{ "version": 1, "entries": [ { "id": "0510dbaf07ed7d50d8a3", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "2e1fdc79a0311fd1", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "AppOwnerOrganizationId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=AppOwnerOrganizationId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "0bff90159e31be010dc8", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "2e1fdc79a0311fd1", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "AppOwnerOrganizationId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=AppOwnerOrganizationId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "0f492a8211655b3618c1", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "8fbde03e79e0437e", "format": "json", "encoding": "json-string", "example": [ { "key": "DeviceId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "DeviceOSType", "value": "VALUE_1" }, { "key": "DeviceTrustType", "value": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=DeviceId]", "type": "named-property" }, { "path": "$[][key=DeviceOSType]", "type": "named-property" }, { "path": "$[][key=DeviceTrustType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "1a6db5740046a873ae16", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal credentials" }, "shapeId": "290a9b92f3ac2551", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "221d416492fcf7a22519", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Import" }, "shapeId": "2b0aa158812d0727", "format": "json", "encoding": "json-string", "example": [ { "key": "Details", "value": "VALUE_1" }, { "key": "ErrorCode", "value": "VALUE_1" }, { "key": "EventName", "value": "VALUE_2" }, { "key": "JoiningProperty", "value": "VALUE_3" }, { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "SourceAnchor", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "TargetAnchor", "value": "VALUE_1" }, { "key": "ipaddr", "value": "VALUE_1" }, { "key": "oid", "value": "VALUE_1" }, { "key": "tid", "value": "VALUE_1" }, { "key": "wids", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Details]", "type": "named-property" }, { "path": "$[][key=ErrorCode]", "type": "named-property" }, { "path": "$[][key=EventName]", "type": "named-property" }, { "path": "$[][key=JoiningProperty]", "type": "named-property" }, { "path": "$[][key=RequestId]", "type": "named-property" }, { "path": "$[][key=SourceAnchor]", "type": "named-property" }, { "path": "$[][key=TargetAnchor]", "type": "named-property" }, { "path": "$[][key=ipaddr]", "type": "named-property" }, { "path": "$[][key=oid]", "type": "named-property" }, { "path": "$[][key=tid]", "type": "named-property" }, { "path": "$[][key=wids]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "25341c0c8b091955f5a5", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal" }, "shapeId": "290a9b92f3ac2551", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "397687110c43668578b6", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Execution" }, "shapeId": "2b0aa158812d0727", "format": "json", "encoding": "json-string", "example": [ { "key": "Details", "value": "VALUE_1" }, { "key": "ErrorCode", "value": "VALUE_2" }, { "key": "EventName", "value": "VALUE_3" }, { "key": "JoiningProperty", "value": "VALUE_2" }, { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "SourceAnchor", "value": "VALUE_2" }, { "key": "TargetAnchor", "value": "VALUE_2" }, { "key": "ipaddr", "value": "VALUE_2" }, { "key": "oid", "value": "VALUE_2" }, { "key": "tid", "value": "VALUE_2" }, { "key": "wids", "value": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Details]", "type": "named-property" }, { "path": "$[][key=ErrorCode]", "type": "named-property" }, { "path": "$[][key=EventName]", "type": "named-property" }, { "path": "$[][key=JoiningProperty]", "type": "named-property" }, { "path": "$[][key=RequestId]", "type": "named-property" }, { "path": "$[][key=SourceAnchor]", "type": "named-property" }, { "path": "$[][key=TargetAnchor]", "type": "named-property" }, { "path": "$[][key=ipaddr]", "type": "named-property" }, { "path": "$[][key=oid]", "type": "named-property" }, { "path": "$[][key=tid]", "type": "named-property" }, { "path": "$[][key=wids]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "3c6ea95735618508704f", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "290a9b92f3ac2551", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "44f096147a0341a8e194", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Consent to application" }, "shapeId": "2e1fdc79a0311fd1", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "AppOwnerOrganizationId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=AppOwnerOrganizationId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "4546ab8d951fcaf94cf6", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "shapeId": "0a1afcf70b7d929d", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "4765d5bf2b07cdd6961b", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Consent to application" }, "shapeId": "0a1afcf70b7d929d", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "56f73df9ca4829692958", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal credentials" }, "shapeId": "13f935868bad877a", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "AppOwnerOrganizationId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=AppOwnerOrganizationId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "65f9345a4b3c082c2fa4", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "1550927c48d87b3e", "format": "json", "encoding": "native-json", "example": [ { "Name": "UserAgent", "Value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].Name", "type": "string" }, { "path": "$[].Value", "type": "string" }, { "path": "$[][Name=UserAgent]", "type": "named-property" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "72a67a9e3672b273e683", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "35c1edeaeccc646d", "format": "json", "encoding": "json-string", "example": [ { "key": "DeviceId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "DeviceOSType", "value": "VALUE_1" }, { "key": "DeviceTrustType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_3" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=DeviceId]", "type": "named-property" }, { "path": "$[][key=DeviceOSType]", "type": "named-property" }, { "path": "$[][key=DeviceTrustType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "7929e92d67f96536b905", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal credentials" }, "shapeId": "13f935868bad877a", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "AppOwnerOrganizationId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=AppOwnerOrganizationId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "7e1a492a8a65c380d904", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Settings_GetSettingsAsync" }, "shapeId": "b1ae68ab4d366e4c", "format": "json", "encoding": "json-string", "example": [ { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000001" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=RequestId]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "812e700129b6e50c261f", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "2c91d3e3131b5c47", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "99f4f0427f3cd2c182f1", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "8bb8a1a04d03e987", "format": "json", "encoding": "json-string", "example": [ { "key": "UserType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=UserType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "ac6156b30bbfc29f95ff", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment to service principal" }, "shapeId": "0a1afcf70b7d929d", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "afdcb5fe8da3dc226b63", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "RoleManagement", "LoggedByService": "Core Directory", "OperationName": "Add member to role" }, "shapeId": "ae2d16b5ff11cadc", "format": "json", "encoding": "json-string", "example": [], "fields": [ { "path": "$", "type": "array" } ], "origin": "observed", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "b1861a875325dad251de", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "shapeId": "2b0aa158812d0727", "format": "json", "encoding": "json-string", "example": [ { "key": "Details", "value": "VALUE_1" }, { "key": "ErrorCode", "value": "VALUE_1" }, { "key": "EventName", "value": "VALUE_2" }, { "key": "JoiningProperty", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "SourceAnchor", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "TargetAnchor", "value": "VALUE_1" }, { "key": "ipaddr", "value": "VALUE_1" }, { "key": "oid", "value": "VALUE_1" }, { "key": "tid", "value": "VALUE_1" }, { "key": "wids", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Details]", "type": "named-property" }, { "path": "$[][key=ErrorCode]", "type": "named-property" }, { "path": "$[][key=EventName]", "type": "named-property" }, { "path": "$[][key=JoiningProperty]", "type": "named-property" }, { "path": "$[][key=RequestId]", "type": "named-property" }, { "path": "$[][key=SourceAnchor]", "type": "named-property" }, { "path": "$[][key=TargetAnchor]", "type": "named-property" }, { "path": "$[][key=ipaddr]", "type": "named-property" }, { "path": "$[][key=oid]", "type": "named-property" }, { "path": "$[][key=tid]", "type": "named-property" }, { "path": "$[][key=wids]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "b3ca1094f70ac03ede6f", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Group_GetDynamicGroupProperties" }, "shapeId": "b1ae68ab4d366e4c", "format": "json", "encoding": "json-string", "example": [ { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000001" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=RequestId]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "b9d8dfabd3c9833abb6b", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "13f935868bad877a", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "AppOwnerOrganizationId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=AppOwnerOrganizationId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "bfba2c1150324a326f84", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Create application \u2013 Certificates and secrets management " }, "shapeId": "2c91d3e3131b5c47", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "c7fd787eb66a59aa8054", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "290a9b92f3ac2551", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "c8fe0b953a35e597f6ef", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "shapeId": "2c91d3e3131b5c47", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "ccbc4698debc4bb21566", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "Authentication", "LoggedByService": "B2C", "OperationName": "Validate user authentication" }, "shapeId": "00723f5ee2db5bba", "format": "json", "encoding": "json-string", "example": [ { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000002" }, { "key": "actorIdentityType", "value": "VALUE_2" }, { "key": "targetEntityType", "value": "VALUE_1" }, { "key": "targetTenant", "value": "00000000-0000-4000-8000-000000000001" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=RequestId]", "type": "named-property" }, { "path": "$[][key=actorIdentityType]", "type": "named-property" }, { "path": "$[][key=targetEntityType]", "type": "named-property" }, { "path": "$[][key=targetTenant]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d033694bf04eacfc2dab", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "6078758a642f5418", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d4ddc4c33a279d1b6ba0", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupsODataV4_Get" }, "shapeId": "b1ae68ab4d366e4c", "format": "json", "encoding": "json-string", "example": [ { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000001" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=RequestId]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d68b7f808bb9b1e66122", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "ba43b38f1e381554", "format": "json", "encoding": "json-string", "example": [ { "key": "User-Agent", "value": "VALUE_2" }, { "key": "UserType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=User-Agent]", "type": "named-property" }, { "path": "$[][key=UserType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "dbec9f1ec7b4debde56e", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Other" }, "shapeId": "2b0aa158812d0727", "format": "json", "encoding": "json-string", "example": [ { "key": "Details", "value": "VALUE_1" }, { "key": "ErrorCode", "value": "VALUE_1" }, { "key": "EventName", "value": "VALUE_2" }, { "key": "JoiningProperty", "value": "VALUE_3" }, { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "SourceAnchor", "value": "VALUE_1" }, { "key": "TargetAnchor", "value": "VALUE_1" }, { "key": "ipaddr", "value": "VALUE_1" }, { "key": "oid", "value": "VALUE_1" }, { "key": "tid", "value": "VALUE_1" }, { "key": "wids", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Details]", "type": "named-property" }, { "path": "$[][key=ErrorCode]", "type": "named-property" }, { "path": "$[][key=EventName]", "type": "named-property" }, { "path": "$[][key=JoiningProperty]", "type": "named-property" }, { "path": "$[][key=RequestId]", "type": "named-property" }, { "path": "$[][key=SourceAnchor]", "type": "named-property" }, { "path": "$[][key=TargetAnchor]", "type": "named-property" }, { "path": "$[][key=ipaddr]", "type": "named-property" }, { "path": "$[][key=oid]", "type": "named-property" }, { "path": "$[][key=tid]", "type": "named-property" }, { "path": "$[][key=wids]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "dc4c9aa5791a60bcc854", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal credentials" }, "shapeId": "290a9b92f3ac2551", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "e0c8ecee3501a868b9ac", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment grant to user" }, "shapeId": "0a1afcf70b7d929d", "format": "json", "encoding": "json-string", "example": [ { "key": "AppId", "value": "00000000-0000-4000-8000-000000000001" }, { "key": "ServicePrincipalProvisioningType", "value": "VALUE_2" }, { "key": "User-Agent", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=AppId]", "type": "named-property" }, { "path": "$[][key=ServicePrincipalProvisioningType]", "type": "named-property" }, { "path": "$[][key=User-Agent]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "fcab5ee85cbb1a0063b6", "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupLifecyclePolicies_Get" }, "shapeId": "b1ae68ab4d366e4c", "format": "json", "encoding": "json-string", "example": [ { "key": "RequestId", "value": "00000000-0000-4000-8000-000000000001" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=RequestId]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "05085f04b3aa00d7b6ed", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal" }, "shapeId": "f0ddd6dfc7ea57e1", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": "00000000-0000-4000-8000-000000000001", "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "string" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "1166f3bb5de49cecb6ea", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Consent to application" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "11e1184980162b301eb1", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "f0ddd6dfc7ea57e1", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": "00000000-0000-4000-8000-000000000001", "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "string" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "15c6d31b1a6cbbad095f", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal credentials" }, "shapeId": "f0ddd6dfc7ea57e1", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": "00000000-0000-4000-8000-000000000001", "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "string" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "1698a5e112adc75eba82", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupsODataV4_Get" }, "shapeId": "30fc2dedc70bac5a", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1@example.invalid", "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "19abcb09f1f46fa1d078", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "f0ddd6dfc7ea57e1", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": "00000000-0000-4000-8000-000000000001", "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "string" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "1a00f741dae9db7bcdd9", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal credentials" }, "shapeId": "f0ddd6dfc7ea57e1", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": "00000000-0000-4000-8000-000000000001", "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "string" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "3d795f8297674960c5ad", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment grant to user" }, "shapeId": "d66b0064cd657ea0", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "null" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "428f07ad2b08e4a9e48b", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Group_GetDynamicGroupProperties" }, "shapeId": "30fc2dedc70bac5a", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1@example.invalid", "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "429bc39826bc5f5603f9", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "439c7b2a983574739a24", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "f0ddd6dfc7ea57e1", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": "00000000-0000-4000-8000-000000000001", "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "string" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "451656be9c3a330feb2b", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Create