description": "The subtype of the rule that is applied to the client request. The rule is indicated by final_rule_id", "Type": "String", "Entity": null }, { "Name": "FinalRuleId", "Description": "The ID of the rule that is applied to the client request. The rule defines the action recorded in the final_action field", "Type": "String", "Entity": null }, { "Name": "FinalAction", "Description": "The action that WAF performs on the client request. Valid values: block, captcha_strict, captcha, and js", "Type": "String", "Entity": null }, { "Name": "FinalPlugin", "Description": "The protection feature that performs the action specified by final_action on the client request. Valid values: waf, deeplearning, dlp, account, normalized, acl, cc, antiscan, scene, antifraud, intelligence, algorithm, wxbb", "Type": "String", "Entity": null }, { "Name": "Host", "Description": "The Host field of the request header. This field contains the domain name or IP address to access", "Type": "String", "Entity": null }, { "Name": "HttpCookie", "Description": "The Cookie field of the request header. This field contains the cookie information about the client", "Type": "String", "Entity": null }, { "Name": "HttpReferer", "Description": "The Referer field of the request header. This field contains the source URL information about the request", "Type": "String", "Entity": null }, { "Name": "HttpUserAgent", "Description": "The User-Agent field of the request header. This field contains information such as the identifier of the client browser or operating system", "Type": "String", "Entity": null }, { "Name": "HttpXForwardedFor", "Description": "The X-Forwarded-For (XFF) field of the request header. This field is used to identify the actual IP address of the client that is connected to the web server by using an HTTP proxy or a load balancing device", "Type": "String", "Entity": null }, { "Name": "Https", "Description": "Indicates whether the request is an HTTPS request. true: The request is an HTTPS request, false: The request is an HTTP request", "Type": "Boolean", "Entity": null }, { "Name": "MatchedHost", "Description": "The domain name of the origin server that is matched by WAF for the request. A wildcard domain name may be matched", "Type": "String", "Entity": null }, { "Name": "NormalizedAction", "Description": "The action that is performed on the client request after a rule created for the positive security model feature is triggered. Valid values: block and continue", "Type": "String", "Entity": null }, { "Name": "NormalizedRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the positive security model feature", "Type": "String", "Entity": null }, { "Name": "NormalizedRuleType", "Description": "The type of the rule that is triggered. The rule is created for the positive security model feature. Valid values: User-Agent, Referer, URL, Cookie, Bod", "Type": "String", "Entity": null }, { "Name": "NormalizedTest", "Description": "The protection mode that is used for the client request after a rule created for the positive security model feature is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "Querystring", "Description": "The query string in the client request. The query string refers to the part that follows the question mark (?) in the requested URL", "Type": "String", "Entity": null }, { "Name": "RealClientIp", "Description": "The actual IP address of the client that initiates the request. WAF identifies the actual IP address based on the analysis of the request", "Type": "String", "Entity": null }, { "Name": "Region", "Description": "The ID of the region where the WAF instance resides. Valid values: cn (Chinese mainland), int (outside the Chinese mainland)", "Type": "String", "Entity": null }, { "Name": "RemoteAddr", "Description": "The IP address that is used to connect to WAF", "Type": "String", "Entity": null }, { "Name": "RemotePort", "Description": "TCP port on the remote device that was being connected to", "Type": "Int32", "Entity": null }, { "Name": "RequestLength", "Description": "The number of bytes in the client request. The request includes the request line, request headers, and request body. Unit: bytes", "Type": "Int64", "Entity": null }, { "Name": "RequestMethod", "Description": "HTTP method of the request", "Type": "String", "Entity": null }, { "Name": "RequestPath", "Description": "The requested relative path. The relative path refers to the part between the domain name and the question mark (?) in the requested URL", "Type": "String", "Entity": null }, { "Name": "RequestTimeMsec", "Description": "The time that is taken by WAF to process the client request. Unit: milliseconds", "Type": "Double", "Entity": null }, { "Name": "RequestTraceid", "Description": "The unique identifier that is generated by WAF for the client request", "Type": "String", "Entity": null }, { "Name": "SceneAction", "Description": "The action that is performed on the client request after a rule created for scenario-specific configuration is triggered. Valid values: block, captcha, js, captcha_pass, and js_pass", "Type": "String", "Entity": null }, { "Name": "SceneId", "Description": "The scenario ID of the rule that is triggered. The rule is created for scenario-specific configuration", "Type": "String", "Entity": null }, { "Name": "SceneRuleId", "Description": "The ID of the rule that is triggered. The rule is created for scenario-specific configuration", "Type": "String", "Entity": null }, { "Name": "SceneRuleType", "Description": "The type of the rule that is triggered. The rule is created for scenario-specific configuration. Valid values: bot_aialgo, js, intelligence, sdk, cc", "Type": "String", "Entity": null }, { "Name": "SceneTest", "Description": "The protection mode that is used for the client request after a rule created for scenario-specific configuration is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "ServerPort", "Description": "The requested destination port", "Type": "Int32", "Entity": null }, { "Name": "ServerProtocol", "Description": "The protocol and version that is used by the origin server to respond to the request forwarded by WAF", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "Int32", "Entity": null }, { "Name": "SslCipher", "Description": "The cipher suite that is used in the client request", "Type": "String", "Entity": null }, { "Name": "SslProtocol", "Description": "The SSL or TLS protocol and version that are used in the client request", "Type": "String", "Entity": null }, { "Name": "Time", "Description": "The time that the alert was added to the incident", "Type": "DateTime", "Entity": null }, { "Name": "UaBrowser", "Description": "The name of the browser that initiates the request", "Type": "String", "Entity": null }, { "Name": "UaBrowserFamily", "Description": "The family to which the browser belongs", "Type": "String", "Entity": null }, { "Name": "UaBrowserType", "Description": "The type of the browser that initiates the request", "Type": "String", "Entity": null }, { "Name": "UaBrowserVersion", "Description": "The version of the browser that initiates the request", "Type": "String", "Entity": null }, { "Name": "UaDeviceType", "Description": "The device type of the client that initiates the request", "Type": "String", "Entity": null }, { "Name": "UaOs", "Description": "The operating system of the client that initiates the request", "Type": "String", "Entity": null }, { "Name": "UaOsFamily", "Description": "The family to which the operating system of the client belongs", "Type": "String", "Entity": null }, { "Name": "UpstreamAddr", "Description": "The back-to-origin addresses used by WAF. Each address is in the IP:Port format. Multiple addresses are separated with commas", "Type": "String", "Entity": null }, { "Name": "UpstreamResponseTime", "Description": "The time that is taken by the origin server to respond to the request. The request is forwarded by WAF. Unit: seconds", "Type": "Double", "Entity": null }, { "Name": "UpstreamStatus", "Description": "The status code that is returned by the origin server to WAF", "Type": "Int32", "Entity": null }, { "Name": "UserId", "Description": "The ID of the Alibaba Cloud account to which the WAF instance belongs", "Type": "String", "Entity": null }, { "Name": "WafAction", "Description": "The action that is performed on the client request after a rule created for the Protection Rules Engine is triggered. The value is fixed as block", "Type": "String", "Entity": null }, { "Name": "WafTest", "Description": "The protection mode that is used for the client request after a rule created for the Protection Rules Engine is triggered. true: observation mode, false: prevention mode", "Type": "Boolean", "Entity": null }, { "Name": "WafRuleId", "Description": "The ID of the rule that is triggered. The rule is created for the Protection Rules Engine", "Type": "String", "Entity": null }, { "Name": "WafRuleType", "Description": "The type of the rule that is triggered. The rule is created for the Protection Rules Engine. Valid values: xss, code_exec, webshell, sqli, lfilei, rfilei, crlf, other", "Type": "String", "Entity": null }, { "Name": "LogStore", "Description": "The name of the log store where the logs are stored.", "Type": "String", "Entity": null }, { "Name": "LogRegion", "Description": "The region where the log store is located.", "Type": "String", "Entity": null }, { "Name": "LogProject", "Description": "The name of the log project where the logs are stored.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SentinelAudit", "TableSource": "sentinel", "Description": "Audit logs for operations performed on Azure Sentinel resources, such as Data Connectors, Analytic Rules and more. These logs can be used to audit operations on your Sentinel resources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "SentinelResourceId", "Description": "The Sentinel resource ID.", "Type": "String", "Entity": null }, { "Name": "SentinelResourceName", "Description": "The Sentinel resource name.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "WorkspaceId", "Description": "The workspace ID.", "Type": "String", "Entity": null }, { "Name": "SentinelResourceType", "Description": "The resource type, for example: DataConnector, AlertRule, etc.", "Type": "String", "Entity": null }, { "Name": "SentinelResourceKind", "Description": "The resource kind, for example: connector kind (such as Office365, AmazonWebServicesCloudTrail), alert rule kind (scheduld).", "Type": "String", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "ExtendedProperties", "Description": "Additional information based on the resource type.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SentinelBehaviorEntities", "TableSource": "sentinel", "Description": "Microsoft Sentinel behaviors table. Contains information about entities (file, process, device, user, and others) that are involved in a behavior or observation, including detected threats.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was generated.", "Type": "DateTime", "Entity": null }, { "Name": "BehaviorId", "Description": "Unique identifier for the behavior", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "List of categories that the information belongs to, in JSON array format", "Type": "String", "Entity": null }, { "Name": "ServiceSource", "Description": "Product or service that provided the alert information", "Type": "String", "Entity": null }, { "Name": "DetectionSource", "Description": "Detection technology or sensor that identified the notable component or activity", "Type": "String", "Entity": null }, { "Name": "DataSources", "Description": "Products or services that provided information for the event; for example: Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "EntityType", "Description": "Type of object, such as a file, a process, a device, or a user", "Type": "String", "Entity": null }, { "Name": "EntityRole", "Description": "Indicates whether the entity is impacted or merely related.", "Type": "String", "Entity": null }, { "Name": "DetailedEntityRole", "Description": "The role of the entity in the behavior.", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FolderPath", "Description": "Folder containing the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA1", "Description": "SHA-1 hash of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "SHA256", "Description": "SHA-256 of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int64", "Entity": null }, { "Name": "ThreatFamily", "Description": "Malware family that the suspicious or malicious file or process has been classified under", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": null }, { "Name": "RemoteUrl", "Description": "URL or fully qualified domain name (FQDN) that was being connected to", "Type": "String", "Entity": null }, { "Name": "AccountName", "Description": "User name of the account", "Type": "String", "Entity": null }, { "Name": "AccountDomain", "Description": "Domain of the account", "Type": "String", "Entity": null }, { "Name": "AccountSid", "Description": "Security Identifier (SID) of the account", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "DeviceName", "Description": "Fully qualified domain name (FQDN) of the device", "Type": "String", "Entity": null }, { "Name": "LocalIP", "Description": "IP address assigned to the local machine used during communication", "Type": "String", "Entity": null }, { "Name": "NetworkMessageId", "Description": "Unique identifier for the email, generated by Microsoft 365", "Type": "String", "Entity": null }, { "Name": "EmailSubject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "EmailClusterId", "Description": "Identifier for the group of similar emails clustered based on heuristic analysis of their contents", "Type": "String", "Entity": null }, { "Name": "Application", "Description": "Application that performed the recorded action", "Type": "String", "Entity": null }, { "Name": "ApplicationId", "Description": "Unique identifier for the application", "Type": "Int32", "Entity": null }, { "Name": "OAuthApplicationId", "Description": "Unique identifier of the third-party OAuth application", "Type": "String", "Entity": null }, { "Name": "ProcessCommandLine", "Description": "Command line used to create the new process", "Type": "String", "Entity": null }, { "Name": "RegistryKey", "Description": "Registry key that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueName", "Description": "Name of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "RegistryValueData", "Description": "Data of the registry value that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "CloudResource", "Description": "Cloud resource name", "Type": "String", "Entity": null }, { "Name": "CloudPlatform", "Description": "The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform", "Type": "String", "Entity": null }, { "Name": "CloudResourceType", "Description": "Type of cloud resource.", "Type": "String", "Entity": null }, { "Name": "CloudResourceId", "Description": "Unique identifier of the cloud resource accessed.", "Type": "String", "Entity": null }, { "Name": "CloudSubscriptionId", "Description": "Unique identifier of the cloud service subscription.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SentinelBehaviorInfo", "TableSource": "sentinel", "Description": "Microsoft Sentinel behaviors table. Contains information about behaviors, which refers to a conclusion or insight based on one or more raw events, which can provide analysts more context in investigations.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time when the record was generated.", "Type": "DateTime", "Entity": null }, { "Name": "BehaviorId", "Description": "Unique identifier for the behavior", "Type": "String", "Entity": null }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "ActionType", "Description": "Type of activity that triggered the event", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Categories", "Description": "List of categories that the information belongs to, in JSON array format", "Type": "String", "Entity": null }, { "Name": "AttackTechniques", "Description": "MITRE ATT&CK techniques associated with the activity that triggered the alert", "Type": "String", "Entity": null }, { "Name": "ServiceSource", "Description": "Product or service that provided the alert information", "Type": "String", "Entity": null }, { "Name": "DetectionSource", "Description": "Detection technology or sensor that identified the notable component or activity", "Type": "String", "Entity": null }, { "Name": "DataSources", "Description": "Products or services that provided information for the event; for example: Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "Unique identifier for the device in Microsoft Defender for Endpoint", "Type": "String", "Entity": null }, { "Name": "AccountUpn", "Description": "User principal name (UPN) of the account", "Type": "String", "Entity": null }, { "Name": "AccountObjectId", "Description": "Unique identifier for the account in Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "Insights", "Description": "Insights related to the behavior.", "Type": "String", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SentinelHealth", "TableSource": "sentinel", "Description": "Health logs for operations performed by Microsoft Sentinel resources such as Data Connectors, Analytic Rules and more. These logs can be used to monitor the health of your Microsoft Sentinel resources.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "SentinelResourceId", "Description": "The Sentinel resource ID.", "Type": "String", "Entity": null }, { "Name": "SentinelResourceName", "Description": "The Sentinel resource name.", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "Reason", "Description": "The operation reason.", "Type": "String", "Entity": null }, { "Name": "WorkspaceId", "Description": "The workspace ID.", "Type": "String", "Entity": null }, { "Name": "SentinelResourceType", "Description": "The resource type, for example: DataConnector, AlertRule, etc.", "Type": "String", "Entity": null }, { "Name": "SentinelResourceKind", "Description": "The resource kind, for example: connector kind (such as Office365, AmazonWebServicesCloudTrail), alert rule kind (scheduld).", "Type": "String", "Entity": null }, { "Name": "RecordId", "Description": "A unique record identifier.", "Type": "String", "Entity": null }, { "Name": "ExtendedProperties", "Description": "Additional information based on the resource type.", "Type": "Object", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SentinelImpervaWAFCloudV2Logs", "TableSource": "sentinel", "Description": "Imperva Cloud WAF logs containing web application firewall events and security data from Incapsula WAF, ingested via S3 with SQS notifications.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp when the event occurred, derived from the CEF Start field.", "Type": "DateTime", "Entity": null }, { "Name": "LogVersion", "Description": "CEF log format version identifier.", "Type": "String", "Entity": null }, { "Name": "EventVendor", "Description": "The vendor of the product generating the event. Always 'Imperva'.", "Type": "String", "Entity": null }, { "Name": "EventProduct", "Description": "The product name generating the event, e.g. 'Incapsula WAF'.", "Type": "String", "Entity": null }, { "Name": "EventType", "Description": "The type of event, e.g. 'Normal', 'SQL Injection'.", "Type": "String", "Entity": null }, { "Name": "DeviceVersion", "Description": "The version of the WAF device firmware.", "Type": "String", "Entity": null }, { "Name": "SignatureId", "Description": "The unique identifier for the security signature that triggered.", "Type": "String", "Entity": null }, { "Name": "AttackName", "Description": "The name of the detected attack or event classification.", "Type": "String", "Entity": null }, { "Name": "AttackSeverity", "Description": "The severity rating of the attack, from 0 to 10.", "Type": "String", "Entity": null }, { "Name": "FileId", "Description": "Unique identifier for the log file.", "Type": "String", "Entity": null }, { "Name": "RequestClientApplication", "Description": "The client application or user agent string of the request.", "Type": "String", "Entity": null }, { "Name": "Suid", "Description": "The session user identifier or email associated with the request.", "Type": "String", "Entity": null }, { "Name": "Customer", "Description": "The Imperva customer account name.", "Type": "String", "Entity": null }, { "Name": "Tag", "Description": "Tags associated with the event, such as attack classification labels.", "Type": "String", "Entity": null }, { "Name": "CiCode", "Description": "The city code of the request origin.", "Type": "String", "Entity": null }, { "Name": "Src", "Description": "The source IP address of the client making the request.", "Type": "String", "Entity": null }, { "Name": "In", "Description": "The size of the incoming request in bytes.", "Type": "String", "Entity": null }, { "Name": "CCode", "Description": "The ISO country code of the request origin.", "Type": "String", "Entity": null }, { "Name": "Cn1", "Description": "The HTTP response status code.", "Type": "String", "Entity": null }, { "Name": "RequestMethod", "Description": "HTTP method of the request", "Type": "String", "Entity": null }, { "Name": "DeviceFacility", "Description": "The facility or module that generated the event, e.g. 'waf'.", "Type": "String", "Entity": null }, { "Name": "App", "Description": "The application protocol, e.g. 'HTTPS', 'HTTP'.", "Type": "String", "Entity": null }, { "Name": "Ver", "Description": "The TLS or HTTP protocol version used.", "Type": "String", "Entity": null }, { "Name": "Ref", "Description": "The HTTP referer header value.", "Type": "String", "Entity": null }, { "Name": "AdditionalReqHeaders", "Description": "Additional HTTP request headers captured.", "Type": "String", "Entity": null }, { "Name": "DeviceExternalId", "Description": "External device identifier from the WAF.", "Type": "String", "Entity": null }, { "Name": "Act", "Description": "The action taken on the request, e.g. 'REQ_PASSED', 'REQ_BLOCKED'.", "Type": "String", "Entity": null }, { "Name": "Start", "Description": "The start timestamp of the event in Unix epoch milliseconds.", "Type": "String", "Entity": null }, { "Name": "End", "Description": "The end timestamp of the event in Unix epoch milliseconds.", "Type": "String", "Entity": null }, { "Name": "AdditionalResHeaders", "Description": "Additional HTTP response headers captured.", "Type": "String", "Entity": null }, { "Name": "SiteId", "Description": "The unique identifier for the protected site in Imperva.", "Type": "String", "Entity": null }, { "Name": "SourceServiceName", "Description": "The hostname or service name of the protected site.", "Type": "String", "Entity": null }, { "Name": "SiteTag", "Description": "Tags associated with the protected site.", "Type": "String", "Entity": null }, { "Name": "Cpt", "Description": "The client port number of the request.", "Type": "String", "Entity": null }, { "Name": "Request", "Description": "The requested URL path.", "Type": "String", "Entity": null }, { "Name": "Xff", "Description": "The X-Forwarded-For header value indicating original client IP behind proxies.", "Type": "String", "Entity": null }, { "Name": "FilePermission", "Description": "File permission information associated with the event.", "Type": "String", "Entity": null }, { "Name": "FileType", "Description": "File extension type", "Type": "String", "Entity": null }, { "Name": "Dproc", "Description": "The destination process name.", "Type": "String", "Entity": null }, { "Name": "PostBody", "Description": "The HTTP POST body content, if captured.", "Type": "String", "Entity": null }, { "Name": "QStr", "Description": "The URL query string parameters.", "Type": "String", "Entity": null }, { "Name": "SIP", "Description": "The server IP address that handled the request.", "Type": "String", "Entity": null }, { "Name": "Spt", "Description": "The server port number.", "Type": "String", "Entity": null }, { "Name": "AdditionalRuleInfo", "Description": "Additional information about the WAF rule that was triggered.", "Type": "String", "Entity": null }, { "Name": "CapSupport", "Description": "Client capability support flags for advanced detection.", "Type": "String", "Entity": null }, { "Name": "ClApp", "Description": "The classified client application type.", "Type": "String", "Entity": null }, { "Name": "CoSupport", "Description": "Client cookie support indicator.", "Type": "String", "Entity": null }, { "Name": "ClAppSig", "Description": "The client application signature used for bot detection.", "Type": "String", "Entity": null }, { "Name": "JavascriptSupport", "Description": "Whether the client supports JavaScript execution.", "Type": "String", "Entity": null }, { "Name": "Latitude", "Description": "The north to south coordinates of the sign-in location", "Type": "String", "Entity": null }, { "Name": "Longitude", "Description": "The east to west coordinates of the sign-in location", "Type": "String", "Entity": null }, { "Name": "RuleName", "Description": "The name of the WAF rule that matched the request.", "Type": "String", "Entity": null }, { "Name": "VID", "Description": "The visitor identifier assigned by Imperva for tracking.", "Type": "String", "Entity": null }, { "Name": "DeliveryRuleDetails", "Description": "Details about the content delivery rule applied to the request.