application \u2013 Certificates and secrets management " }, "shapeId": "d66b0064cd657ea0", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "null" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "60147e23a01b9fa21bd0", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "RoleManagement", "LoggedByService": "PIM", "OperationName": "Add member to role in PIM completed (timebound)" }, "shapeId": "97dc185df1b6133c", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": null, "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "null" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "6b250ccb26eb5727765a", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "7b8c3d4515abb825", "format": "json", "encoding": "native-json", "example": { "user": { "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "754d7f27faf36134c94f", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "86db2f47f8226ad19e23", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "d66b0064cd657ea0", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "null" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "89ada96b7fd2e693809c", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Execution" }, "shapeId": "30fc2dedc70bac5a", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "964260e220b651139ad8", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "f0ddd6dfc7ea57e1", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": "00000000-0000-4000-8000-000000000001", "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "string" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "975c8634e8164d9ecf99", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Import" }, "shapeId": "30fc2dedc70bac5a", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "97ea08b41256897a43b6", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Settings_GetSettingsAsync" }, "shapeId": "30fc2dedc70bac5a", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1@example.invalid", "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "a236742d8291abb34ebc", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "d66b0064cd657ea0", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "null" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "a5dda084b3eea16bf799", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "a7c723d9fce9a420efc0", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "d66b0064cd657ea0", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "null" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "bb568ec43b4b0addac89", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "shapeId": "d66b0064cd657ea0", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "null" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "bb9c058e7b0ab2fa40b2", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Other" }, "shapeId": "30fc2dedc70bac5a", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "c776c21ce48424b5c9e2", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "Authentication", "LoggedByService": "B2C", "OperationName": "Validate user authentication" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1@example.invalid", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d8883afda76a04af11e5", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment grant to user" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "e538737d8894a8f95c23", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Create application \u2013 Certificates and secrets management " }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "e91a0ee8db3e748b5003", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment to service principal" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "eb2c599ed5b1337111c8", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "shapeId": "30fc2dedc70bac5a", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": "USERNAME_1", "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "string" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "ede0f98e06900fb16ed5", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupLifecyclePolicies_Get" }, "shapeId": "83f7087f380f66f0", "format": "json", "encoding": "json-string", "example": { "app": { "agentType": "VALUE_1", "appId": null, "blueprintId": null, "displayName": null, "servicePrincipalId": null, "servicePrincipalName": null } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.app", "type": "object" }, { "path": "$.app.agentType", "type": "string" }, { "path": "$.app.appId", "type": "null" }, { "path": "$.app.blueprintId", "type": "null" }, { "path": "$.app.displayName", "type": "null" }, { "path": "$.app.servicePrincipalId", "type": "null" }, { "path": "$.app.servicePrincipalName", "type": "null" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "f597d4b28edf4a154eca", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "shapeId": "d66b0064cd657ea0", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "null" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "fa1f3a2d806360133b9c", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "fbe4090e0497fdd62c2b", "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "020ba0cde8532f17", "format": "json", "encoding": "json-string", "example": { "user": { "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "ipAddress": "192.0.2.1", "roles": [], "userPrincipalName": "USERNAME_1@example.invalid" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.user", "type": "object" }, { "path": "$.user.agentType", "type": "string" }, { "path": "$.user.displayName", "type": "string" }, { "path": "$.user.id", "type": "string" }, { "path": "$.user.ipAddress", "type": "string" }, { "path": "$.user.roles", "type": "array" }, { "path": "$.user.userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "0489d579e7cb83340caa", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "RoleManagement", "LoggedByService": "PIM", "OperationName": "Add member to role in PIM requested (timebound)" }, "shapeId": "e0b11f9fb4f4def0", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME", "id": "00000000-0000-4000-8000-000000000003", "modifiedProperties": [], "type": "User", "userPrincipalName": "USERNAME_1@example.invalid" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "\"00000000-0000-4000-8000-000000000001\"", "oldValue": "\"VALUE_2\"" }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "\"VALUE_3\"", "oldValue": "\"VALUE_2\"" }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "\"00000000-0000-4000-8000-000000000001\"", "oldValue": "\"VALUE_2\"" } ], "type": "VALUE_4" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_2", "id": "00000000-0000-4000-8000-000000000002", "modifiedProperties": [], "type": "VALUE_5" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000004", "modifiedProperties": [], "type": "VALUE_7" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].type", "type": "string" }, { "path": "$[].userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "05cd9026f1f466ce7dc8", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "shapeId": "d3fb62acf4e7179b", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "00000000-0000-4000-8000-000000000002", "id": null, "modifiedProperties": [], "type": "VALUE_2" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "0a28cb98ddf4fbe05037", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "12d9e71d86f72081", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppAddress", "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]", "oldValue": "[{\"Address\":\"https://example.invalid/SAMPLE_2\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=AppAddress]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "0ab9f8fd96620d136364", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal" }, "shapeId": "d76e464f30e6b61a", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "10fb725b53a466cf6eb8", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal credentials" }, "shapeId": "6ab18dabef4343f9", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "KeyDescription", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"VALUE_3\"]" } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=KeyDescription]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "15c8951eb4dfa899ed53", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "b906ba76be64b6df", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "MethodExecutionResult.", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "TargetId.UserType", "newValue": "\"VALUE_3\"", "oldValue": null } ], "type": "User", "userPrincipalName": "USERNAME_1@example.invalid" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=MethodExecutionResult.]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.UserType]", "type": "named-property" }, { "path": "$[].type", "type": "string" }, { "path": "$[].userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "1d7ac27d9f37d43e54fe", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "shapeId": "4585bc1ea7e6d92f", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "\"VALUE_4\"", "oldValue": "\"VALUE_4\"" }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "\"VALUE_2\"", "oldValue": "\"VALUE_3\"" }, { "displayName": "ServicePrincipal.AppId", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.DisplayName", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.Name", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.ObjectID", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "TargetId.ServicePrincipalNames", "newValue": "\"VALUE_5\"", "oldValue": null } ], "type": "ServicePrincipal" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000002", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "null" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.Name]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "2135c92d49da0b6e0b5e", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "32e2aa0c59f5e5c6", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "CloudDeviceOSVersion", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"VALUE_3\"]" }, { "displayName": "DeviceOSVersion", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"VALUE_3\"]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "TargetId.DeviceId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "TargetId.DeviceOSType", "newValue": "\"VALUE_5\"", "oldValue": null }, { "displayName": "TargetId.DeviceTrustType", "newValue": "\"VALUE_6\"", "oldValue": null } ], "type": "VALUE_7" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=CloudDeviceOSVersion]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DeviceOSVersion]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceOSType]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "2325146e1811c7e63b50", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "shapeId": "9c51e884a048b928", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_001", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "[\"VALUE_3\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":null,\"CredentialsWithUsageVerify\":null,\"IdentifierUris\":null,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":null}]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_004", "newValue": "[\"VALUE_5\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_6\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AllProperties", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageSign", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageVerify", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].IdentifierUris", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].IsEnabled", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].ServicePrincipalLockExtension", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].TokenEncryptionKeyId", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "26580f387aa0cf3e5cec", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "f021706f76c4e13f", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AccountEnabled", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "AppPrincipalId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "Credential", "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000002\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_7\"", "oldValue": null }, { "displayName": "ServicePrincipalName", "newValue": "[\"https://example.invalid/SAMPLE_1\"]", "oldValue": "[]" }, { "displayName": "ServicePrincipalTag", "newValue": "[\"VALUE_4\"]", "oldValue": "[]" } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].KeyGroupId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].KeyStoreId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AccountEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppPrincipalId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Credential]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalTag]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "318bddb08ef73e2ce044", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "ca73123d3f31d8aa", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppAddress", "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AppAddress]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "32bd7cd7514b0ea64c29", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Import" }, "shapeId": "a9623d0b61778df3", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": null, "modifiedProperties": [], "type": "VALUE_7" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "countryLetterCode", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "dirSyncEnabled", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "displayName", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "objectId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "replicationScope", "newValue": "\"VALUE_5\"", "oldValue": null }, { "displayName": "technicalNotificationMails", "newValue": "\"USERNAME_1@example.invalid\"", "oldValue": null }, { "displayName": "verifiedDomains", "newValue": "\"VALUE_6\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=countryLetterCode]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=dirSyncEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=displayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=objectId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=replicationScope]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=technicalNotificationMails]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=verifiedDomains]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "32ea2c3b75197da9c69d", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "a7af99e174f4222b", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "FederatedIdentityCredentials", "newValue": "[]", "oldValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].Audiences", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].Audiences[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].ClaimsMatchingExpressionLanguageVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ClaimsMatchingExpressionValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue::[].Description", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].Id", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Issuer", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Name", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Subject", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].TrustedIssuer", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=FederatedIdentityCredentials]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "34d19de6f2ba5e6f4537", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "e0d0ee0c1cc4e520", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AccountEnabled", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "AppPrincipalId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "Credential", "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "ServicePrincipalName", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].KeyGroupId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].KeyStoreId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AccountEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppPrincipalId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Credential]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalName]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "3543dc037d753df7f2ad", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "002c54e03bbec1ae", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AccountEnabled", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "AppPrincipalId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "Credential", "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_7\"", "oldValue": null }, { "displayName": "KeyDescription", "newValue": "[\"VALUE_3\"]", "oldValue": "[]" }, { "displayName": "ManagedIdentityResourceId", "newValue": "[\"VALUE_4\"]", "oldValue": "[]" }, { "displayName": "ServicePrincipalName", "newValue": "[\"https://example.invalid/SAMPLE_1\"]", "oldValue": "[]" }, { "displayName": "ServicePrincipalTag", "newValue": "[\"VALUE_5\"]", "oldValue": "[]" } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].KeyGroupId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].KeyStoreId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AccountEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppPrincipalId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Credential]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=KeyDescription]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ManagedIdentityResourceId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalTag]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "380ebf0250068bafe0df", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "b5cda13c5ed86c10", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "FederatedIdentityCredentials", "newValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Audiences", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].Audiences[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].ClaimsMatchingExpressionLanguageVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ClaimsMatchingExpressionValue", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].Description", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].Id", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Issuer", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Name", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Subject", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].TrustedIssuer", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=FederatedIdentityCredentials]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "3a51f0aa5f43c27173a3", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "6fcd032979ca74cd", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "RequiredResourceAccess", "newValue": "[]", "oldValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[1]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]" } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[].DirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[].ImpersonationAccessGrants", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[].ImpersonationAccessGrants[]", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ResourceAppId", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=RequiredResourceAccess]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "453f8b1b7928801ecb08", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "65a0174558329768", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AccountEnabled", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "AppAddress", "newValue": "[{\"Address\":\"VALUE_2\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]", "oldValue": "[]" }, { "displayName": "AppPrincipalId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "Credential", "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_4\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_8\"", "oldValue": null }, { "displayName": "ServicePrincipalName", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "ServicePrincipalTag", "newValue": "[\"VALUE_5\"]", "oldValue": "[]" } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].KeyGroupId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].KeyStoreId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AccountEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppAddress]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppPrincipalId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Credential]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalTag]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "4f1b25aca55e5720081d", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "3323d84ef30fe231", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppAddress", "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AppAddress]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "5d95dae084922bf181c4", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "shapeId": "47994d27b2e783a6", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AccountEnabled", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "AppPrincipalId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "Credential", "newValue": "[{\"CredentialType\":1,\"KeyGroupId\":\"00000000-0000-4000-8000-000000000003\",\"KeyStoreId\":\"00000000-0000-4000-8000-000000000003\"}]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_5\"", "oldValue": null }, { "displayName": "KeyDescription", "newValue": "[\"VALUE_3\"]", "oldValue": "[]" }, { "displayName": "ManagedIdentityResourceId", "newValue": "[\"VALUE_4\"]", "oldValue": "[]" }, { "displayName": "ServicePrincipalName", "newValue": "[\"https://example.invalid/SAMPLE_1\"]", "oldValue": "[]" } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].KeyGroupId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].KeyStoreId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AccountEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppPrincipalId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Credential]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=KeyDescription]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ManagedIdentityResourceId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipalName]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "5f5d32f826ba656d725b", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "40c0d31775455b4d", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "IsCompliant", "newValue": "[false]", "oldValue": "[false]" }, { "displayName": "TargetId.DeviceId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "TargetId.DeviceOSType", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "TargetId.DeviceTrustType", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "VALUE_5" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=IsCompliant]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceOSType]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "6067fac5d6a4f8024d77", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Settings_GetSettingsAsync" }, "shapeId": "3bc0a92f8f9ceeb9", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "6b7e65c96b1ca07a446d", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "330bd399ec516255", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "725edb16396596ce4f6e", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Other" }, "shapeId": "d3fb62acf4e7179b", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "ServicePrincipal" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_2", "id": null, "modifiedProperties": [], "type": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "7dd4db9e507b09d3022f", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "2230a3f8980cfaba", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "TargetId.DeviceId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "TargetId.DeviceOSType", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "TargetId.DeviceTrustType", "newValue": "\"VALUE_2\"", "oldValue": null } ], "type": "VALUE_4" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceOSType]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "83ce0896bb77f3a094b0", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Create application \u2013 Certificates and secrets management " }, "shapeId": "83060a43f56720cf", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "KeyDescription", "newValue": "[]", "oldValue": "[]" } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=KeyDescription]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "841c38169961c5192674", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "f66b5fb6bc354a34", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Entitlement", "newValue": "[{\"ClaimValue\":\"VALUE_2\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_3\",\"DirectAccessGrantTypes\":[1],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrantTypes\":[],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_2\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":null,\"UserConsentDisplayName\":null},{\"ClaimValue\":\"VALUE_6\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_7\",\"DirectAccessGrantTypes\":[],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000004\",\"ImpersonationAccessGrantTypes\":[{\"Impersonated\":1,\"Impersonator\":1}],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_4\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":\"USERNAME_5\",\"UserConsentDisplayName\":\"USERNAME_4\"}]", "oldValue": "[{\"ClaimValue\":\"VALUE_2\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_3\",\"DirectAccessGrantTypes\":[1],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrantTypes\":[],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_2\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":null,\"UserConsentDisplayName\":null},{\"ClaimValue\":\"VALUE_6\",\"Definition\":null,\"DependentMicrosoftGraphPermissions\":[],\"Description\":\"VALUE_7\",\"DirectAccessGrantTypes\":[],\"DirectAccessPrivilegeLevel\":1,\"EntitlementCategory\":1,\"EntitlementEncodingVersion\":1,\"EntitlementId\":\"00000000-0000-4000-8000-000000000004\",\"ImpersonationAccessGrantTypes\":[{\"Impersonated\":1,\"Impersonator\":1}],\"ImpersonationPrivilegeLevel\":1,\"IsDisabled\":false,\"IsPreauthzOnlyDirectAccessGrant\":false,\"IsPreauthzOnlyImpersonationGrant\":false,\"IsPrivate\":false,\"Name\":\"USERNAME_4\",\"Origin\":1,\"ResourceScopeType\":1,\"UserConsentDescription\":\"USERNAME_5\",\"UserConsentDisplayName\":\"USERNAME_4\"}]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_10\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].ClaimValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Definition", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].DependentMicrosoftGraphPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].Description", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].DirectAccessGrantTypes", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].DirectAccessGrantTypes[]", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].DirectAccessPrivilegeLevel", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].EntitlementCategory", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].EntitlementEncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].ImpersonationAccessGrantTypes", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].ImpersonationAccessGrantTypes[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].ImpersonationAccessGrantTypes[].Impersonated", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ImpersonationAccessGrantTypes[].Impersonator", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ImpersonationPrivilegeLevel", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IsDisabled", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].IsPreauthzOnlyDirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].IsPreauthzOnlyImpersonationGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].IsPrivate", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].Name", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Origin", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ResourceScopeType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].UserConsentDescription", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].UserConsentDescription", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].UserConsentDisplayName", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].UserConsentDisplayName", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].ClaimValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Definition", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue::[].DependentMicrosoftGraphPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].Description", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].DirectAccessGrantTypes", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].DirectAccessGrantTypes[]", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].DirectAccessPrivilegeLevel", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].EntitlementCategory", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].EntitlementEncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].ImpersonationAccessGrantTypes", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].ImpersonationAccessGrantTypes[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].ImpersonationAccessGrantTypes[].Impersonated", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ImpersonationAccessGrantTypes[].Impersonator", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ImpersonationPrivilegeLevel", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].IsDisabled", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].IsPreauthzOnlyDirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].IsPreauthzOnlyImpersonationGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].IsPrivate", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].Name", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Origin", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ResourceScopeType", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].UserConsentDescription", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue::[].UserConsentDescription", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].UserConsentDisplayName", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue::[].UserConsentDisplayName", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=Entitlement]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "84b59f6f8681c5457ba4", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "f444c70ec02ac425", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"VALUE_3\"]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "89db593531bab95426a4", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Consent to application" }, "shapeId": "97a5bd26864bdbc7", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "ConsentAction.Permissions", "newValue": "\"VALUE_5\"", "oldValue": null }, { "displayName": "ConsentContext.IsAdminConsent", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "ConsentContext.IsAppOnly", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "ConsentContext.OnBehalfOfAll", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "ConsentContext.Tags", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=ConsentAction.Permissions]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ConsentContext.IsAdminConsent]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ConsentContext.IsAppOnly]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ConsentContext.OnBehalfOfAll]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ConsentContext.Tags]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "8bc5dd98402d7cffe6bc", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "shapeId": "cfd294eacb50c489", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_001", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "[\"VALUE_3\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_004", "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":null,\"CredentialsWithUsageVerify\":null,\"IdentifierUris\":null,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":null}]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_005", "newValue": "[\"VALUE_5\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_6\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AllProperties", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageSign", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageVerify", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].IdentifierUris", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].IsEnabled", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].ServicePrincipalLockExtension", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].TokenEncryptionKeyId", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_005]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "8d1933d13be285419184", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "be720cd4684d7ba8", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "RequiredResourceAccess", "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]", "oldValue": "[]" } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].DirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].ImpersonationAccessGrants", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].ResourceAppId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=RequiredResourceAccess]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "984b251976f8924b889d", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "shapeId": "695293043cf09c21", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "00000000-0000-4000-8000-000000000002", "groupType": "VALUE_7", "id": null, "modifiedProperties": [], "type": "Group" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "\"00000000-0000-4000-8000-000000000003\"", "oldValue": null }, { "displayName": "IsSoftDeleted", "newValue": "\"VALUE_5\"", "oldValue": null }, { "displayName": "description", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "dirSyncEnabled", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "displayName", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "mailEnabled", "newValue": "\"VALUE_5\"", "oldValue": null }, { "displayName": "objectId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "onPremisesObjectIdentifier", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "securityEnabled", "newValue": "\"VALUE_6\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].groupType", "type": "string" }, { "path": "$[].id", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=IsSoftDeleted]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=description]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=dirSyncEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=displayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=mailEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=objectId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=onPremisesObjectIdentifier]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=securityEnabled]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "9d022e2e2ef7e11d51bf", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "shapeId": "cf87c0dcbceaaffb", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "ServicePrincipal.AppId", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.DisplayName", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.Name", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.ObjectID", "newValue": "\"00000000-0000-4000-8000-000000000003\"", "oldValue": null }, { "displayName": "TargetId.ServicePrincipalNames", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "ServicePrincipal" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000003", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "null" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.Name]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "a4efde3a75f1bf7be7d2", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "shapeId": "f5e08913179090ef", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppAddress", "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]", "oldValue": "[]" }, { "displayName": "AppId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_001", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "[\"VALUE_3\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":false,\"CredentialsWithUsageVerify\":false,\"IdentifierUris\":false,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":false}]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_004", "newValue": "[\"VALUE_5\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_6\"", "oldValue": null }, { "displayName": "RequiredResourceAccess", "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000003\",\"ImpersonationAccessGrants\":[1]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000004\"}]", "oldValue": "[]" } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].AllProperties", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageSign", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageVerify", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IdentifierUris", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].IsEnabled", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].DirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].ImpersonationAccessGrants", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].ImpersonationAccessGrants[]", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ResourceAppId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].ServicePrincipalLockExtension", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].TokenEncryptionKeyId", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AppAddress]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=RequiredResourceAccess]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "b489e9e52129abb1ce0f", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "5d66071e131a87f4", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"VALUE_3\"]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "TargetId.UserType", "newValue": "\"VALUE_5\"", "oldValue": null } ], "type": "User", "userPrincipalName": "USERNAME_1@example.invalid" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.UserType]", "type": "named-property" }, { "path": "$[].type", "type": "string" }, { "path": "$[].userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "b490eb822009d1e0ee67", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "shapeId": "bbf221947a0a432f", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "ServicePrincipal.AppId", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.DisplayName", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.Name", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.ObjectID", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "TargetId.ServicePrincipalNames", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "ServicePrincipal" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000002", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "null" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.Name]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "b8e9fd3a038430effe2a", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupsODataV4_Get" }, "shapeId": "3bc0a92f8f9ceeb9", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "c08a292fe52dbb895bca", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "12fe9d0c77e09aeb", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "CloudDeviceOSVersion", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"1.5\"]" }, { "displayName": "DeviceOSVersion", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"1.5\"]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "TargetId.DeviceId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "TargetId.DeviceOSType", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "TargetId.DeviceTrustType", "newValue": "\"VALUE_5\"", "oldValue": null } ], "type": "VALUE_6" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[]::", "type": "number" }, { "path": "$[].modifiedProperties[][displayName=CloudDeviceOSVersion]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DeviceOSVersion]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceOSType]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "c29ff061e34bd877f012", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal credentials" }, "shapeId": "6ab18dabef4343f9", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "KeyDescription", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"VALUE_2\"]" } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=KeyDescription]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "c93e21ebeec0cb84952b", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Execution" }, "shapeId": "d76e464f30e6b61a", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d0fdccb1218953a25a39", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "de0c730900f5563f", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_3\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d1d51e3079200b95d437", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "4b5882908f69fcca", "format": "json", "encoding": "native-json", "example": [ { "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "DisplayName", "newValue": "\"VALUE_1\"", "oldValue": "\"VALUE_2\"" } ], "type": "User", "userPrincipalName": "USERNAME_1@example.invalid" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].type", "type": "string" }, { "path": "$[].userPrincipalName", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d2788cb83f75972c9993", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "93c8d1baf3d22a7d", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "FederatedIdentityCredentials", "newValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]", "oldValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":\"VALUE_3\",\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_4\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Audiences", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].Audiences[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].ClaimsMatchingExpressionLanguageVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ClaimsMatchingExpressionValue", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].Description", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].Id", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Issuer", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Name", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Subject", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].TrustedIssuer", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].Audiences", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].Audiences[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].ClaimsMatchingExpressionLanguageVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ClaimsMatchingExpressionValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue::[].Description", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].Id", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Issuer", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Name", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].Subject", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].TrustedIssuer", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=FederatedIdentityCredentials]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "d5fe35be4651c5d93b09", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "shapeId": "1d4a7fc57a9b264b", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "00000000-0000-4000-8000-000000000002", "groupType": "VALUE_6", "id": null, "modifiedProperties": [], "type": "Group" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "IsSoftDeleted", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "description", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "dirSyncEnabled", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "displayName", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "mailEnabled", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "objectId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "onPremisesObjectIdentifier", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "securityEnabled", "newValue": "\"VALUE_5\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].groupType", "type": "string" }, { "path": "$[].id", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=IsSoftDeleted]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=description]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=dirSyncEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=displayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=mailEnabled]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=objectId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=onPremisesObjectIdentifier]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=securityEnabled]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "ddaeff7520cd1526c19a", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "d76e464f30e6b61a", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "dfefadf5474744dbb299", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "7726c00bcd27f198", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "RequiredResourceAccess", "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]", "oldValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000002\",\"ImpersonationAccessGrants\":[]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000003\"}]" } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].DirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].ImpersonationAccessGrants", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].ResourceAppId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[].DirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].RequiredAppPermissions[].ImpersonationAccessGrants", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[].ResourceAppId", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=RequiredResourceAccess]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "e2686d75d8f7b96ed6a3", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "shapeId": "94857a262c4e794f", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "CloudDeviceOSVersion", "newValue": "[\"1.5\"]", "oldValue": "[\"VALUE_2\"]" }, { "displayName": "DeviceOSVersion", "newValue": "[\"1.5\"]", "oldValue": "[\"VALUE_2\"]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "TargetId.DeviceId", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "TargetId.DeviceOSType", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "TargetId.DeviceTrustType", "newValue": "\"VALUE_5\"", "oldValue": null } ], "type": "VALUE_6" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]::", "type": "number" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=CloudDeviceOSVersion]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DeviceOSVersion]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceOSType]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.DeviceTrustType]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "e49d4c6f964127aa16cc", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Group_GetDynamicGroupProperties" }, "shapeId": "0ef9a95f59d33a99", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "groupType": "VALUE_2", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "Group" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].groupType", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "e69d7a3e659487fd9c46", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "9da1f051ec064f12", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppAddress", "newValue": "[{\"Address\":\"https://example.invalid/SAMPLE_1\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]", "oldValue": "[{\"Address\":\"https://example.invalid/SAMPLE_2\",\"AddressType\":1,\"IsReplyAddressDefault\":false,\"ReplyAddressClientType\":1,\"ReplyAddressIndex\":null}]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].oldValue::[].Address", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::[].AddressType", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].IsReplyAddressDefault", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue::[].ReplyAddressClientType", "type": "integer" }, { "path": "$[].modifiedProperties[].oldValue::[].ReplyAddressIndex", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=AppAddress]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "e6a9873db2a9aa8c1e1f", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment grant to user" }, "shapeId": "1bb0becc60ac5757", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppRole.DisplayName", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "AppRole.Id", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "AppRole.Value", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "AppRoleAssignment.CreatedDateTime", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "AppRoleAssignment.LastModifiedDateTime", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "EXAMPLE_LABEL_001", "newValue": "\"00000000-0000-4000-8000-000000000003\"", "oldValue": null }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "\"USERNAME_1@example.invalid\"", "oldValue": null }, { "displayName": "TargetId.ServicePrincipalNames", "newValue": "\"00000000-0000-4000-8000-000000000004\"", "oldValue": null } ], "type": "ServicePrincipal" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000003", "modifiedProperties": [], "type": "User", "userPrincipalName": "USERNAME_1@example.invalid" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=AppRole.DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRole.Id]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRole.Value]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRoleAssignment.CreatedDateTime]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRoleAssignment.LastModifiedDateTime]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]", "type": "named-property" }, { "path": "$[].type", "type": "string" }, { "path": "$[].userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "ead37c49d8e71e338552", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "c363df4e5cac9086", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "FederatedIdentityCredentials", "newValue": "[{\"Audiences\":[\"VALUE_2\"],\"ClaimsMatchingExpressionLanguageVersion\":1,\"ClaimsMatchingExpressionValue\":null,\"Description\":null,\"EncodingVersion\":1,\"Id\":\"00000000-0000-4000-8000-000000000002\",\"Issuer\":\"https://example.invalid/SAMPLE_1\",\"Name\":\"USERNAME_2\",\"Subject\":\"00000000-0000-4000-8000-000000000003\",\"TrustedIssuer\":null}]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_3\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Audiences", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].Audiences[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].ClaimsMatchingExpressionLanguageVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ClaimsMatchingExpressionValue", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].Description", "type": "null" }, { "path": "$[].modifiedProperties[].newValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].Id", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Issuer", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Name", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Subject", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].TrustedIssuer", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=FederatedIdentityCredentials]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "ebc5dbffccc9bc087530", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Other" }, "shapeId": "5848a2d5a3c47cc9", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "00000000-0000-4000-8000-000000000002", "id": null, "modifiedProperties": [], "type": "VALUE_3" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "member", "newValue": "\"VALUE_2\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=member]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "eccafa5276c15cb76832", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "shapeId": "93816ca2b39e8149", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_2\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "edb337a57b95ba519cf9", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "7d9a52d2789ea332", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "[]", "oldValue": "[\"VALUE_2\"]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_3\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "eea3b10df5f7e8dc40a5", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupLifecyclePolicies_Get" }, "shapeId": "3bc0a92f8f9ceeb9", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [], "type": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "f0845ba943833c52fa95", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "shapeId": "da3f29edcb978dd5", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "Included Updated Properties", "newValue": "\"VALUE_7\"", "oldValue": null }, { "displayName": "SearchableDeviceKey", "newValue": "[\"VALUE_2\"]", "oldValue": "[\"VALUE_4\"]" }, { "displayName": "TargetId.UserType", "newValue": "\"VALUE_8\"", "oldValue": null } ], "type": "User", "userPrincipalName": "USERNAME_1@example.invalid" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[].oldValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=SearchableDeviceKey]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.UserType]", "type": "named-property" }, { "path": "$[].type", "type": "string" }, { "path": "$[].userPrincipalName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "f48aef23cd33bb864d3f", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "shapeId": "9274b336a65ccc90", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "\"VALUE_4\"", "oldValue": "\"VALUE_4\"" }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": "\"00000000-0000-4000-8000-000000000002\"" }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "\"VALUE_2\"", "oldValue": "\"VALUE_3\"" }, { "displayName": "ServicePrincipal.AppId", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.DisplayName", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.Name", "newValue": null, "oldValue": null }, { "displayName": "ServicePrincipal.ObjectID", "newValue": "\"00000000-0000-4000-8000-000000000003\"", "oldValue": null }, { "displayName": "TargetId.ServicePrincipalNames", "newValue": "\"VALUE_5\"", "oldValue": null } ], "type": "ServicePrincipal" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": null, "id": "00000000-0000-4000-8000-000000000003", "modifiedProperties": [], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "null" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "null" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "string" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.Name]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "f64c8291e8b5950d7d50", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment to service principal" }, "shapeId": "af4a65b991833595", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "00000000-0000-4000-8000-000000000004", "id": "00000000-0000-4000-8000-000000000003", "modifiedProperties": [], "type": "ServicePrincipal" }, { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppRole.DisplayName", "newValue": "\"VALUE_3\"", "oldValue": null }, { "displayName": "AppRole.Id", "newValue": "\"00000000-0000-4000-8000-000000000002\"", "oldValue": null }, { "displayName": "AppRole.Value", "newValue": "\"VALUE_2\"", "oldValue": null }, { "displayName": "AppRoleAssignment.CreatedDateTime", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "AppRoleAssignment.LastModifiedDateTime", "newValue": "\"VALUE_4\"", "oldValue": null }, { "displayName": "ServicePrincipal.AppId", "newValue": "\"00000000-0000-4000-8000-000000000004\"", "oldValue": null }, { "displayName": "ServicePrincipal.DisplayName", "newValue": "\"VALUE_5\"", "oldValue": null }, { "displayName": "ServicePrincipal.Name", "newValue": "\"00000000-0000-4000-8000-000000000004\"", "oldValue": null }, { "displayName": "ServicePrincipal.ObjectID", "newValue": "\"00000000-0000-4000-8000-000000000003\"", "oldValue": null }, { "displayName": "TargetId.ServicePrincipalNames", "newValue": "\"VALUE_6\"", "oldValue": null } ], "type": "ServicePrincipal" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[][displayName=AppRole.DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRole.Id]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRole.Value]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRoleAssignment.CreatedDateTime]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=AppRoleAssignment.LastModifiedDateTime]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.Name]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=ServicePrincipal.ObjectID]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=TargetId.ServicePrincipalNames]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "f6c01004db9006a46d18", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "shapeId": "a3fb40f2536e7da7", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "AppId", "newValue": "[\"00000000-0000-4000-8000-000000000002\"]", "oldValue": "[]" }, { "displayName": "DisplayName", "newValue": "[\"VALUE_2\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_001", "newValue": "[false]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_002", "newValue": "[\"VALUE_3\"]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_003", "newValue": "[{\"AllProperties\":false,\"CredentialsWithUsageSign\":false,\"CredentialsWithUsageVerify\":false,\"IdentifierUris\":false,\"IsEnabled\":false,\"ServicePrincipalLockExtension\":\"VALUE_4\",\"TokenEncryptionKeyId\":false}]", "oldValue": "[]" }, { "displayName": "EXAMPLE_LABEL_004", "newValue": "[\"VALUE_5\"]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_6\"", "oldValue": null }, { "displayName": "RequiredResourceAccess", "newValue": "[{\"EncodingVersion\":1,\"RequiredAppPermissions\":[{\"DirectAccessGrant\":false,\"EntitlementId\":\"00000000-0000-4000-8000-000000000003\",\"ImpersonationAccessGrants\":[1]}],\"ResourceAppId\":\"00000000-0000-4000-8000-000000000004\"}]", "oldValue": "[]" } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].AllProperties", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageSign", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].CredentialsWithUsageVerify", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].EncodingVersion", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].IdentifierUris", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].IsEnabled", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].DirectAccessGrant", "type": "boolean" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].EntitlementId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].ImpersonationAccessGrants", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::[].RequiredAppPermissions[].ImpersonationAccessGrants[]", "type": "integer" }, { "path": "$[].modifiedProperties[].newValue::[].ResourceAppId", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].ServicePrincipalLockExtension", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].TokenEncryptionKeyId", "type": "boolean" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=AppId]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=DisplayName]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_004]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=RequiredResourceAccess]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "fe64a4d0a1ccf85b2597", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Authentication", "LoggedByService": "B2C", "OperationName": "Validate user authentication" }, "shapeId": "065e37e2527a3a2b", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "00000000-0000-4000-8000-000000000001", "id": null, "modifiedProperties": [], "type": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "null" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "ff64e47a3fbd26cfc895", "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "shapeId": "6aec36d1bc3ff8d4", "format": "json", "encoding": "json-string", "example": [ { "administrativeUnits": [], "agentType": "VALUE_1", "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "modifiedProperties": [ { "displayName": "EXAMPLE_LABEL_001", "newValue": "[{\"Key\":\"VALUE_2\",\"Value\":\"https://example.invalid/SAMPLE_1\"}]", "oldValue": "[]" }, { "displayName": "Included Updated Properties", "newValue": "\"VALUE_3\"", "oldValue": null } ], "type": "Application" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].administrativeUnits", "type": "array" }, { "path": "$[].agentType", "type": "string" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].modifiedProperties", "type": "array" }, { "path": "$[].modifiedProperties[]", "type": "object" }, { "path": "$[].modifiedProperties[].displayName", "type": "string" }, { "path": "$[].modifiedProperties[].newValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].newValue", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::", "type": "array" }, { "path": "$[].modifiedProperties[].newValue::", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[]", "type": "object" }, { "path": "$[].modifiedProperties[].newValue::[].Key", "type": "string" }, { "path": "$[].modifiedProperties[].newValue::[].Value", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue", "type": "encoded-json" }, { "path": "$[].modifiedProperties[].oldValue", "type": "null" }, { "path": "$[].modifiedProperties[].oldValue", "type": "string" }, { "path": "$[].modifiedProperties[].oldValue::", "type": "array" }, { "path": "$[].modifiedProperties[][displayName=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[].modifiedProperties[][displayName=Included Updated Properties]", "type": "named-property" }, { "path": "$[].type", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs" }, { "id": "03b084bb42f45c168414", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListApplications", "Application": "Amazon Web Services" }, "shapeId": "3c2e8f7a80f4a88b", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_7", "accountId": "1", "arn": "VALUE_8", "principalId": "VALUE_9", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_10", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "type": "VALUE_13", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_14" } }, "type": "VALUE_15" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "04de4f8b0d1b3700c7e0", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List role policies", "Application": "Amazon Web Services" }, "shapeId": "4a7889bc6375a366", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "roleName": "VALUE_7" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_8", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_9" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_10", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_13", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_14", "principalId": "VALUE_15", "type": "VALUE_16", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_17" } }, "type": "VALUE_18" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.roleName", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "2c4dad1387d8a0730ce6", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List attached role policies", "Application": "Amazon Web Services" }, "shapeId": "4a7889bc6375a366", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "roleName": "VALUE_7" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_8", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_9" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_10", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_13", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_14", "principalId": "VALUE_15", "type": "VALUE_16", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_17" } }, "type": "VALUE_18" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.roleName", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "2ec04bad13526bc35082", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListMalwareProtectionPlans", "Application": "Amazon Web Services" }, "shapeId": "4defd9287d07d1c6", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_7", "tlsVersion": "VALUE_8" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_9", "accountId": "1", "arn": "VALUE_10", "principalId": "VALUE_11", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_12", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_13", "principalId": "VALUE_14", "type": "VALUE_15", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_16" } }, "type": "VALUE_17" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "2f8f45214591cc40d188", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Assume role with web identity", "Application": "Amazon Web Services" }, "shapeId": "e71e62c01e4e195d", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "additionalEventData": { "@odata.type": "VALUE_1", "ExtendedRequestId": "VALUE_2", "RequestDetails": { "@odata.type": "VALUE_1", "awsServingRegion": "VALUE_3", "endpointType": "VALUE_4" }, "identityProviderConnectionVerificationMethod": "VALUE_5" }, "awsRegion": "VALUE_3", "eventCategory": "VALUE_6", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_7", "eventSource": "VALUE_8", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_9", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "roleArn": "VALUE_10", "roleSessionName": "VALUE_11" }, "resources": [ "{\"ARN\":\"VALUE_10\",\"accountId\":\"1\",\"type\":\"VALUE_12\"}" ], "resources@odata.type": "VALUE_13", "responseElements": { "@odata.type": "VALUE_1", "assumedRoleUser": { "@odata.type": "VALUE_1", "arn": "VALUE_14", "assumedRoleId": "VALUE_15" }, "audience": "VALUE_16", "credentials": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_17", "expiration": "VALUE_18", "sessionToken": "VALUE_19" }, "packedPolicySize": 1, "packedPolicySize@odata.type": "VALUE_20", "provider": "VALUE_21", "sessionTokenSize": 1, "sessionTokenSize@odata.type": "VALUE_20", "sessionTokenUtilization": 1, "sessionTokenUtilization@odata.type": "VALUE_20", "subjectFromWebIdentityToken": "00000000-0000-4000-8000-000000000003" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_22", "clientProvidedHostHeader": "VALUE_23", "keyExchange": "VALUE_24", "tlsVersion": "VALUE_25" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "identityProvider": "VALUE_21", "principalId": "VALUE_26", "type": "VALUE_27", "userName": "00000000-0000-4000-8000-000000000003" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.additionalEventData", "type": "object" }, { "path": "$.additionalEventData.ExtendedRequestId", "type": "string" }, { "path": "$.additionalEventData.RequestDetails", "type": "object" }, { "path": "$.additionalEventData.RequestDetails.awsServingRegion", "type": "string" }, { "path": "$.additionalEventData.RequestDetails.endpointType", "type": "string" }, { "path": "$.additionalEventData.RequestDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.additionalEventData.identityProviderConnectionVerificationMethod", "type": "string" }, { "path": "$.additionalEventData[\"@odata.type\"]", "type": "string" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.roleArn", "type": "string" }, { "path": "$.requestParameters.roleSessionName", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.resources", "type": "array" }, { "path": "$.resources[]", "type": "encoded-json" }, { "path": "$.resources[]", "type": "string" }, { "path": "$.resources[]::", "type": "object" }, { "path": "$.resources[]::.ARN", "type": "string" }, { "path": "$.resources[]::.accountId", "type": "encoded-json" }, { "path": "$.resources[]::.accountId", "type": "string" }, { "path": "$.resources[]::.accountId::", "type": "integer" }, { "path": "$.resources[]::.type", "type": "string" }, { "path": "$.responseElements", "type": "object" }, { "path": "$.responseElements.assumedRoleUser", "type": "object" }, { "path": "$.responseElements.assumedRoleUser.arn", "type": "string" }, { "path": "$.responseElements.assumedRoleUser.assumedRoleId", "type": "string" }, { "path": "$.responseElements.assumedRoleUser[\"@odata.type\"]", "type": "string" }, { "path": "$.responseElements.audience", "type": "string" }, { "path": "$.responseElements.credentials", "type": "object" }, { "path": "$.responseElements.credentials.accessKeyId", "type": "string" }, { "path": "$.responseElements.credentials.expiration", "type": "string" }, { "path": "$.responseElements.credentials.sessionToken", "type": "string" }, { "path": "$.responseElements.credentials[\"@odata.type\"]", "type": "string" }, { "path": "$.responseElements.packedPolicySize", "type": "integer" }, { "path": "$.responseElements.provider", "type": "string" }, { "path": "$.responseElements.sessionTokenSize", "type": "integer" }, { "path": "$.responseElements.sessionTokenUtilization", "type": "integer" }, { "path": "$.responseElements.subjectFromWebIdentityToken", "type": "string" }, { "path": "$.responseElements[\"@odata.type\"]", "type": "string" }, { "path": "$.responseElements[\"packedPolicySize@odata.type\"]", "type": "string" }, { "path": "$.responseElements[\"sessionTokenSize@odata.type\"]", "type": "string" }, { "path": "$.responseElements[\"sessionTokenUtilization@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.keyExchange", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.identityProvider", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity.userName", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" }, { "path": "$[\"resources@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "35417fe0df21a7a8d33c", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Get policy", "Application": "Amazon Web Services" }, "shapeId": "16c44e1960833a0e", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "policyArn": "VALUE_7" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_8", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_9" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_10", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_13", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_14", "principalId": "VALUE_15", "type": "VALUE_16", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_17" } }, "type": "VALUE_18" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.policyArn", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "3866ba79ef26081b8dae", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListCertificates", "Application": "Amazon Web Services" }, "shapeId": "5e1c404de27fdaa7", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "includes": { "@odata.type": "VALUE_1", "hasDnsFqdn": false, "keyTypes": [ "VALUE_7" ], "keyTypes@odata.type": "VALUE_14" }, "maxItems": 