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "SigninLogs", "TableSource": "sentinel", "Description": "", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "OperationName", "Description": "Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation", "Type": "String", "Entity": null }, { "Name": "OperationVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "Type of threat indicator or breach activity identified by the alert", "Type": "String", "Entity": null }, { "Name": "ResultType", "Description": "Result of the operation. Possible values: Success, Failure", "Type": "String", "Entity": null }, { "Name": "ResultSignature", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResultDescription", "Description": "Additional description of the operation's result", "Type": "String", "Entity": null }, { "Name": "DurationMs", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "Resource", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceProvider", "Description": "", "Type": "String", "Entity": null }, { "Name": "Identity", "Description": "The display name of the actor identified in the signin.", "Type": "String", "Entity": null }, { "Name": "Level", "Description": "", "Type": "String", "Entity": null }, { "Name": "Location", "Description": "City, country, or other geographic location associated with the event", "Type": "String", "Entity": null }, { "Name": "AlternateSignInName", "Description": "On-premises user principal name (UPN) of the user signing in to Microsoft Entra ID", "Type": "String", "Entity": null }, { "Name": "AppDisplayName", "Description": "The application name displayed in the Azure Portal.", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "The application identifier in Azure Active Directory.", "Type": "String", "Entity": null }, { "Name": "AuthenticationContextClassReferences", "Description": "Contains a collection of values that represent the conditional access authentication contexts applied to the sign-in.", "Type": "String", "Entity": null }, { "Name": "AuthenticationDetails", "Description": "List of pass or fail verdicts by email authentication protocols like DMARC, DKIM, SPF or a combination of multiple authentication types (CompAuth)", "Type": "String", "Entity": null }, { "Name": "AppliedEventListeners", "Description": "Detailed information about the listeners, such as Azure Logic Apps and Azure Functions, that were triggered by the corresponding events in the sign-in event.", "Type": "Object", "Entity": null }, { "Name": "AuthenticationMethodsUsed", "Description": "The authentication methods used. Possible values: SMS, Authenticator App, App Verification code, Password, FIDO, PTA, or PHS.", "Type": "String", "Entity": null }, { "Name": "AuthenticationProcessingDetails", "Description": "Details about the authentication processor", "Type": "String", "Entity": null }, { "Name": "AuthenticationRequirement", "Description": "Type of authentication required for the sign-in. Possible values: multiFactorAuthentication (MFA was required) and singleFactorAuthentication (no MFA was required).", "Type": "String", "Entity": null }, { "Name": "AuthenticationRequirementPolicies", "Description": "Sources of authentication requirement, such as conditional access, per-user MFA, identity protection, and security defaults.", "Type": "String", "Entity": null }, { "Name": "ClientAppUsed", "Description": "Indicates the client app used", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessPolicies", "Description": "Details of the conditional access policies applied to the sign-in event", "Type": "Object", "Entity": null }, { "Name": "ConditionalAccessStatus", "Description": "Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).", "Type": "String", "Entity": null }, { "Name": "CreatedDateTime", "Description": "Date and time when the account user was created", "Type": "DateTime", "Entity": null }, { "Name": "DeviceDetail", "Description": "The device information from where the sign-in occurred. Includes information such as deviceId, OS, and browser.", "Type": "Object", "Entity": null }, { "Name": "IsInteractive", "Description": "Indicates whether a user sign in is interactive. In interactive sign in, the user provides an authentication factor to Azure AD. These factors include passwords, responses to MFA challenges, biometric factors, or QR codes that a user provides to Azure AD or an associated app. In non-interactive sign in, the user doesn't provide an authentication factor. Instead, the client app uses a token or code to authenticate or access a resource on behalf of a user. Non-interactive sign ins are commonly used for a client to sign in on a user's behalf in a process transparent to the user.", "Type": "Boolean", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "IPAddress", "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Type": "String", "Entity": null }, { "Name": "IsRisky", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "LocationDetails", "Description": "Provides the city, state, country/region and latitude and longitude from where the sign-in happened.", "Type": "Object", "Entity": null }, { "Name": "MfaDetail", "Description": "This property is deprecated.", "Type": "Object", "Entity": null }, { "Name": "NetworkLocationDetails", "Description": "Network location details of the authentication processor of the sign-in event", "Type": "String", "Entity": null }, { "Name": "OriginalRequestId", "Description": "The request identifier of the first request in the authentication sequence.", "Type": "String", "Entity": null }, { "Name": "ProcessingTimeInMilliseconds", "Description": "", "Type": "String", "Entity": null }, { "Name": "RiskDetail", "Description": "The reason behind a specific state of a risky user, sign-in, or a risk event. Possible values: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, or adminConfirmedSigninCompromised. The value none means that no action has been performed on the user or sign-in so far. Note: Details for this property are only available for Azure AD Premium P2 customers. All other customers are returned hidden.", "Type": "String", "Entity": null }, { "Name": "RiskEventTypes", "Description": "Array of risk event types applicable to the event", "Type": "String", "Entity": null }, { "Name": "RiskEventTypes_V2", "Description": "The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, or generic.", "Type": "String", "Entity": null }, { "Name": "RiskLevelAggregated", "Description": "Aggregated risk level during sign-in. Possible values: 0 (aggregated risk level not set), 1 (none), 10 (low), 50 (medium), or 100 (high).", "Type": "String", "Entity": null }, { "Name": "RiskLevelDuringSignIn", "Description": "User risk level at sign-in", "Type": "String", "Entity": null }, { "Name": "RiskState", "Description": "Indicates risky user state. Possible values: 0 (none), 1 (confirmed safe), 2 (remediated), 3 (dismissed), 4 (at risk), or 5 (confirmed compromised).", "Type": "String", "Entity": null }, { "Name": "ResourceDisplayName", "Description": "Display name of the resource accessed. The display name can contain any character.", "Type": "String", "Entity": null }, { "Name": "ResourceIdentity", "Description": "The resource that the user signed in to.", "Type": "String", "Entity": null }, { "Name": "ResourceServicePrincipalId", "Description": "The identifier of the service principal representing the target resource in the sign-in event.", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "Unique identifier of the service principal that performed the action", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalName", "Description": "Name of the service principal that initiated the sign-in", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "Object", "Entity": null }, { "Name": "TokenIssuerName", "Description": "The name of the identity provider. For example, sts.microsoft.com.", "Type": "String", "Entity": null }, { "Name": "TokenIssuerType", "Description": "Indicates if the token issuer is Microsoft Entra ID (0) or Active Directory Federation Services (1)", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "UserDisplayName", "Description": "The display name of the user.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "The identifier of the user.", "Type": "String", "Entity": null }, { "Name": "UserPrincipalName", "Description": "The UPN of the user.", "Type": "String", "Entity": null }, { "Name": "AADTenantId", "Description": "", "Type": "String", "Entity": null }, { "Name": "UserType", "Description": "Identifies whether the user is a member or guest in the tenant. Possible values are: member and guest.", "Type": "String", "Entity": null }, { "Name": "FlaggedForReview", "Description": "During a failed sign in, a user may click a button in the Azure portal to mark the failed event for tenant admins. If a user clicked the button to flag the failed sign in, this value is true.", "Type": "Boolean", "Entity": null }, { "Name": "IPAddressFromResourceProvider", "Description": "The IP address a user used to reach a resource provider, used to determine Conditional Access compliance for some policies. For example, when a user interacts with Exchange Online, the IP address Exchange receives from the user may be recorded here. This value is often null.", "Type": "String", "Entity": null }, { "Name": "SignInIdentifier", "Description": "The identification that the user provided to sign in. It may be the userPrincipalName but it's also populated when a user signs in using other identifiers.", "Type": "String", "Entity": null }, { "Name": "SignInIdentifierType", "Description": "The type of sign in identifier. Possible values are: userPrincipalName, phoneNumber, proxyAddress, qrCode, onPremisesUserPrincipalName.", "Type": "String", "Entity": null }, { "Name": "ResourceTenantId", "Description": "Unique identifier of the tenant of the resource accessed", "Type": "String", "Entity": null }, { "Name": "HomeTenantId", "Description": "The tenant identifier of the user initiating the sign in. Not applicable in Managed Identity or service principal sign ins.", "Type": "String", "Entity": null }, { "Name": "UniqueTokenIdentifier", "Description": "Unique identifier embedded in every access token and ID token that were issued", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Type": "String", "Entity": null }, { "Name": "SessionLifetimePolicies", "Description": "Any conditional access session management policies that were applied during the sign-in event.", "Type": "String", "Entity": null }, { "Name": "AutonomousSystemNumber", "Description": "The Autonomous System Number (ASN) of the network used by the actor.", "Type": "String", "Entity": null }, { "Name": "AuthenticationProtocol", "Description": "Authentication protocol that the compromised user used to sign in; possible values: Undefined, NTLM, Kerberos", "Type": "String", "Entity": null }, { "Name": "CrossTenantAccessType", "Description": "Describes the type of cross-tenant access used by the actor to access the resource.", "Type": "String", "Entity": null }, { "Name": "AuthenticationAppDeviceDetails", "Description": "Details of the app and device state used during the most recent authentication step using an authentication app.", "Type": "String", "Entity": null }, { "Name": "AuthenticationAppPolicyEvaluationDetails", "Description": "The details of the policies applied and enforced related to the authentication app during the latest signIn step.", "Type": "String", "Entity": null }, { "Name": "ClientCredentialType", "Description": "The type of client credential used. Examples include client assertion, client secret, etc.", "Type": "String", "Entity": null }, { "Name": "FederatedCredentialId", "Description": "Federated Credential Id.", "Type": "String", "Entity": null }, { "Name": "GlobalSecureAccessIpAddress", "Description": "Global secure IP address that user signed in from.", "Type": "String", "Entity": null }, { "Name": "HomeTenantName", "Description": "The tenant name of the external tenant who homes the entitity taking action in the customer's tenant.", "Type": "String", "Entity": null }, { "Name": "IncomingTokenType", "Description": "The type of token utilized to signIn (examples: primary refresh token, saml assertion).", "Type": "String", "Entity": null }, { "Name": "IsTenantRestricted", "Description": "Indicates if a signIn is under a tenant restrictions policy or not.", "Type": "Boolean", "Entity": null }, { "Name": "IsThroughGlobalSecureAccess", "Description": "Displays whether or not a user came through Global Secure Access service or not.", "Type": "Boolean", "Entity": null }, { "Name": "OriginalTransferMethod", "Description": "Transfer method used to initiate a session throughout all subsequent requests.", "Type": "String", "Entity": null }, { "Name": "TokenProtectionStatusDetails", "Description": "Token protection creates a cryptographically secure tie between the token and the device it's issued to. This field indicates whether the signin token was bound to the device or not.", "Type": "Object", "Entity": null }, { "Name": "AppOwnerTenantId", "Description": "Specifies the ID of the tenant where the app was registered", "Type": "String", "Entity": null }, { "Name": "ResourceOwnerTenantId", "Description": "The tenant identifier of the owner of the resource referenced in the sign in.", "Type": "String", "Entity": null }, { "Name": "Agent", "Description": "The agentic property for sign in logs. Includes the agentType and the parentAppId when the type is AgenticInstance.", "Type": "Object", "Entity": null }, { "Name": "SourceAppClientId", "Description": "The Source App's Client ID for Target Identities.", "Type": "String", "Entity": null }, { "Name": "ConditionalAccessAudiences", "Description": "The audiences targeted by the conditional access policy.", "Type": "String", "Entity": null }, { "Name": "AuthenticatorAppLocation", "Description": "The location of the authenticator app.", "Type": "String", "Entity": null }, { "Name": "ClientSessionId", "Description": "ID of the client session associated with the signIn.", "Type": "String", "Entity": null }, { "Name": "RootActorID", "Description": "The root actor virtual ID associated with the sign-in.", "Type": "String", "Entity": null }, { "Name": "AppliedConditionalAccessPolicies", "Description": "", "Type": "String", "Entity": null }, { "Name": "RiskLevel", "Description": "The AAD risk level (Low/Medium/High) of the user account", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "ThreatIntelExportOperation", "TableSource": "sentinel", "Description": "Threat Intelligence Export Operation Logs.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp of when the log entry was generated (UTC).", "Type": "DateTime", "Entity": null }, { "Name": "TimeExported", "Description": "The time of export to destination (UTC).", "Type": "DateTime", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "StixId", "Description": "A globally unique identifier that identifies a STIX object.", "Type": "String", "Entity": null }, { "Name": "ExternallyExportedId", "Description": "The unique identifier of the exported object.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "The name of the STIX object source.", "Type": "String", "Entity": null }, { "Name": "ExportedBy", "Description": "The user who initiated the export operation (email address).", "Type": "String", "Entity": null }, { "Name": "ExportDuration", "Description": "The total time, in milliseconds, taken to complete the export operation.", "Type": "Int32", "Entity": null }, { "Name": "ExportId", "Description": "A value that uniquely identifies the Export operation.", "Type": "String", "Entity": null }, { "Name": "ExportType", "Description": "Represents the export destination type. e.g. TAXII", "Type": "String", "Entity": null }, { "Name": "Status", "Description": "Indicator of the profile status - can be Enabled or Disabled", "Type": "String", "Entity": null }, { "Name": "ErrorDetails", "Description": "Additional information when Status is 'Failure' / 'Timeout'.", "Type": "String", "Entity": null }, { "Name": "DestinationInfo", "Description": "Additional information about the export destination depending on ExportType.", "Type": "Object", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ThreatIntelIndicators", "TableSource": "sentinel", "Description": "Threat Intelligence table that contains STIX indicators.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time of indicator ingestion.", "Type": "DateTime", "Entity": null }, { "Name": "WorkspaceId", "Description": "The workspace that submitted the indicator.", "Type": "String", "Entity": null }, { "Name": "AzureTenantId", "Description": "The tenant that submitted the indicator.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "The name of the source.", "Type": "String", "Entity": null }, { "Name": "LastUpdateMethod", "Description": "The component that last updated the indicator.", "Type": "String", "Entity": null }, { "Name": "IsDeleted", "Description": "A value that indicates whether the data was deleted from Sentinel or not.", "Type": "Boolean", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "Data", "Description": "All object properties, formatted according to the STIX specification (https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.pdf).", "Type": "Object", "Entity": null }, { "Name": "IsActive", "Description": "A value that specifies if an indicator is active and valid for detections.", "Type": "Boolean", "Entity": null }, { "Name": "Revoked", "Description": "A value that specifies whether the indicator was revoked.", "Type": "Boolean", "Entity": null }, { "Name": "ValidUntil", "Description": "The time at which this indicator should no longer be considered a valid indicator of the bahviors it is related to or represents.", "Type": "DateTime", "Entity": null }, { "Name": "ValidFrom", "Description": "The time from which this indicator is considered a valid indicator of the behaviors it is related or represents.", "Type": "DateTime", "Entity": null }, { "Name": "Created", "Description": "The date when the indicator was created.", "Type": "DateTime", "Entity": null }, { "Name": "Modified", "Description": "The date when the indicator was modified.", "Type": "DateTime", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "String", "Entity": null }, { "Name": "Confidence", "Description": "The confidence that the creator has in the correctness of their data. The value must be a number in the range of 0-100.", "Type": "Int32", "Entity": null }, { "Name": "Pattern", "Description": "The detection pattern for this indicator MAY be expressed as a STIX pattern.", "Type": "String", "Entity": null }, { "Name": "ObservableKey", "Description": "The entire left-hand side of an equality comparison from the pattern.", "Type": "String", "Entity": null }, { "Name": "ObservableValue", "Description": "The entire right-hand side of an equality comparison from the pattern.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ThreatIntelObjects", "TableSource": "sentinel", "Description": "Threat Intelligence Generic STIX Object Table.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time of STIX object ingestion.", "Type": "DateTime", "Entity": null }, { "Name": "WorkspaceId", "Description": "The workspace that submitted the STIX object.", "Type": "String", "Entity": null }, { "Name": "AzureTenantId", "Description": "The tenant that submitted the STIX object.", "Type": "String", "Entity": null }, { "Name": "Id", "Description": "Unique id of the activity log", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "The name of the source.", "Type": "String", "Entity": null }, { "Name": "StixType", "Description": "The name of this STIX Object.", "Type": "String", "Entity": null }, { "Name": "LastUpdateMethod", "Description": "The component that last updated the record.", "Type": "String", "Entity": null }, { "Name": "IsDeleted", "Description": "A value that indicates whether the data was deleted from Sentinel or not.", "Type": "Boolean", "Entity": null }, { "Name": "AdditionalFields", "Description": "Additional information about the entity or event", "Type": "Object", "Entity": null }, { "Name": "Data", "Description": "All object properties, formatted according to STIX specification (https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.pdf).", "Type": "Object", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "ThreatIntelligenceIndicator", "TableSource": "sentinel", "Description": "Threat Intelligence Indicator", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Time of indicator ingestion.", "Type": "DateTime", "Entity": null }, { "Name": "SourceSystem", "Description": "Source system.", "Type": "String", "Entity": null }, { "Name": "Action", "Description": "Action taken on the entity", "Type": "String", "Entity": null }, { "Name": "ActivityGroupNames", "Description": "Activity groups associated with indicator.", "Type": "String", "Entity": null }, { "Name": "AdditionalInformation", "Description": "Free text additional information for indicator.", "Type": "String", "Entity": null }, { "Name": "ConfidenceScore", "Description": "Confidence rating of the indicator, from 0 to 100.", "Type": "Double", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "DiamondModel", "Description": "Diamond model value for the indicator, one of adversary, capability, infrastructure or victim.", "Type": "String", "Entity": null }, { "Name": "ExternalIndicatorId", "Description": "Identifier for indicator from submitting system.", "Type": "String", "Entity": null }, { "Name": "ExpirationDateTime", "Description": "Time of indicator expiration.", "Type": "DateTime", "Entity": null }, { "Name": "IndicatorId", "Description": "Unique identifier for indicator, calculated by receiving system.", "Type": "String", "Entity": null }, { "Name": "ThreatType", "Description": "Threat type of indicator.", "Type": "String", "Entity": null }, { "Name": "Active", "Description": "Indicates whether indicator is active.", "Type": "Boolean", "Entity": null }, { "Name": "KillChainActions", "Description": "Indicates whether kill chain value 'actions' is set.", "Type": "Boolean", "Entity": null }, { "Name": "KillChainC2", "Description": "Indicates whether kill chain value 'C2' is set.", "Type": "Boolean", "Entity": null }, { "Name": "KillChainDelivery", "Description": "Indicates whether kill chain value 'delivery' is set.", "Type": "Boolean", "Entity": null }, { "Name": "KillChainExploitation", "Description": "Indicates whether kill chain value 'exploitation' is set.", "Type": "Boolean", "Entity": null }, { "Name": "KillChainReconnaissance", "Description": "Indicates whether kill chain value 'reconniassance' is set.", "Type": "Boolean", "Entity": null }, { "Name": "KillChainWeaponization", "Description": "Indicates whether kill chain value 'weaponization' is set.", "Type": "Boolean", "Entity": null }, { "Name": "KnownFalsePositives", "Description": "Text describing situations where indicator may cause false