1, "maxItems@odata.type": "VALUE_15" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_16", "clientProvidedHostHeader": "VALUE_17", "keyExchange": "VALUE_18", "tlsVersion": "VALUE_19" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_20", "accountId": "1", "arn": "VALUE_21", "principalId": "VALUE_22", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_23", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_24", "principalId": "VALUE_25", "type": "VALUE_26", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_27" } }, "type": "VALUE_28" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.includes", "type": "object" }, { "path": "$.requestParameters.includes.hasDnsFqdn", "type": "boolean" }, { "path": "$.requestParameters.includes.keyTypes", "type": "array" }, { "path": "$.requestParameters.includes.keyTypes[]", "type": "string" }, { "path": "$.requestParameters.includes[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters.includes[\"keyTypes@odata.type\"]", "type": "string" }, { "path": "$.requestParameters.maxItems", "type": "integer" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters[\"maxItems@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.keyExchange", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "3958e788e9590a781f74", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListDomains", "Application": "Amazon Web Services" }, "shapeId": "907634f3edddaa2b", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_7", "clientProvidedHostHeader": "VALUE_8", "tlsVersion": "VALUE_9" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_10", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_13", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_14", "principalId": "VALUE_15", "type": "VALUE_16", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_17" } }, "type": "VALUE_18" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "487cfd750fd36080501d", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListKeys", "Application": "Amazon Web Services" }, "shapeId": "015cf647ff283457", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "limit": 1, "limit@odata.type": "VALUE_7" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_8", "clientProvidedHostHeader": "VALUE_9", "keyExchange": "VALUE_10", "tlsVersion": "VALUE_11" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_12", "accountId": "1", "arn": "VALUE_13", "principalId": "VALUE_14", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_15", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_16", "principalId": "VALUE_17", "type": "VALUE_18", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_19" } }, "type": "VALUE_20" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.limit", "type": "integer" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters[\"limit@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.keyExchange", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "4aa47d30c0f1fe025ec5", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "FileDownloaded", "Application": "Microsoft SharePoint Online" }, "shapeId": "6fccd6c6b9bee228", "format": "json", "encoding": "native-json", "example": { "ClientIP": "192.0.2.1", "CreationTime": "2026-01-01T00:00:00Z", "ObjectId": "https://example.invalid/SAMPLE_1", "Operation": "FileDownloaded", "SiteUrl": "https://example.invalid/SAMPLE_2", "SourceFileName": "SAMPLEFILE_1.txt", "UserId": "USERNAME_1@example.invalid" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.ClientIP", "type": "string" }, { "path": "$.CreationTime", "type": "string" }, { "path": "$.ObjectId", "type": "string" }, { "path": "$.Operation", "type": "string" }, { "path": "$.SiteUrl", "type": "string" }, { "path": "$.SourceFileName", "type": "string" }, { "path": "$.UserId", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "51ea67d1938e597a1ad1", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListApplications", "Application": "Amazon Web Services" }, "shapeId": "4defd9287d07d1c6", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_7", "tlsVersion": "VALUE_8" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_9", "accountId": "1", "arn": "VALUE_10", "principalId": "VALUE_11", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_12", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_13", "principalId": "VALUE_14", "type": "VALUE_15", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_16" } }, "type": "VALUE_17" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "5b0f50835672c5863908", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "AnonymousLinkCreated", "Application": "Microsoft OneDrive for Business" }, "shapeId": "5c3053a679f326ee", "format": "json", "encoding": "native-json", "example": { "CreationTime": "2026-01-01T00:00:00Z", "ObjectId": "https://example.invalid/SAMPLE_1", "Operation": "AnonymousLinkCreated", "SharingType": "VALUE_1", "SiteUrl": "https://example.invalid/SAMPLE_2", "SourceFileName": "SAMPLEFILE_1.txt", "TargetUserOrGroupType": "USERNAME_1", "UniqueSharingId": "00000000-0000-4000-8000-000000000001", "UserId": "USERNAME_1@example.invalid", "Workload": "OneDrive" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.CreationTime", "type": "string" }, { "path": "$.ObjectId", "type": "string" }, { "path": "$.Operation", "type": "string" }, { "path": "$.SharingType", "type": "string" }, { "path": "$.SiteUrl", "type": "string" }, { "path": "$.SourceFileName", "type": "string" }, { "path": "$.TargetUserOrGroupType", "type": "string" }, { "path": "$.UniqueSharingId", "type": "string" }, { "path": "$.UserId", "type": "string" }, { "path": "$.Workload", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "6b1df56017af43e5e3f7", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "GetBucketLocation", "Application": "Amazon Web Services" }, "shapeId": "043921b04079f841", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "additionalEventData": { "@odata.type": "VALUE_1", "AuthenticationMethod": "VALUE_2", "CipherSuite": "VALUE_3", "SignatureVersion": "VALUE_4", "bytesTransferredIn": 1, "bytesTransferredIn@odata.type": "VALUE_5", "bytesTransferredOut": 1, "bytesTransferredOut@odata.type": "VALUE_5", "endTime": 1, "endTime@odata.type": "2026-01-01T00:00:00Z", "httpStatusCode": 1, "httpStatusCode@odata.type": "VALUE_5", "startTime": 1, "startTime@odata.type": "2026-01-01T00:00:00Z", "x-amz-id-2": "VALUE_6" }, "awsRegion": "VALUE_7", "eventCategory": "VALUE_8", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_9", "eventSource": "VALUE_10", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_11", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "VALUE_12", "requestParameters": { "@odata.type": "VALUE_1", "Host": "VALUE_13", "bucketName": "VALUE_14", "location": "VALUE_15" }, "resources": [ "{\"ARN\":\"VALUE_16\",\"accountId\":\"1\",\"type\":\"VALUE_17\"}" ], "resources@odata.type": "VALUE_18", "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_3", "clientProvidedHostHeader": "VALUE_13", "tlsVersion": "VALUE_19" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_20", "accountId": "1", "arn": "VALUE_21", "principalId": "VALUE_22", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_23", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_24", "principalId": "VALUE_25", "type": "VALUE_26", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_27" } }, "type": "VALUE_28" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.additionalEventData", "type": "object" }, { "path": "$.additionalEventData.AuthenticationMethod", "type": "string" }, { "path": "$.additionalEventData.CipherSuite", "type": "string" }, { "path": "$.additionalEventData.SignatureVersion", "type": "string" }, { "path": "$.additionalEventData.bytesTransferredIn", "type": "integer" }, { "path": "$.additionalEventData.bytesTransferredOut", "type": "integer" }, { "path": "$.additionalEventData.endTime", "type": "integer" }, { "path": "$.additionalEventData.httpStatusCode", "type": "integer" }, { "path": "$.additionalEventData.startTime", "type": "integer" }, { "path": "$.additionalEventData[\"@odata.type\"]", "type": "string" }, { "path": "$.additionalEventData[\"bytesTransferredIn@odata.type\"]", "type": "string" }, { "path": "$.additionalEventData[\"bytesTransferredOut@odata.type\"]", "type": "string" }, { "path": "$.additionalEventData[\"endTime@odata.type\"]", "type": "string" }, { "path": "$.additionalEventData[\"httpStatusCode@odata.type\"]", "type": "string" }, { "path": "$.additionalEventData[\"startTime@odata.type\"]", "type": "string" }, { "path": "$.additionalEventData[\"x-amz-id-2\"]", "type": "string" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.Host", "type": "string" }, { "path": "$.requestParameters.bucketName", "type": "string" }, { "path": "$.requestParameters.location", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.resources", "type": "array" }, { "path": "$.resources[]", "type": "encoded-json" }, { "path": "$.resources[]", "type": "string" }, { "path": "$.resources[]::", "type": "object" }, { "path": "$.resources[]::.ARN", "type": "string" }, { "path": "$.resources[]::.accountId", "type": "encoded-json" }, { "path": "$.resources[]::.accountId", "type": "string" }, { "path": "$.resources[]::.accountId::", "type": "integer" }, { "path": "$.resources[]::.type", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" }, { "path": "$[\"resources@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "7468b4ce8f29879a83c1", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "UserLoggedIn", "Application": "Office 365" }, "shapeId": "419b93357ec48417", "format": "json", "encoding": "native-json", "example": { "Actor": [ { "ID": "USERNAME_1@example.invalid", "Type": 1 } ], "ClientIP": "192.0.2.1", "CreationTime": "2026-01-01T00:00:00Z", "ExtendedProperties": [ { "Name": "UserAgent", "Value": "VALUE_1" } ], "Operation": "UserLoggedIn", "ResultStatus": "Succeeded", "UserId": "USERNAME_1@example.invalid", "Workload": "AzureActiveDirectory" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.Actor", "type": "array" }, { "path": "$.Actor[]", "type": "object" }, { "path": "$.Actor[].ID", "type": "string" }, { "path": "$.Actor[].Type", "type": "integer" }, { "path": "$.ClientIP", "type": "string" }, { "path": "$.CreationTime", "type": "string" }, { "path": "$.ExtendedProperties", "type": "array" }, { "path": "$.ExtendedProperties[]", "type": "object" }, { "path": "$.ExtendedProperties[].Name", "type": "string" }, { "path": "$.ExtendedProperties[].Value", "type": "string" }, { "path": "$.ExtendedProperties[][Name=UserAgent]", "type": "named-property" }, { "path": "$.Operation", "type": "string" }, { "path": "$.ResultStatus", "type": "string" }, { "path": "$.UserId", "type": "string" }, { "path": "$.Workload", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "798acf7bdc761de4c6b0", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List attached role policies", "Application": "Amazon Web Services" }, "shapeId": "43b149454a9aea7b", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "maxItems": 1, "maxItems@odata.type": "VALUE_7", "roleName": "VALUE_8" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_9", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_10" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_11", "accountId": "1", "arn": "VALUE_12", "principalId": "VALUE_13", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_14", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_15", "principalId": "VALUE_16", "type": "VALUE_17", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_18" } }, "type": "VALUE_19" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.maxItems", "type": "integer" }, { "path": "$.requestParameters.roleName", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters[\"maxItems@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "8b17b841fb88ee3424be", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List role policies", "Application": "Amazon Web Services" }, "shapeId": "43b149454a9aea7b", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "maxItems": 1, "maxItems@odata.type": "VALUE_7", "roleName": "VALUE_8" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_9", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_10" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_11", "accountId": "1", "arn": "VALUE_12", "principalId": "VALUE_13", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_14", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_15", "principalId": "VALUE_16", "type": "VALUE_17", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_18" } }, "type": "VALUE_19" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.maxItems", "type": "integer" }, { "path": "$.requestParameters.roleName", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters[\"maxItems@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "8cd49a6c889850016828", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListClusters", "Application": "Amazon Web Services" }, "shapeId": "2053fb1710bf1ccf", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "maxResults": "1" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_7", "tlsVersion": "VALUE_8" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_9", "accountId": "1", "arn": "VALUE_10", "principalId": "VALUE_11", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_12", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_13", "principalId": "VALUE_14", "type": "VALUE_15", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_16" } }, "type": "VALUE_17" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.maxResults", "type": "encoded-json" }, { "path": "$.requestParameters.maxResults", "type": "string" }, { "path": "$.requestParameters.maxResults::", "type": "integer" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "a56ffc739811c62e35bd", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List entities for policy", "Application": "Amazon Web Services" }, "shapeId": "1187c8bee446ecf2", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "maxItems": 1, "maxItems@odata.type": "VALUE_7", "policyArn": "VALUE_8" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_9", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_10" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_11", "accountId": "1", "arn": "VALUE_12", "principalId": "VALUE_13", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_14", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_15", "principalId": "VALUE_16", "type": "VALUE_17", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_18" } }, "type": "VALUE_19" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.maxItems", "type": "integer" }, { "path": "$.requestParameters.policyArn", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters[\"maxItems@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "a7e0caf0c310c03ee868", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListDetectors", "Application": "Amazon Web Services" }, "shapeId": "4defd9287d07d1c6", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_7", "tlsVersion": "VALUE_8" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_9", "accountId": "1", "arn": "VALUE_10", "principalId": "VALUE_11", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_12", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_13", "principalId": "VALUE_14", "type": "VALUE_15", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_16" } }, "type": "VALUE_17" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "c231c97faf0e6935cebd", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "New-InboxRule", "Application": "Microsoft Exchange Online" }, "shapeId": "515aa9906b44dc12", "format": "json", "encoding": "native-json", "example": { "CreationTime": "2026-01-01T00:00:00Z", "ObjectId": "VALUE_1", "Operation": "New-InboxRule", "Parameters": [ { "Name": "ForwardTo", "Value": "USERNAME_1@example.invalid" }, { "Name": "Identity", "Value": "VALUE_1" } ], "UserId": "USERNAME_2@example.invalid", "Workload": "Exchange" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.CreationTime", "type": "string" }, { "path": "$.ObjectId", "type": "string" }, { "path": "$.Operation", "type": "string" }, { "path": "$.Parameters", "type": "array" }, { "path": "$.Parameters[]", "type": "object" }, { "path": "$.Parameters[].Name", "type": "string" }, { "path": "$.Parameters[].Value", "type": "string" }, { "path": "$.Parameters[][Name=ForwardTo]", "type": "named-property" }, { "path": "$.Parameters[][Name=Identity]", "type": "named-property" }, { "path": "$.UserId", "type": "string" }, { "path": "$.Workload", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "c833a1e1f02bbad15935", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListCertificates", "Application": "Amazon Web Services" }, "shapeId": "29db6db22ff60f7c", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_7", "clientProvidedHostHeader": "VALUE_8", "keyExchange": "VALUE_9", "tlsVersion": "VALUE_10" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_11", "accountId": "1", "arn": "VALUE_12", "principalId": "VALUE_13", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_14", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_15", "principalId": "VALUE_16", "type": "VALUE_17", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_18" } }, "type": "VALUE_19" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.keyExchange", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "d027f4a2ef17841d40b0", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListMalwareProtectionPlans", "Application": "Amazon Web Services" }, "shapeId": "3c2e8f7a80f4a88b", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_7", "accountId": "1", "arn": "VALUE_8", "principalId": "VALUE_9", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_10", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "type": "VALUE_13", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_14" } }, "type": "VALUE_15" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "d2e8a1a3b52d0ea668a5", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Get