positives.", "Type": "String", "Entity": null }, { "Name": "MalwareNames", "Description": "List of malware names associated with indicator", "Type": "String", "Entity": null }, { "Name": "PassiveOnly", "Description": "Indicates whether the indicator should trigger an event that is visible to a user.", "Type": "Boolean", "Entity": null }, { "Name": "ThreatSeverity", "Description": "Indicator severity rating from 0 to 5. Higher value indicates greater severity.", "Type": "Int32", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "String", "Entity": null }, { "Name": "TrafficLightProtocolLevel", "Description": "Industry standard traffic light protocol level, one of white, green, amber or red.", "Type": "String", "Entity": null }, { "Name": "EmailEncoding", "Description": "The email encoding observable.", "Type": "String", "Entity": null }, { "Name": "EmailLanguage", "Description": "Detected language of the email content", "Type": "String", "Entity": null }, { "Name": "EmailRecipient", "Description": "The email recipient observable.", "Type": "String", "Entity": null }, { "Name": "EmailSenderAddress", "Description": "The email sender address observable.", "Type": "String", "Entity": null }, { "Name": "EmailSenderName", "Description": "The email sender name observable.", "Type": "String", "Entity": null }, { "Name": "EmailSourceDomain", "Description": "The email source domain observable.", "Type": "String", "Entity": null }, { "Name": "EmailSourceIpAddress", "Description": "The email source IP address observable.", "Type": "String", "Entity": null }, { "Name": "EmailSubject", "Description": "Subject of the email", "Type": "String", "Entity": null }, { "Name": "EmailXMailer", "Description": "The email X-Mailer observable.", "Type": "String", "Entity": null }, { "Name": "FileCompileDateTime", "Description": "The file compilation time observable.", "Type": "DateTime", "Entity": null }, { "Name": "FileCreatedDateTime", "Description": "The file creation time observable.", "Type": "DateTime", "Entity": null }, { "Name": "FileHashType", "Description": "The file hash type observable.", "Type": "String", "Entity": null }, { "Name": "FileHashValue", "Description": "The file hash value observable.", "Type": "String", "Entity": null }, { "Name": "FileMutexName", "Description": "The file mutex name observable.", "Type": "String", "Entity": null }, { "Name": "FileName", "Description": "Name of the file that the recorded action was applied to", "Type": "String", "Entity": null }, { "Name": "FilePacker", "Description": "The file packer observable.", "Type": "String", "Entity": null }, { "Name": "FilePath", "Description": "The file path observable.", "Type": "String", "Entity": null }, { "Name": "FileSize", "Description": "Size of the file in bytes", "Type": "Int32", "Entity": null }, { "Name": "FileType", "Description": "File extension type", "Type": "String", "Entity": null }, { "Name": "DomainName", "Description": "Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack", "Type": "String", "Entity": null }, { "Name": "NetworkIP", "Description": "The network IP address observable.", "Type": "String", "Entity": null }, { "Name": "NetworkPort", "Description": "The network port observable.", "Type": "Int32", "Entity": null }, { "Name": "NetworkDestinationAsn", "Description": "The network destination autonomous system number observable.", "Type": "Int32", "Entity": null }, { "Name": "NetworkDestinationCidrBlock", "Description": "The network destination CIDR block observable.", "Type": "String", "Entity": null }, { "Name": "NetworkDestinationIP", "Description": "The network destination IP address.", "Type": "String", "Entity": null }, { "Name": "NetworkCidrBlock", "Description": "The network CIDR block observable.", "Type": "String", "Entity": null }, { "Name": "NetworkDestinationPort", "Description": "The network destination port observable.", "Type": "Int32", "Entity": null }, { "Name": "NetworkProtocol", "Description": "The network protocol observable.", "Type": "Int32", "Entity": null }, { "Name": "NetworkSourceAsn", "Description": "The network source autonomous system number observable.", "Type": "Int32", "Entity": null }, { "Name": "NetworkSourceCidrBlock", "Description": "The network source CIDR block observable.", "Type": "String", "Entity": null }, { "Name": "NetworkSourceIP", "Description": "The network source IP address observable.", "Type": "String", "Entity": null }, { "Name": "NetworkSourcePort", "Description": "The network source port observable.", "Type": "Int32", "Entity": null }, { "Name": "Url", "Description": "Full Url from email", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "User agent information from the web browser or other client application", "Type": "String", "Entity": null }, { "Name": "IndicatorProvider", "Description": "The name of the entity that provided the indicator.", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "Update", "TableSource": "", "Description": "Details for update schedule run. Includes information such as which updates where available and which were installed.", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "Title", "Description": "Title of the alert", "Type": "String", "Entity": null }, { "Name": "Classification", "Description": "", "Type": "String", "Entity": null }, { "Name": "PublishedDate", "Description": "Date vulnerability was disclosed to the public", "Type": "DateTime", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "UpdateState", "Description": "", "Type": "String", "Entity": null }, { "Name": "Product", "Description": "", "Type": "String", "Entity": null }, { "Name": "OSType", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProductVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "ProductArch", "Description": "", "Type": "String", "Entity": null }, { "Name": "CVENumbers", "Description": "", "Type": "String", "Entity": null }, { "Name": "BulletinUrl", "Description": "", "Type": "String", "Entity": null }, { "Name": "BulletinID", "Description": "", "Type": "String", "Entity": null }, { "Name": "PackageRepository", "Description": "", "Type": "String", "Entity": null }, { "Name": "PackageSeverity", "Description": "", "Type": "String", "Entity": null }, { "Name": "OSName", "Description": "", "Type": "String", "Entity": null }, { "Name": "OSVersion", "Description": "Version of the operating system running on the machine", "Type": "String", "Entity": null }, { "Name": "OSFullName", "Description": "", "Type": "String", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier of the cloud service subscription", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceProvider", "Description": "", "Type": "String", "Entity": null }, { "Name": "Resource", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceType", "Description": "Type of cloud resource", "Type": "String", "Entity": null }, { "Name": "ComputerEnvironment", "Description": "", "Type": "String", "Entity": null }, { "Name": "VMUUID", "Description": "", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "", "Type": "String", "Entity": null }, { "Name": "MSRCSeverity", "Description": "", "Type": "String", "Entity": null }, { "Name": "KBID", "Description": "", "Type": "String", "Entity": null }, { "Name": "UpdateID", "Description": "", "Type": "String", "Entity": null }, { "Name": "RevisionNumber", "Description": "", "Type": "String", "Entity": null }, { "Name": "Optional", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "RebootBehavior", "Description": "", "Type": "String", "Entity": null }, { "Name": "MSRCBulletinID", "Description": "", "Type": "String", "Entity": null }, { "Name": "Approved", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "ApprovalSource", "Description": "", "Type": "String", "Entity": null }, { "Name": "InstallTimePredictionSeconds", "Description": "", "Type": "Double", "Entity": null }, { "Name": "InstallTimeDeviationRangeSeconds", "Description": "", "Type": "Double", "Entity": null }, { "Name": "InstallTimeAvailable", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "UpdateSummary", "TableSource": "", "Description": "Summary for each update schedule run. Includes information such as how many updates were not installed.", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "ManagementGroupName", "Description": "", "Type": "String", "Entity": null }, { "Name": "SourceComputerId", "Description": "The source computer ID of the activity", "Type": "String", "Entity": null }, { "Name": "OldestMissingSecurityUpdateInDays", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "OldestMissingSecurityUpdateBucket", "Description": "", "Type": "String", "Entity": null }, { "Name": "WindowsUpdateSetting", "Description": "", "Type": "String", "Entity": null }, { "Name": "WindowsUpdateAgentVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "WSUSServer", "Description": "", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "OsVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "NETRuntimeVersion", "Description": "", "Type": "String", "Entity": null }, { "Name": "CriticalUpdatesMissing", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "SecurityUpdatesMissing", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "OtherUpdatesMissing", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "TotalUpdatesMissing", "Description": "", "Type": "Int32", "Entity": null }, { "Name": "RestartPending", "Description": "", "Type": "Boolean", "Entity": null }, { "Name": "SubscriptionId", "Description": "Unique identifier of the cloud service subscription", "Type": "String", "Entity": null }, { "Name": "ResourceGroup", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceProvider", "Description": "", "Type": "String", "Entity": null }, { "Name": "Resource", "Description": "", "Type": "String", "Entity": null }, { "Name": "ResourceId", "Description": "Unique identifier of the resource accessed", "Type": "String", "Entity": null }, { "Name": "ResourceType", "Description": "Type of cloud resource", "Type": "String", "Entity": null }, { "Name": "ComputerEnvironment", "Description": "", "Type": "String", "Entity": null }, { "Name": "VMUUID", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "Usage", "TableSource": "sentinel", "Description": "Hourly usage data for each table in the workspace.", "Schema": [ { "Name": "Computer", "Description": "Deprecated", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Date and time the record was created.", "Type": "DateTime", "Entity": null }, { "Name": "Plan", "Description": "Plan of this table (Analytics, Basic or Auxiliary).", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "For Usage record SourceSystem is always OMS.", "Type": "String", "Entity": null }, { "Name": "StartTime", "Description": "Date and time of the first activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "EndTime", "Description": "Date and time of the last activity related to the behavior", "Type": "DateTime", "Entity": null }, { "Name": "ResourceUri", "Description": "The URI of the workspace. This will be same for all records in this table in workspace.", "Type": "String", "Entity": null }, { "Name": "LinkedResourceUri", "Description": "Deprecated", "Type": "String", "Entity": null }, { "Name": "DataType", "Description": "Table that usage is being reported about.", "Type": "String", "Entity": null }, { "Name": "Solution", "Description": "Solution about which usage is being reported.", "Type": "String", "Entity": null }, { "Name": "BatchesWithinSla", "Description": "Deprecated", "Type": "Int64", "Entity": null }, { "Name": "BatchesOutsideSla", "Description": "Deprecated", "Type": "Int64", "Entity": null }, { "Name": "BatchesCapped", "Description": "Deprecated", "Type": "Int64", "Entity": null }, { "Name": "TotalBatches", "Description": "Deprecated", "Type": "Int64", "Entity": null }, { "Name": "AvgLatencyInSeconds", "Description": "Deprecated", "Type": "Double", "Entity": null }, { "Name": "Quantity", "Description": "Size of data in Mbytes.", "Type": "Double", "Entity": null }, { "Name": "QuantityUnit", "Description": "Value is alwais Mbytes.", "Type": "String", "Entity": null }, { "Name": "IsBillable", "Description": "Logical flag to indicate whether we bill for this data record.", "Type": "Boolean", "Entity": null }, { "Name": "MeterId", "Description": "GUID of the meter used for billing.", "Type": "String", "Entity": null }, { "Name": "LinkedMeterId", "Description": "Deprecated", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "LogManagement" }, { "Name": "UserAccessAnalytics", "TableSource": "sentinel", "Description": "This analytics table, for a given user, provides the direct or transitive access to Azure resources. For example, if the user under investigation is Jane Smith, Access Analytics calculates all the Azure subscriptions that she either can access directly, via groups or serviceprincipals.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp when the access analytics is calculated", "Type": "DateTime", "Entity": null }, { "Name": "AADTenantId", "Description": "Unique identifier of the Azure Tenant", "Type": "String", "Entity": null }, { "Name": "SourceEntityType", "Description": "Type of entity which has access to the target entity", "Type": "String", "Entity": null }, { "Name": "SourceEntityId", "Description": "Unique identifier of entity which has access to the target entity", "Type": "String", "Entity": null }, { "Name": "SourceEntityName", "Description": "Display name of entity which has access to the target entity", "Type": "String", "Entity": null }, { "Name": "TargetEntityType", "Description": "Type of the entity which the source entity can access", "Type": "String", "Entity": null }, { "Name": "TargetEntityId", "Description": "Unique identifier of the entity which the source entity can access", "Type": "String", "Entity": null }, { "Name": "TargetEntityName", "Description": "Display name of the entity which the source entity can access", "Type": "String", "Entity": null }, { "Name": "AccessLevel", "Description": "The level of access that the source entity has to the target entity", "Type": "String", "Entity": null }, { "Name": "AccessType", "Description": "The type of access that the source entity has to the target entity", "Type": "String", "Entity": null }, { "Name": "AccessStartTime", "Description": "Timestamp when the source entity was provided access to the target entity", "Type": "DateTime", "Entity": null }, { "Name": "AccessEndTime", "Description": "Timestamp when the source entity's access to the target entity was revoked", "Type": "DateTime", "Entity": null }, { "Name": "AccessEndReason", "Description": "Reason why the source entity's access to the target entity was revoked", "Type": "String", "Entity": null }, { "Name": "AccessId", "Description": "Unique identifier for the access between source and target entity", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "UserPeerAnalytics", "TableSource": "sentinel", "Description": "This analytics table, for a given user, provides a ranked list of peers. For example, if the user is Jane Smith, Peer Analytics calculates all of Jane's peers based on her mailing list, security groups, etc and provides the top 20 of her peers.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "Timestamp when the peer analytics is calculated", "Type": "DateTime", "Entity": null }, { "Name": "AADTenantId", "Description": "Unique identifier of the Azure Tenant", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "Unique identifier of the primary user", "Type": "String", "Entity": null }, { "Name": "UserPrincipalName", "Description": "User principal name of the primary user", "Type": "String", "Entity": null }, { "Name": "UserName", "Description": "User name of the primary user", "Type": "String", "Entity": null }, { "Name": "PeerUserId", "Description": "Unique identifier of the peer of the primary user", "Type": "String", "Entity": null }, { "Name": "PeerUserPrincipalName", "Description": "User principal name of the peer of the primary user", "Type": "String", "Entity": null }, { "Name": "PeerUserName", "Description": "User name of the peer of the primary user", "Type": "String", "Entity": null }, { "Name": "Rank", "Description": "Rank of the peer with respect to the primary user", "Type": "Int32", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "Watchlist", "TableSource": "sentinel", "Description": "Azure Sentinel Watchlist contains imported data from CSV files that can be used to join or filter as an alert/incident condition.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The timestamp (UTC) of when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "AzureTenantId", "Description": "The AAD tenant ID to which this Watchlist table belongs.", "Type": "String", "Entity": null }, { "Name": "WatchlistId", "Description": "The Resource Manager Watchlist resource name.", "Type": "String", "Entity": null }, { "Name": "WatchlistItemId", "Description": "The Watchlist item unique ID.", "Type": "String", "Entity": null }, { "Name": "WatchlistName", "Description": "The display name of Watchlist.", "Type": "String", "Entity": null }, { "Name": "WatchlistAlias", "Description": "The unique string referring to the Watchlist.", "Type": "String", "Entity": null }, { "Name": "Source", "Description": "The registry path or other location used to determine the current device setting", "Type": "String", "Entity": null }, { "Name": "Provider", "Description": "The input provider of the Watchlist.", "Type": "String", "Entity": null }, { "Name": "CreatedBy", "Description": "Identity of the user account who created the profile", "Type": "Object", "Entity": null }, { "Name": "UpdatedBy", "Description": "The JSON object with the user who last updated the Watchlist or Watchlist item, including: Object ID, email and name.", "Type": "Object", "Entity": null }, { "Name": "CreatedTimeUTC", "Description": "The time (UTC) when the Watchlist or Watchlist item was first created.", "Type": "DateTime", "Entity": null }, { "Name": "LastUpdatedTimeUTC", "Description": "The time (UTC) when Watchlist or Watchlist item was last updated.", "Type": "DateTime", "Entity": null }, { "Name": "Notes", "Description": "The notes provided by user.", "Type": "String", "Entity": null }, { "Name": "Tags", "Description": "Labels representing various attributes used to identify or categorize a security configuration", "Type": "String", "Entity": null }, { "Name": "DefaultDuration", "Description": "The JSON object describing the default duration to live that each item of a Watchlist should inherit on creation. The default duration has this format : P(n)Y(n)M(n)DT(n)H(n)M(n)S, where P, Y, M, DT, H, M and S are invariant. For example, P3Y6M4DT12H30M9S represents a duration of three years, six months, four days, twelve hours, thirty minutes, and nine seconds.", "Type": "String", "Entity": null }, { "Name": "TimeToLive", "Description": "The time to live for a Watchlist record, expressed as a date and time of day (e.g. 2020-08-20T17:00:00.9618037Z). Its original value is inherited from Watchlist’s default duration. If TimeToLive passes, the record is considered deleted. A record's duration can be extended at any time by updating the TimeToLive value.", "Type": "DateTime", "Entity": null }, { "Name": "WatchlistItem", "Description": "The JSON object with key-value pairs from the input Watchlist source.", "Type": "Object", "Entity": null }, { "Name": "EntityMapping", "Description": "The JSON object with Azure Sentinel entity mapping to input columns.", "Type": "Object", "Entity": null }, { "Name": "CorrelationId", "Description": "Unique identifier of the sign-in event", "Type": "String", "Entity": null }, { "Name": "SearchKey", "Description": "The SearchKey is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field to join in other event tables by IP address.", "Type": "String", "Entity": null }, { "Name": "WatchlistCategory", "Description": "The Watchlist category provided by user.", "Type": "String", "Entity": null }, { "Name": "_DTTimestamp", "Description": "The time (UTC) when the event was generated.", "Type": "DateTime", "Entity": null }, { "Name": "_DTItemId", "Description": "The Watchlist or Watchlist item unique ID. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:johndoe@contoso.com'. A Watchlist item has unique ID and belongs to a Watchlist. The containing Watchlist can identified using the 'WatchlistId'.", "Type": "String", "Entity": null }, { "Name": "_DTItemType", "Description": "Distinguish between a Watchlist and a Watchlist item. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:johndoe@contoso.com'. A Watchlist item type will belong to a Watchlist type and the containing Watchlist can identified using the 'WatchlistId'.", "Type": "String", "Entity": null }, { "Name": "_DTItemStatus", "Description": "Was the Watchlist or Watchlist item created, updated or deleted by user. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:johndoe@contoso.com'. If a Watchlist is added, the the status would be 'Created'. If the name of the Watchlist is updated from 'RiskyUsers' to 'RiskyEmployees' the status would be 'Updated'.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "WindowsEvent", "TableSource": "sentinel", "Description": "Windows events which are collected and sent by the agent.", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The time stamp when the event was generated on the computer.", "Type": "DateTime", "Entity": null }, { "Name": "Provider", "Description": "System Properties Type - Identifies the provider that logged the event.", "Type": "String", "Entity": null }, { "Name": "Channel", "Description": "The channel to which the event was logged.", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "The name of the computer on which the event occurred.", "Type": "String", "Entity": null }, { "Name": "Task", "Description": "The task defined in the event.", "Type": "Int32", "Entity": null }, { "Name": "EventLevel", "Description": "Contains the severity level of the event.", "Type": "Int32", "Entity": null }, { "Name": "EventLevelName", "Description": "The rendered message string of the level specified in the event.", "Type": "String", "Entity": null }, { "Name": "EventID", "Description": "The identifier that the provider used to identify the event.", "Type": "Int32", "Entity": null }, { "Name": "ManagementGroupName", "Description": "Additional information based on the resource type.", "Type": "String", "Entity": null }, { "Name": "SystemUserId", "Description": "The ID of the user who is responsible for the event.", "Type": "String", "Entity": null }, { "Name": "Version", "Description": "Version of the agent.", "Type": "Int32", "Entity": null }, { "Name": "Opcode", "Description": "The opcode element is defined by the SystemPropertiesType complex type.", "Type": "String", "Entity": null }, { "Name": "Keywords", "Description": "A bitmask of the keywords defined in the event.", "Type": "String", "Entity": null }, { "Name": "Correlation", "Description": "The activity identifiers that consumers can use to group related events together.", "Type": "String", "Entity": null }, { "Name": "SystemProcessId", "Description": "Identifies the process that generated the event.", "Type": "Int32", "Entity": null }, { "Name": "SystemThreadId", "Description": "Identifies the thread that generated the event.", "Type": "Int32", "Entity": null }, { "Name": "EventRecordId", "Description": "The record number assigned to the event when it was logged.", "Type": "String", "Entity": null }, { "Name": "EventData", "Description": "Contains the event data parsed to dynamic type. If the parsing fails then this field will contain null and the RawEventData field will be populated.", "Type": "Object", "Entity": null }, { "Name": "RawEventData", "Description": "Full raw event information from the source application or service in JSON format", "Type": "String", "Entity": null }, { "Name": "EventOriginId", "Description": "VM ID obtained from the Azure Instance Metadata Service (IMDS).", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null, "TableSection": "Usx", "TableSectionName": "Microsoft Sentinel" }, { "Name": "WindowsFirewall", "TableSource": "", "Description": "Contains fully formed Windows Firewall log messages that