role", "Application": "Amazon Web Services" }, "shapeId": "4a7889bc6375a366", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "roleName": "VALUE_7" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_8", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_9" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_10", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_13", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_14", "principalId": "VALUE_15", "type": "VALUE_16", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_17" } }, "type": "VALUE_18" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.roleName", "type": "string" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "e93cdcf1c60745e7f835", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Get service last accessed details", "Application": "Amazon Web Services" }, "shapeId": "791f0f3d8be248ec", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "jobId": "00000000-0000-4000-8000-000000000003", "maxItems": 1, "maxItems@odata.type": "VALUE_7" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_8", "clientProvidedHostHeader": "VALUE_5", "tlsVersion": "VALUE_9" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_10", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_13", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_14", "principalId": "VALUE_15", "type": "VALUE_16", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_17" } }, "type": "VALUE_18" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.jobId", "type": "string" }, { "path": "$.requestParameters.maxItems", "type": "integer" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters[\"maxItems@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "ed0ad96fd1a630fb574a", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListApplications", "Application": "Amazon Web Services" }, "shapeId": "907634f3edddaa2b", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_7", "clientProvidedHostHeader": "VALUE_8", "tlsVersion": "VALUE_9" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_10", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_13", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_14", "principalId": "VALUE_15", "type": "VALUE_16", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_17" } }, "type": "VALUE_18" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "f9e6f85c9db9af440197", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListFunctions20150331", "Application": "Amazon Web Services" }, "shapeId": "c871032b51638394", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "requestParameters": { "@odata.type": "VALUE_1", "maxItems": 1, "maxItems@odata.type": "VALUE_7" }, "sourceIPAddress": "192.0.2.1", "tlsDetails": { "@odata.type": "VALUE_1", "cipherSuite": "VALUE_8", "clientProvidedHostHeader": "VALUE_9", "tlsVersion": "VALUE_10" }, "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_11", "accountId": "1", "arn": "VALUE_12", "principalId": "VALUE_13", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_14", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_15", "principalId": "VALUE_16", "type": "VALUE_17", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_18" } }, "type": "VALUE_19" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.requestParameters", "type": "object" }, { "path": "$.requestParameters.maxItems", "type": "integer" }, { "path": "$.requestParameters[\"@odata.type\"]", "type": "string" }, { "path": "$.requestParameters[\"maxItems@odata.type\"]", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.tlsDetails", "type": "object" }, { "path": "$.tlsDetails.cipherSuite", "type": "string" }, { "path": "$.tlsDetails.clientProvidedHostHeader", "type": "string" }, { "path": "$.tlsDetails.tlsVersion", "type": "string" }, { "path": "$.tlsDetails[\"@odata.type\"]", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "fe93a10410662f6a3123", "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListDetectors", "Application": "Amazon Web Services" }, "shapeId": "3c2e8f7a80f4a88b", "format": "json", "encoding": "native-json", "example": { "@odata.type": "VALUE_1", "awsRegion": "VALUE_2", "eventCategory": "VALUE_3", "eventID": "00000000-0000-4000-8000-000000000001", "eventName": "VALUE_4", "eventSource": "VALUE_5", "eventTime": "2026-01-01T00:00:00Z", "eventType": "VALUE_6", "eventVersion": "1.5", "managementEvent": false, "readOnly": false, "recipientAccountId": "1", "requestID": "00000000-0000-4000-8000-000000000002", "sourceIPAddress": "192.0.2.1", "userAgent": "USERNAME_1", "userIdentity": { "@odata.type": "VALUE_1", "accessKeyId": "VALUE_7", "accountId": "1", "arn": "VALUE_8", "principalId": "VALUE_9", "sessionContext": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1", "creationDate": "VALUE_10", "mfaAuthenticated": "false" }, "sessionIssuer": { "@odata.type": "VALUE_1", "accountId": "1", "arn": "VALUE_11", "principalId": "VALUE_12", "type": "VALUE_13", "userName": "USERNAME_2" }, "webIdFederationData": { "@odata.type": "VALUE_1", "attributes": { "@odata.type": "VALUE_1" }, "federatedProvider": "VALUE_14" } }, "type": "VALUE_15" } }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.awsRegion", "type": "string" }, { "path": "$.eventCategory", "type": "string" }, { "path": "$.eventID", "type": "string" }, { "path": "$.eventName", "type": "string" }, { "path": "$.eventSource", "type": "string" }, { "path": "$.eventTime", "type": "string" }, { "path": "$.eventType", "type": "string" }, { "path": "$.eventVersion", "type": "encoded-json" }, { "path": "$.eventVersion", "type": "string" }, { "path": "$.eventVersion::", "type": "number" }, { "path": "$.managementEvent", "type": "boolean" }, { "path": "$.readOnly", "type": "boolean" }, { "path": "$.recipientAccountId", "type": "encoded-json" }, { "path": "$.recipientAccountId", "type": "string" }, { "path": "$.recipientAccountId::", "type": "integer" }, { "path": "$.requestID", "type": "string" }, { "path": "$.sourceIPAddress", "type": "string" }, { "path": "$.userAgent", "type": "string" }, { "path": "$.userIdentity", "type": "object" }, { "path": "$.userIdentity.accessKeyId", "type": "string" }, { "path": "$.userIdentity.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.accountId", "type": "string" }, { "path": "$.userIdentity.accountId::", "type": "integer" }, { "path": "$.userIdentity.arn", "type": "string" }, { "path": "$.userIdentity.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.attributes.creationDate", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated", "type": "string" }, { "path": "$.userIdentity.sessionContext.attributes.mfaAuthenticated::", "type": "boolean" }, { "path": "$.userIdentity.sessionContext.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer", "type": "object" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "encoded-json" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.accountId::", "type": "integer" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.arn", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.principalId", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.type", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer.userName", "type": "string" }, { "path": "$.userIdentity.sessionContext.sessionIssuer[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes", "type": "object" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.attributes[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData.federatedProvider", "type": "string" }, { "path": "$.userIdentity.sessionContext.webIdFederationData[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.sessionContext[\"@odata.type\"]", "type": "string" }, { "path": "$.userIdentity.type", "type": "string" }, { "path": "$.userIdentity[\"@odata.type\"]", "type": "string" }, { "path": "$[\"@odata.type\"]", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudappevents-table" }, { "id": "060234644ac4b45279f9", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NamedPipeEvent" }, "shapeId": "c0073ad8d740c546", "format": "json", "encoding": "json-string", "example": { "DesiredAccess": 1, "FileOperation": "SAMPLEFILE_1.txt", "NamedPipeEnd": "VALUE_1", "PipeName": "VALUE_2", "RemoteClientsAccess": "VALUE_3", "SessionId": 1, "ThreadId": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.DesiredAccess", "type": "integer" }, { "path": "$.FileOperation", "type": "string" }, { "path": "$.NamedPipeEnd", "type": "string" }, { "path": "$.PipeName", "type": "string" }, { "path": "$.RemoteClientsAccess", "type": "string" }, { "path": "$.SessionId", "type": "integer" }, { "path": "$.ThreadId", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "0b39b647198c6abd32dd", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DriverLoad" }, "shapeId": "b2fa431d04976935", "format": "json", "encoding": "json-string", "example": { "ImageBase": "1", "ImageMD5": "VALUE_1", "ImageName": "VALUE_2", "ImageSHA1": "VALUE_3", "ImageSHA256": "VALUE_4", "UserSid": "USERNAME_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.ImageBase", "type": "encoded-json" }, { "path": "$.ImageBase", "type": "string" }, { "path": "$.ImageBase::", "type": "integer" }, { "path": "$.ImageMD5", "type": "string" }, { "path": "$.ImageName", "type": "string" }, { "path": "$.ImageSHA1", "type": "string" }, { "path": "$.ImageSHA256", "type": "string" }, { "path": "$.UserSid", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "113ab62cc56da1288b35", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftBlocked" }, "shapeId": "79a36f9659b2824a", "format": "json", "encoding": "json-string", "example": { "IsAudit": false, "RuleId": "00000000-0000-4000-8000-000000000001" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.IsAudit", "type": "boolean" }, { "path": "$.RuleId", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "13d455c141f4548625ff", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskCreated" }, "shapeId": "6052478f9ec2743d", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"StartBoundary\":\"VALUE_2\"}}}", "TaskName": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.StartBoundary", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "13fb7aeb1cda30e6c930", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "shapeId": "338cd9a6c3b9671e", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"CalendarTrigger\":{\"Enabled\":\"false\",\"EndBoundary\":\"VALUE_2\",\"ScheduleByDay\":{\"DaysInterval\":\"1\"},\"StartBoundary\":\"VALUE_3\"}}}", "TaskName": "VALUE_4" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.EndBoundary", "type": "string" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.ScheduleByDay", "type": "object" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.ScheduleByDay.DaysInterval", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.ScheduleByDay.DaysInterval", "type": "string" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.ScheduleByDay.DaysInterval::", "type": "integer" }, { "path": "$.TaskContent::.Triggers.CalendarTrigger.StartBoundary", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "168c6c135047ad6f5641", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusDetection" }, "shapeId": "36abed46e73090ac", "format": "json", "encoding": "json-string", "example": { "ThreatName": "VALUE_1", "WasExecuting": false }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.ThreatName", "type": "string" }, { "path": "$.WasExecuting", "type": "boolean" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "1a2485151917e279686f", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveMounted" }, "shapeId": "0fcbe1c7d1b0e597", "format": "json", "encoding": "json-string", "example": { "BusType": 1, "DriveLetter": "VALUE_1", "LoggedOnUsers": [ "USERNAME_1" ], "Manufacturer": "VALUE_2", "ProductName": "VALUE_3", "ProductRevision": "1.5", "Volume": "VALUE_4" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.BusType", "type": "integer" }, { "path": "$.DriveLetter", "type": "string" }, { "path": "$.LoggedOnUsers", "type": "array" }, { "path": "$.LoggedOnUsers[]", "type": "string" }, { "path": "$.Manufacturer", "type": "string" }, { "path": "$.ProductName", "type": "string" }, { "path": "$.ProductRevision", "type": "encoded-json" }, { "path": "$.ProductRevision", "type": "string" }, { "path": "$.ProductRevision::", "type": "number" }, { "path": "$.Volume", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "1cddd58731290ac17594", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "shapeId": "d2d73b88b4c6f198", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}}}", "TaskName": "VALUE_2" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "21a3573af0505b204e79", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ShellLinkCreateFileEvent" }, "shapeId": "29de6bcfe9b7f3ce", "format": "json", "encoding": "json-string", "example": { "IsOnRemovableMedia": false, "ShellLinkShowCommand": "echo SAMPLE_1", "VolumeGuidPath": "SAMPLEFILE_1.txt" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.IsOnRemovableMedia", "type": "boolean" }, { "path": "$.ShellLinkShowCommand", "type": "string" }, { "path": "$.VolumeGuidPath", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "26d383e3af32c8171c71", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftAudited" }, "shapeId": "79a36f9659b2824a", "format": "json", "encoding": "json-string", "example": { "IsAudit": false, "RuleId": "00000000-0000-4000-8000-000000000001" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.IsAudit", "type": "boolean" }, { "path": "$.RuleId", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "27d75be27a17c9029747", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "shapeId": "d22b0e63a005052a", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"@id\":\"VALUE_1\",\"Enabled\":\"false\",\"RandomDelay\":\"VALUE_2\",\"Repetition\":{\"Interval\":\"VALUE_3\",\"StopAtDurationEnd\":\"false\"},\"StartBoundary\":\"VALUE_4\"},\"WnfStateChangeTrigger\":[{\"@id\":\"VALUE_5\",\"Data\":\"VALUE_6\",\"DataOffset\":\"1\",\"Enabled\":\"false\",\"StateName\":\"VALUE_7\"}]}}", "TaskName": "VALUE_10" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.RandomDelay", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.Interval", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.StartBoundary", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger[\"@id\"]", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger", "type": "array" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[]", "type": "object" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Data", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].DataOffset", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].DataOffset", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].DataOffset::", "type": "integer" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].StateName", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[][\"@id\"]", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "27d9dbd554063c077465", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemoteWmiOperation" }, "shapeId": "ed1cbdc951f96799", "format": "json", "encoding": "json-string", "example": { "Namespace": "VALUE_1", "OperationDetails": "VALUE_2", "OperationType": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.Namespace", "type": "string" }, { "path": "$.OperationDetails", "type": "string" }, { "path": "$.OperationType", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "31d1becb43f3ded9611f", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PowerShellCommand" }, "shapeId": "5b6cd0f3c73de130", "format": "json", "encoding": "json-string", "example": { "Command": "echo SAMPLE_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.Command", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "36e6ee7e0e65e543fdf2", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DnsQueryResponse" }, "shapeId": "ed174481ab1b0aea", "format": "json", "encoding": "json-string", "example": { "DnsQueryResult": [ "{\"DnsQueryType\":\"VALUE_1\",\"Result\":\"{\\\"dv3\\\":1,\\\"dv3_1\\\":1,\\\"pq\\\":1}\"}" ], "DnsQueryString": "VALUE_2" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.DnsQueryResult", "type": "array" }, { "path": "$.DnsQueryResult[]", "type": "encoded-json" }, { "path": "$.DnsQueryResult[]", "type": "string" }, { "path": "$.DnsQueryResult[]::", "type": "object" }, { "path": "$.DnsQueryResult[]::.DnsQueryType", "type": "string" }, { "path": "$.DnsQueryResult[]::.Result", "type": "encoded-json" }, { "path": "$.DnsQueryResult[]::.Result", "type": "string" }, { "path": "$.DnsQueryResult[]::.Result::", "type": "object" }, { "path": "$.DnsQueryResult[]::.Result::.dv3", "type": "integer" }, { "path": "$.DnsQueryResult[]::.Result::.dv3_1", "type": "integer" }, { "path": "$.DnsQueryResult[]::.Result::.pq", "type": "integer" }, { "path": "$.DnsQueryString", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "3a61ced19dfc3016f2cc", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ShellLinkCreateFileEvent" }, "shapeId": "e8f37f5cfc5471b7", "format": "json", "encoding": "json-string", "example": { "FileSizeInBytes": 1, "IsOnRemovableMedia": false, "ShellLinkRunAsAdmin": false, "ShellLinkShowCommand": "echo