already match the WindowsFirewall table format.", "Schema": [ { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Computer", "Description": "", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "", "Type": "DateTime", "Entity": null }, { "Name": "CommunicationDirection", "Description": "", "Type": "String", "Entity": null }, { "Name": "FirewallAction", "Description": "", "Type": "String", "Entity": null }, { "Name": "Protocol", "Description": "Protocol used during the communication", "Type": "String", "Entity": null }, { "Name": "SourceIP", "Description": "", "Type": "String", "Entity": null }, { "Name": "DestinationIP", "Description": "", "Type": "String", "Entity": null }, { "Name": "RemoteIP", "Description": "IP address that was being connected to", "Type": "String", "Entity": null }, { "Name": "SourcePort", "Description": "Port where the attacker communication originated from", "Type": "Int32", "Entity": null }, { "Name": "FullDestinationAddress", "Description": "", "Type": "String", "Entity": null }, { "Name": "DestinationPort", "Description": "Destination port of the activity", "Type": "Int32", "Entity": null }, { "Name": "RequestSizeInBytes", "Description": "", "Type": "Int64", "Entity": null }, { "Name": "Info", "Description": "", "Type": "String", "Entity": null }, { "Name": "ManagementGroupName", "Description": "", "Type": "String", "Entity": null }, { "Name": "MaliciousIP", "Description": "", "Type": "String", "Entity": null }, { "Name": "IndicatorThreatType", "Description": "", "Type": "String", "Entity": null }, { "Name": "Description", "Description": "Description of the information gathered", "Type": "String", "Entity": null }, { "Name": "TLPLevel", "Description": "", "Type": "String", "Entity": null }, { "Name": "Confidence", "Description": "", "Type": "String", "Entity": null }, { "Name": "Severity", "Description": "Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert", "Type": "Int32", "Entity": null }, { "Name": "FirstReportedDateTime", "Description": "", "Type": "String", "Entity": null }, { "Name": "LastReportedDateTime", "Description": "", "Type": "String", "Entity": null }, { "Name": "IsActive", "Description": "", "Type": "String", "Entity": null }, { "Name": "MaliciousIPLongitude", "Description": "", "Type": "Double", "Entity": null }, { "Name": "MaliciousIPLatitude", "Description": "", "Type": "Double", "Entity": null }, { "Name": "MaliciousIPCountry", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableSection": null, "TableSectionName": "Other hunting tables", "TableType": null, "TableRetention": null, "HasData": null, "Tags": null, "UsxResourceType": null }, { "Name": "AIAgentsInfo", "HasData": true, "Schema": [ { "Description": "Date and time when the record was generated", "Entity": null, "Name": "Timestamp", "Type": "DateTime" }, { "Description": "Unique identifier for the agent as assigned to it in Copilot Studio", "Entity": null, "Name": "AIAgentId", "Type": "String" }, { "Description": "Display name of the agent", "Entity": null, "Name": "AIAgentName", "Type": "String" }, { "Description": "Date and time when the agent was created", "Entity": null, "Name": "AgentCreationTime", "Type": "DateTime" }, { "Description": "User principal name (UPN) of the account that created the agent", "Entity": null, "Name": "CreatorAccountUpn", "Type": "String" }, { "Description": "User principal names (UPN) of all the owners of the agent", "Entity": null, "Name": "OwnerAccountUpns", "Type": "String" }, { "Description": "User principal name (UPN) of the account that last modified that agent", "Entity": null, "Name": "LastModifiedByUpn", "Type": "String" }, { "Description": "Date and time the item or related metadata was last modified", "Entity": null, "Name": "LastModifiedTime", "Type": "DateTime" }, { "Description": "Date and time when the agent was last published", "Entity": null, "Name": "LastPublishedTime", "Type": "DateTime" }, { "Description": "Description of the agent as displayed in the agent's source", "Entity": null, "Name": "AgentDescription", "Type": "String" }, { "Description": "Status of the agent", "Entity": null, "Name": "AgentStatus", "Type": "String" }, { "Description": "Details about the knowledge sources added to the agent", "Entity": null, "Name": "KnowledgeDetails", "Type": "Object" }, { "Description": "List of triggers that makes an autonomous agent take action", "Entity": null, "Name": "AgentActionTriggers", "Type": "String" }, { "Description": "Contents of the raw JSON that describes the agent and contains configuration details, as received from the provider", "Entity": null, "Name": "RawAgentInfo", "Type": "String" }, { "Description": "The agent's configured authentication type for users interacting with the agent; possible values: None, Microsoft, Custom.", "Entity": null, "Name": "UserAuthenticationType", "Type": "String" }, { "Description": "Indicates when authentication is triggered for the agent; possible values: Unspecified, None, Integrated, Custom Azure Active Directory, Generic OAuth2", "Entity": null, "Name": "AuthenticationTrigger", "Type": "String" }, { "Description": "Users that can interact with the agent; possible values: Any, Copilot readers, Group membership, Any (multitenant)", "Entity": null, "Name": "AccessControlPolicy", "Type": "String" }, { "Description": "List of Azure Active Directory Group IDs that are allowed to interact with the agent", "Entity": null, "Name": "AuthorizedSecurityGroupIds", "Type": "Object" }, { "Description": "Specifications of the topics that the agent can perform", "Entity": null, "Name": "AgentTopicsDetails", "Type": "Object" }, { "Description": "Specifications of the tools that the agent can access and perform actions on", "Entity": null, "Name": "AgentToolsDetails", "Type": "Object" }, { "Description": "The identifier of the Microsoft Power Platform environment the agent resides in.", "Entity": null, "Name": "EnvironmentId", "Type": "String" }, { "Description": "The platform that provided the information about the agents; possible values: Copilot Studio", "Entity": null, "Name": "Platform", "Type": "String" }, { "Description": "Indicates whether the agent uses generative orchestration (that is, dynamically chooses tools, knowledge, and actions based on context) to operate.", "Entity": null, "Name": "IsGenerativeOrchestrationEnabled", "Type": "Boolean" }, { "Description": "The unique app identifier registered for the agent in Microsoft Entra.", "Entity": null, "Name": "AgentAppId", "Type": "String" }, { "Description": "Lists the schema names of connected agents, which are independently managed agents that are linked to the main one for orchestration.", "Entity": null, "Name": "ConnectedAgentsSchemaNames", "Type": "Object" }, { "Description": "Lists the schema names of the child agents that exist within the main agent.", "Entity": null, "Name": "ChildAgentsSchemaNames", "Type": "Object" }, { "Description": "Which registry provided this agent's metadata (A365 or MDA).", "Entity": null, "Name": "RegistrySource", "Type": "String" }, { "Description": "The agent's system prompt or instructions that define its behavior.", "Entity": null, "Name": "Instructions", "Type": "String" }, { "Description": "The Entra Enterprise Application Object ID associated with this agent, used for identity correlation.", "Entity": null, "Name": "EntraObjectId", "Type": "String" }, { "Description": "The Entra Blueprint service principal ID for hire-able agents.", "Entity": null, "Name": "EntraBlueprintId", "Type": "String" }, { "Description": "Indicates whether the agent is currently blocked by an administrator.", "Entity": null, "Name": "IsBlocked", "Type": "Boolean" }, { "Description": "The version identifier of the agent, as declared in its manifest.", "Entity": null, "Name": "Version", "Type": "String" }, { "Description": "The name of the AI model powering this agent.", "Entity": null, "Name": "AIModel", "Type": "String" }, { "Description": "The capabilities and tools available to this agent, such as web search, file access, or graph connectors.", "Entity": null, "Name": "AccessCapabilities", "Type": "Object" }, { "Description": "The MOS element classification for this agent, indicating its runtime type within the M365 ecosystem.", "Entity": null, "Name": "ElementTypes", "Type": "Object" }, { "Description": "The platform-native identifier for this agent, scoped by OriginatingStore.", "Entity": null, "Name": "SourceAgentId", "Type": "String" } ], "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "TableType": "Regular", "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null, "TableSource": "defender", "Description": "This table will hold inventory information about AI Agents that have been created in Copilot365 or Copilot Studio" }, { "Name": "AADSpnSignInEventsBeta", "HasData": true, "Schema": [ { "Description": "Date and time when the record was generated", "Entity": null, "Name": "Timestamp", "Type": "DateTime" }, { "Description": "Application that performed the recorded action", "Entity": null, "Name": "Application", "Type": "String" }, { "Description": "Unique identifier for the application", "Entity": null, "Name": "ApplicationId", "Type": "String" }, { "Description": "Indicates whether the sign-in was initiated by a managed identity", "Entity": null, "Name": "IsManagedIdentity", "Type": "Boolean" }, { "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Entity": null, "Name": "ErrorCode", "Type": "Int32" }, { "Description": "Unique identifier of the sign-in event", "Entity": null, "Name": "CorrelationId", "Type": "String" }, { "Description": "Name of the service principal that initiated the sign-in", "Entity": null, "Name": "ServicePrincipalName", "Type": "String" }, { "Description": "Unique identifier of the service principal that performed the action", "Entity": null, "Name": "ServicePrincipalId", "Type": "String" }, { "Description": "Display name of the resource accessed. The display name can contain any character.", "Entity": null, "Name": "ResourceDisplayName", "Type": "String" }, { "Description": "Unique identifier of the resource accessed", "Entity": null, "Name": "ResourceId", "Type": "String" }, { "Description": "Unique identifier of the tenant of the resource accessed", "Entity": null, "Name": "ResourceTenantId", "Type": "String" }, { "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Entity": "Ip", "Name": "IPAddress", "Type": "String" }, { "Description": "Country/Region where the account user is located", "Entity": null, "Name": "Country", "Type": "String" }, { "Description": "State where the sign-in occurred, if available", "Entity": null, "Name": "State", "Type": "String" }, { "Description": "City where the client IP address is geolocated", "Entity": null, "Name": "City", "Type": "String" }, { "Description": "The north to south coordinates of the sign-in location", "Entity": null, "Name": "Latitude", "Type": "String" }, { "Description": "The east to west coordinates of the sign-in location", "Entity": null, "Name": "Longitude", "Type": "String" }, { "Description": "Unique identifier of the request", "Entity": null, "Name": "RequestId", "Type": "String" }, { "Description": "Unique identifier for the event", "Entity": null, "Name": "ReportId", "Type": "String" }, { "Description": "Indicates if the sign in was done via confidential client applications", "Entity": null, "Name": "IsConfidentialClient", "Type": "Boolean" } ], "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "TableType": "Regular", "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null, "TableSource": "defender", "Description": "Information about sign-in events initiated by Microsoft Entra ID service principal or managed identities" }, { "Name": "AADSignInEventsBeta", "HasData": true, "Schema": [ { "Description": "Date and time when the record was generated", "Entity": null, "Name": "Timestamp", "Type": "DateTime" }, { "Description": "Application that performed the recorded action", "Entity": null, "Name": "Application", "Type": "String" }, { "Description": "Unique identifier for the application", "Entity": null, "Name": "ApplicationId", "Type": "String" }, { "Description": "Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service", "Entity": null, "Name": "LogonType", "Type": "String" }, { "Description": "Information about the Microsoft Entra ID endpoint that the request was sent to and the type of request sent during sign in", "Entity": null, "Name": "EndpointCall", "Type": "String" }, { "Description": "Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes", "Entity": null, "Name": "ErrorCode", "Type": "Int32" }, { "Description": "Unique identifier of the sign-in event", "Entity": null, "Name": "CorrelationId", "Type": "String" }, { "Description": "Unique number assigned to a user by a website's server for the duration of the visit or session", "Entity": null, "Name": "SessionId", "Type": "String" }, { "Description": "Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.", "Entity": null, "Name": "AccountDisplayName", "Type": "String" }, { "Description": "Unique identifier for the account in Microsoft Entra ID", "Entity": "UserObjectId", "Name": "AccountObjectId", "Type": "String" }, { "Description": "User principal name (UPN) of the account", "Entity": null, "Name": "AccountUpn", "Type": "String" }, { "Description": "Indicates whether a user inside the network does not belong to the organization’s domain", "Entity": null, "Name": "IsExternalUser", "Type": "Int32" }, { "Description": "Indicates whether the user that signed in is a guest in the tenant", "Entity": null, "Name": "IsGuestUser", "Type": "Boolean" }, { "Description": "On-premises user principal name (UPN) of the user signing in to Microsoft Entra ID", "Entity": null, "Name": "AlternateSignInName", "Type": "String" }, { "Description": "Date and time when the user that signed in last changed their password", "Entity": null, "Name": "LastPasswordChangeTimestamp", "Type": "DateTime" }, { "Description": "Display name of the resource accessed. The display name can contain any character.", "Entity": null, "Name": "ResourceDisplayName", "Type": "String" }, { "Description": "Unique identifier of the resource accessed", "Entity": null, "Name": "ResourceId", "Type": "String" }, { "Description": "Unique identifier of the tenant of the resource accessed", "Entity": null, "Name": "ResourceTenantId", "Type": "String" }, { "Description": "Fully qualified domain name (FQDN) of the device", "Entity": "Machine", "Name": "DeviceName", "Type": "String" }, { "Description": "Unique identifier for the device in Microsoft Entra ID", "Entity": null, "Name": "AadDeviceId", "Type": "String" }, { "Description": "Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7", "Entity": null, "Name": "OSPlatform", "Type": "String" }, { "Description": "Indicates the trust type of the device that signed in. For managed device scenarios only. Possible values are Workplace, AzureAd, and ServerAd.", "Entity": null, "Name": "DeviceTrustType", "Type": "String" }, { "Description": "Indicates if the device is managed by the organization (True) or not (False)", "Entity": null, "Name": "IsManaged", "Type": "Int32" }, { "Description": "Indicates whether the device that initiated the event is compliant or not", "Entity": null, "Name": "IsCompliant", "Type": "Int32" }, { "Description": "Details about the authentication processor", "Entity": null, "Name": "AuthenticationProcessingDetails", "Type": "String" }, { "Description": "Type of authentication required for the sign-in. Possible values: multiFactorAuthentication (MFA was required) and singleFactorAuthentication (no MFA was required).", "Entity": null, "Name": "AuthenticationRequirement", "Type": "String" }, { "Description": "Indicates if the token issuer is Microsoft Entra ID (0) or Active Directory Federation Services (1)", "Entity": null, "Name": "TokenIssuerType", "Type": "String" }, { "Description": "Aggregated risk level during sign-in. Possible values: 0 (aggregated risk level not set), 1 (none), 10 (low), 50 (medium), or 100 (high).", "Entity": null, "Name": "RiskLevelAggregated", "Type": "Int32" }, { "Description": "User risk level at sign-in", "Entity": null, "Name": "RiskLevelDuringSignIn", "Type": "Int32" }, { "Description": "Array of risk event types applicable to the event", "Entity": null, "Name": "RiskEventTypes", "Type": "String" }, { "Description": "Indicates risky user state. Possible values: 0 (none), 1 (confirmed safe), 2 (remediated), 3 (dismissed), 4 (at risk), or 5 (confirmed compromised).", "Entity": null, "Name": "RiskState", "Type": "Int32" }, { "Description": "User agent information from the web browser or other client application", "Entity": null, "Name": "UserAgent", "Type": "String" }, { "Description": "Indicates the client app used", "Entity": null, "Name": "ClientAppUsed", "Type": "String" }, { "Description": "Details about the version of the browser used to sign in", "Entity": null, "Name": "Browser", "Type": "String" }, { "Description": "Details of the conditional access policies applied to the sign-in event", "Entity": null, "Name": "ConditionalAccessPolicies", "Type": "String" }, { "Description": "Status of the conditional access policies applied to the sign-in. Possible values are 0 (policies applied), 1 (attempt to apply policies failed), or 2 (policies not applied).", "Entity": null, "Name": "ConditionalAccessStatus", "Type": "Int32" }, { "Description": "IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts", "Entity": "Ip", "Name": "IPAddress", "Type": "String" }, { "Description": "Country/Region where the account user is located", "Entity": null, "Name": "Country", "Type": "String" }, { "Description": "State where the sign-in occurred, if available", "Entity": null, "Name": "State", "Type": "String" }, { "Description": "City where the client IP address is geolocated", "Entity": null, "Name": "City", "Type": "String" }, { "Description": "The north to south coordinates of the sign-in location", "Entity": null, "Name": "Latitude", "Type": "String" }, { "Description": "The east to west coordinates of the sign-in location", "Entity": null, "Name": "Longitude", "Type": "String" }, { "Description": "Network location details of the authentication processor of the sign-in event", "Entity": null, "Name": "NetworkLocationDetails", "Type": "String" }, { "Description": "Unique identifier of the request", "Entity": null, "Name": "RequestId", "Type": "String" }, { "Description": "Unique identifier for the event", "Entity": null, "Name": "ReportId", "Type": "String" }, { "Description": "Unique identifier for the device in Microsoft Entra ID", "Entity": null, "Name": "EntraIdDeviceId", "Type": "String" } ], "TableRetention": { "ColdDays": 0, "HotDays": 30, "TotalInteractiveDays": 30 }, "TableType": "Regular", "Tags": null, "UsxResourceType": "Defender", "TableSection": "Itp", "TableSectionName": null, "TableSource": "defender", "Description": "Information about Microsoft Entra ID sign-in events either by a user (interactive) or a client on the user's behalf (non-interactive)" }, { "Name": "AADGraphActivityLogs", "Schema": [ { "Name": "TenantId", "Description": "Unique identifier of the tenant into which the data connector ingests data.", "Type": "String", "Entity": null }, { "Name": "TimeGenerated", "Description": "The date and time the request was received.", "Type": "DateTime", "Entity": null }, { "Name": "TimeRequested", "Description": "The timestamp when the request was made.", "Type": "DateTime", "Entity": null }, { "Name": "Location", "Description": "The name of the region that served the request.", "Type": "String", "Entity": null }, { "Name": "RequestId", "Description": "The identifier representing the request.", "Type": "String", "Entity": null }, { "Name": "AADTenantId", "Description": "The identifier of the tenant where the request was made.", "Type": "String", "Entity": null }, { "Name": "OperationName", "Description": "The name of the operation performed on the resource.", "Type": "String", "Entity": null }, { "Name": "ApiVersion", "Description": "The API version of the operation.", "Type": "String", "Entity": null }, { "Name": "Category", "Description": "The log category, e.g., AzureADGraphActivityLogs.", "Type": "String", "Entity": null }, { "Name": "ResultSignature", "Description": "The HTTP response status or outcome of the operation.", "Type": "String", "Entity": null }, { "Name": "DurationMs", "Description": "The duration of the request in milliseconds.", "Type": "Int32", "Entity": null }, { "Name": "Level", "Description": "The severity level of the event (e.g., Informational).", "Type": "String", "Entity": null }, { "Name": "RequestMethod", "Description": "The HTTP method used (e.g., GET, POST).", "Type": "String", "Entity": null }, { "Name": "ResponseStatusCode", "Description": "The HTTP status code returned in the response.", "Type": "Int32", "Entity": null }, { "Name": "ResponseSizeBytes", "Description": "The size of the response returned to the caller, in bytes.", "Type": "Int32", "Entity": null }, { "Name": "SignInActivityId", "Description": "The identifier representing the sign-in activity.", "Type": "String", "Entity": null }, { "Name": "Roles", "Description": "The roles assigned in the token claims.", "Type": "String", "Entity": null }, { "Name": "TokenIssuedAt", "Description": "The timestamp when the token was issued.", "Type": "DateTime", "Entity": null }, { "Name": "ActorType", "Description": "The type of actor making the request (e.g., User, Application).", "Type": "String", "Entity": null }, { "Name": "AppId", "Description": "The identifier of the application making the request.", "Type": "String", "Entity": null }, { "Name": "UserId", "Description": "The identifier of the user making the request.", "Type": "String", "Entity": null }, { "Name": "ServicePrincipalId", "Description": "The identifier of the service principal making the request.", "Type": "String", "Entity": null }, { "Name": "Scopes", "Description": "The scopes included in the token claims.", "Type": "String", "Entity": null }, { "Name": "IdentityProvider", "Description": "The identity provider used during authentication.", "Type": "String", "Entity": null }, { "Name": "ClientAuthMethod", "Description": "The authentication method used by the client.", "Type": "String", "Entity": null }, { "Name": "Wids", "Description": "The WIDs from the token claims.", "Type": "String", "Entity": null }, { "Name": "CallerIpAddress", "Description": "The IP address of the caller making the request.", "Type": "String", "Entity": null }, { "Name": "UserAgent", "Description": "The user agent string provided by the client.", "Type": "String", "Entity": null }, { "Name": "RequestUri", "Description": "The URI of the request sent to the AAD Graph API.", "Type": "String", "Entity": null }, { "Name": "SessionId", "Description": "The session identifier from the request context.", "Type": "String", "Entity": null }, { "Name": "DeviceId", "Description": "The identifier of the device used in the request.", "Type": "String", "Entity": null }, { "Name": "SourceSystem", "Description": "", "Type": "String", "Entity": null }, { "Name": "Type", "Description": "The name of the table", "Type": "String", "Entity": null }, { "Name": "_IsBillable", "Description": "", "Type": "String", "Entity": null }, { "Name": "_BilledSize", "Description": "", "Type": "Double", "Entity": null }, { "Name": "_ResourceId", "Description": "A unique identifier for the resource that the record is associated with", "Type": "String", "Entity": null }, { "Name": "_SubscriptionId", "Description": "A unique identifier for the subscription that the record is associated with", "Type": "String", "Entity": null } ], "TableType": "Regular", "TableRetention": { "HotDays": 14, "ColdDays": 76, "TotalInteractiveDays": 90 }, "HasData": true, "Tags": [ { "Type": "Category", "Value": "Audit" }, { "Type": "Category", "Value": "Security" }, { "Type": "Solution", "Value": "LogManagement" } ], "UsxResourceType": "LogAnalytics", "TableSection": "Usx", "TableSectionName": "LogManagement", "TableSource": "sentinel", "Description": "AAD Graph Activity Logs provide details of legacy API requests made to Azure Active Directory Graph for resources in the tenant." } ]