SAMPLE_1", "VolumeGuidPath": "SAMPLEFILE_1.txt" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.FileSizeInBytes", "type": "integer" }, { "path": "$.IsOnRemovableMedia", "type": "boolean" }, { "path": "$.ShellLinkRunAsAdmin", "type": "boolean" }, { "path": "$.ShellLinkShowCommand", "type": "string" }, { "path": "$.VolumeGuidPath", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "3aa534a3feb6fe6f6917", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanCompleted" }, "shapeId": "efa9e753f01f6ed6", "format": "json", "encoding": "json-string", "example": { "Domain": "COMPUTERNAME_1", "ScanId": "VALUE_1", "ScanParametersIndex": "1", "ScanTypeIndex": "VALUE_2", "User": "USERNAME_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.Domain", "type": "string" }, { "path": "$.ScanId", "type": "string" }, { "path": "$.ScanParametersIndex", "type": "encoded-json" }, { "path": "$.ScanParametersIndex", "type": "string" }, { "path": "$.ScanParametersIndex::", "type": "integer" }, { "path": "$.ScanTypeIndex", "type": "string" }, { "path": "$.User", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "3ae707dc41822663ba8a", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "shapeId": "2feae14a4fc1e698", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"RandomDelay\":\"VALUE_2\",\"Repetition\":{\"Interval\":\"VALUE_3\",\"StopAtDurationEnd\":\"false\"},\"StartBoundary\":\"VALUE_4\"}}}", "TaskName": "VALUE_5" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.RandomDelay", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.Interval", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.StartBoundary", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "450cda8eaf42235cbc08", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanCancelled" }, "shapeId": "efa9e753f01f6ed6", "format": "json", "encoding": "json-string", "example": { "Domain": "COMPUTERNAME_1", "ScanId": "VALUE_1", "ScanParametersIndex": "1", "ScanTypeIndex": "VALUE_2", "User": "USERNAME_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.Domain", "type": "string" }, { "path": "$.ScanId", "type": "string" }, { "path": "$.ScanParametersIndex", "type": "encoded-json" }, { "path": "$.ScanParametersIndex", "type": "string" }, { "path": "$.ScanParametersIndex::", "type": "integer" }, { "path": "$.ScanTypeIndex", "type": "string" }, { "path": "$.User", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "613eb3c6c8264a7c8140", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ReadProcessMemoryApiCall" }, "shapeId": "62befa7119c3b896", "format": "json", "encoding": "json-string", "example": { "TotalBytesCopied": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.TotalBytesCopied", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "6510730c28b50ea2c480", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "shapeId": "6052478f9ec2743d", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"StartBoundary\":\"VALUE_2\"}}}", "TaskName": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.StartBoundary", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "6c45c26bfecc6b8115a1", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtAllocateVirtualMemoryApiCall" }, "shapeId": "d9f0b1ee727b1aec", "format": "json", "encoding": "json-string", "example": { "BaseAddress": 1, "ProtectionMask": 1, "RegionSize": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.BaseAddress", "type": "integer" }, { "path": "$.ProtectionMask", "type": "integer" }, { "path": "$.RegionSize", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "6e6cb0161bcecec9a618", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "LdapSearch" }, "shapeId": "203248dfc7e820c6", "format": "json", "encoding": "json-string", "example": { "AttributeList": [ "VALUE_1" ], "DistinguishedName": "VALUE_12", "ScopeOfSearch": "VALUE_13", "SearchFilter": "VALUE_14" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.AttributeList", "type": "array" }, { "path": "$.AttributeList[]", "type": "string" }, { "path": "$.DistinguishedName", "type": "string" }, { "path": "$.ScopeOfSearch", "type": "string" }, { "path": "$.SearchFilter", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "705759e49cf4e3c426c4", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemoteWmiOperation" }, "shapeId": "3635fde86a114177", "format": "json", "encoding": "json-string", "example": { "OperationType": "VALUE_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.OperationType", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "7c6c18e8ebaa763f425c", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveMounted" }, "shapeId": "b1ae06e8c29cbe29", "format": "json", "encoding": "json-string", "example": { "BusType": 1, "DriveLetter": "VALUE_1", "LoggedOnUsers": [ "USERNAME_1" ], "ProductName": "VALUE_2", "ProductRevision": "1.5", "Volume": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.BusType", "type": "integer" }, { "path": "$.DriveLetter", "type": "string" }, { "path": "$.LoggedOnUsers", "type": "array" }, { "path": "$.LoggedOnUsers[]", "type": "string" }, { "path": "$.ProductName", "type": "string" }, { "path": "$.ProductRevision", "type": "encoded-json" }, { "path": "$.ProductRevision", "type": "string" }, { "path": "$.ProductRevision::", "type": "number" }, { "path": "$.Volume", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "80432c73037fa63f5f37", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BruteForceActivityDetected" }, "shapeId": "6d1c733a4a911090", "format": "json", "encoding": "json-string", "example": { "AttackType": "VALUE_1", "DomainName": "COMPUTERNAME_1", "IP": "192.0.2.1", "Username": "USERNAME_1", "WorkStationName": "VALUE_2" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.AttackType", "type": "string" }, { "path": "$.DomainName", "type": "string" }, { "path": "$.IP", "type": "string" }, { "path": "$.Username", "type": "string" }, { "path": "$.WorkStationName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "85ae7b5b41493b7d12bd", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskCreated" }, "shapeId": "9a25fe9809c5edf3", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":null,\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"RandomDelay\":\"VALUE_1\",\"Repetition\":{\"Interval\":\"VALUE_2\",\"StopAtDurationEnd\":\"false\"},\"StartBoundary\":\"VALUE_3\"}}}", "TaskName": "VALUE_4" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "null" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.RandomDelay", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.Interval", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Repetition.StopAtDurationEnd::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.StartBoundary", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "8bfe1922b2331bf43814", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DpapiAccessed" }, "shapeId": "75d7a6f8d229c114", "format": "json", "encoding": "json-string", "example": { "CallerProcessID": 1, "MasterKeyGUID": "00000000-0000-4000-8000-000000000001", "OperationType": "VALUE_1", "ReturnValue": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.CallerProcessID", "type": "integer" }, { "path": "$.MasterKeyGUID", "type": "string" }, { "path": "$.OperationType", "type": "string" }, { "path": "$.ReturnValue", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "94d1c9ea0958e4b1bb0c", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DnsQueryResponse" }, "shapeId": "15af20d40af183e6", "format": "json", "encoding": "json-string", "example": { "DnsQueryResult": [ "{\"DnsQueryType\":\"VALUE_1\",\"Result\":\"VALUE_2\"}" ], "DnsQueryString": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.DnsQueryResult", "type": "array" }, { "path": "$.DnsQueryResult[]", "type": "encoded-json" }, { "path": "$.DnsQueryResult[]", "type": "string" }, { "path": "$.DnsQueryResult[]::", "type": "object" }, { "path": "$.DnsQueryResult[]::.DnsQueryType", "type": "string" }, { "path": "$.DnsQueryResult[]::.Result", "type": "string" }, { "path": "$.DnsQueryString", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "a00a0e78fc4bde82632f", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ShellLinkCreateFileEvent" }, "shapeId": "9af73c802fb3a065", "format": "json", "encoding": "json-string", "example": { "FileSizeInBytes": 1, "IsOnRemovableMedia": false, "ShellLinkIconPath": "SAMPLEFILE_1.txt", "ShellLinkRunAsAdmin": false, "ShellLinkShowCommand": "echo SAMPLE_1", "VolumeGuidPath": "SAMPLEFILE_2.txt" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.FileSizeInBytes", "type": "integer" }, { "path": "$.IsOnRemovableMedia", "type": "boolean" }, { "path": "$.ShellLinkIconPath", "type": "string" }, { "path": "$.ShellLinkRunAsAdmin", "type": "boolean" }, { "path": "$.ShellLinkShowCommand", "type": "string" }, { "path": "$.VolumeGuidPath", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "a122883ec3eb44497176", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DnsQueryResponse" }, "shapeId": "7e67fbf5fa04968a", "format": "json", "encoding": "json-string", "example": { "DnsQueryString": "VALUE_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.DnsQueryString", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "a6fde83974fa9b1085f5", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "LdapSearch" }, "shapeId": "d719b180d044012d", "format": "json", "encoding": "json-string", "example": { "AttributeList": [ "VALUE_1" ], "ScopeOfSearch": "VALUE_2", "SearchFilter": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.AttributeList", "type": "array" }, { "path": "$.AttributeList[]", "type": "string" }, { "path": "$.ScopeOfSearch", "type": "string" }, { "path": "$.SearchFilter", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "a7da4ef2b3535510ccae", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ShellLinkCreateFileEvent" }, "shapeId": "a1324509785e832f", "format": "json", "encoding": "json-string", "example": { "FileSizeInBytes": 1, "IsOnRemovableMedia": false, "ShellLinkIconPath": "SAMPLEFILE_1.txt", "ShellLinkRunAsAdmin": false, "ShellLinkShowCommand": "echo SAMPLE_1", "ShellLinkWorkingDirectory": "VALUE_1", "VolumeGuidPath": "SAMPLEFILE_2.txt" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.FileSizeInBytes", "type": "integer" }, { "path": "$.IsOnRemovableMedia", "type": "boolean" }, { "path": "$.ShellLinkIconPath", "type": "string" }, { "path": "$.ShellLinkRunAsAdmin", "type": "boolean" }, { "path": "$.ShellLinkShowCommand", "type": "string" }, { "path": "$.ShellLinkWorkingDirectory", "type": "string" }, { "path": "$.VolumeGuidPath", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "aab4ca2597eb4a8a069c", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ProcessCreatedUsingWmiQuery" }, "shapeId": "1308305237e7b60f", "format": "json", "encoding": "json-string", "example": { "ClientMachine": "VALUE_1", "IsRemoteMachine": false }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.ClientMachine", "type": "string" }, { "path": "$.IsRemoteMachine", "type": "boolean" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "aed73c2e110c48a6f28d", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskCreated" }, "shapeId": "8a331d64c3df236e", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"WnfStateChangeTrigger\":{\"Data\":\"VALUE_2\",\"DataOffset\":\"1\",\"Enabled\":\"false\",\"StateName\":\"VALUE_3\"}}}", "TaskName": "VALUE_4" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.Data", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.DataOffset", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.DataOffset", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.DataOffset::", "type": "integer" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger.StateName", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "b0bcf5f38fd0421412f2", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DpapiAccessed" }, "shapeId": "0a263d0c4b0aa1b8", "format": "json", "encoding": "json-string", "example": { "CallerProcessID": 1, "Flags": "VALUE_1", "MasterKeyGUID": "00000000-0000-4000-8000-000000000001", "OperationType": "VALUE_2", "ProtectionFlags": "VALUE_3", "ReturnValue": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.CallerProcessID", "type": "integer" }, { "path": "$.Flags", "type": "string" }, { "path": "$.MasterKeyGUID", "type": "string" }, { "path": "$.OperationType", "type": "string" }, { "path": "$.ProtectionFlags", "type": "string" }, { "path": "$.ReturnValue", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "b65faca2914ce98a6fe0", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemoteDesktopConnection" }, "shapeId": "2fb241fc7ffe77bb", "format": "json", "encoding": "json-string", "example": { "Protocol": "VALUE_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.Protocol", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "bb662c6640a497aaf6f9", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "LdapSearch" }, "shapeId": "a288cc3896acc742", "format": "json", "encoding": "json-string", "example": { "AttributeList": [ "VALUE_1" ], "DistinguishedName": "VALUE_2", "ScopeOfSearch": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.AttributeList", "type": "array" }, { "path": "$.AttributeList[]", "type": "string" }, { "path": "$.DistinguishedName", "type": "string" }, { "path": "$.ScopeOfSearch", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "bf8eac4db673a322a75b", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskCreated" }, "shapeId": "1814c7b9a4cfcec5", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"StartBoundary\":\"VALUE_2\"},\"WnfStateChangeTrigger\":[{\"@id\":\"VALUE_3\",\"Data\":\"VALUE_4\",\"DataOffset\":\"1\",\"Enabled\":\"false\",\"StateName\":\"VALUE_5\"}]}}", "TaskName": "VALUE_9" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.TimeTrigger.StartBoundary", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger", "type": "array" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[]", "type": "object" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Data", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].DataOffset", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].DataOffset", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].DataOffset::", "type": "integer" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].Enabled::", "type": "boolean" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[].StateName", "type": "string" }, { "path": "$.TaskContent::.Triggers.WnfStateChangeTrigger[][\"@id\"]", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "c485601d56d82aabddfb", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DpapiAccessed" }, "shapeId": "bcf51103ecf2c357", "format": "json", "encoding": "json-string", "example": { "CallerProcessID": 1, "Flags": "VALUE_1", "MasterKeyGUID": "00000000-0000-4000-8000-000000000001", "OperationType": "VALUE_2", "ReturnValue": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.CallerProcessID", "type": "integer" }, { "path": "$.Flags", "type": "string" }, { "path": "$.MasterKeyGUID", "type": "string" }, { "path": "$.OperationType", "type": "string" }, { "path": "$.ReturnValue", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "e653bed079527defe391", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtAllocateVirtualMemoryRemoteApiCall" }, "shapeId": "aefe2f8148715aef", "format": "json", "encoding": "json-string", "example": { "IntegrityLevel": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.IntegrityLevel", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "eb975e72ded719d5a898", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CreateRemoteThreadApiCall" }, "shapeId": "aefe2f8148715aef", "format": "json", "encoding": "json-string", "example": { "IntegrityLevel": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.IntegrityLevel", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "ef662b332890adb94828", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ProcessPrimaryTokenModified" }, "shapeId": "8a3fcfdfec044fed", "format": "json", "encoding": "json-string", "example": { "CurrentTokenIntegrityLevel": "1", "CurrentTokenPointer": "1", "CurrentTokenPrivEnabled": "1", "CurrentTokenSource": "VALUE_1", "CurrentTokenUserSid": "USERNAME_1", "OriginalTokenIntegrityLevel": "1", "OriginalTokenPointer": "1", "OriginalTokenPrivEnabled": "1", "OriginalTokenPrivPresent": "1", "OriginalTokenSource": "VALUE_1", "OriginalTokenUserSid": "USERNAME_1", "SystemTokenPointer": "1", "TokenModificationProperties": "{\"currentTokenIntegrityLevelName\":\"VALUE_2\",\"isChangedToSystemToken\":false,\"originalTokenIntegrityLevelName\":\"VALUE_2\",\"privilegesFlags\":[],\"tokenChangeDescription\":\"VALUE_3\"}" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.CurrentTokenIntegrityLevel", "type": "encoded-json" }, { "path": "$.CurrentTokenIntegrityLevel", "type": "string" }, { "path": "$.CurrentTokenIntegrityLevel::", "type": "integer" }, { "path": "$.CurrentTokenPointer", "type": "encoded-json" }, { "path": "$.CurrentTokenPointer", "type": "string" }, { "path": "$.CurrentTokenPointer::", "type": "integer" }, { "path": "$.CurrentTokenPrivEnabled", "type": "encoded-json" }, { "path": "$.CurrentTokenPrivEnabled", "type": "string" }, { "path": "$.CurrentTokenPrivEnabled::", "type": "integer" }, { "path": "$.CurrentTokenSource", "type": "string" }, { "path": "$.CurrentTokenUserSid", "type": "string" }, { "path": "$.OriginalTokenIntegrityLevel", "type": "encoded-json" }, { "path": "$.OriginalTokenIntegrityLevel", "type": "string" }, { "path": "$.OriginalTokenIntegrityLevel::", "type": "integer" }, { "path": "$.OriginalTokenPointer", "type": "encoded-json" }, { "path": "$.OriginalTokenPointer", "type": "string" }, { "path": "$.OriginalTokenPointer::", "type": "integer" }, { "path": "$.OriginalTokenPrivEnabled", "type": "encoded-json" }, { "path": "$.OriginalTokenPrivEnabled", "type": "string" }, { "path": "$.OriginalTokenPrivEnabled::", "type": "integer" }, { "path": "$.OriginalTokenPrivPresent", "type": "encoded-json" }, { "path": "$.OriginalTokenPrivPresent", "type": "string" }, { "path": "$.OriginalTokenPrivPresent::", "type": "integer" }, { "path": "$.OriginalTokenSource", "type": "string" }, { "path": "$.OriginalTokenUserSid", "type": "string" }, { "path": "$.SystemTokenPointer", "type": "encoded-json" }, { "path": "$.SystemTokenPointer", "type": "string" }, { "path": "$.SystemTokenPointer::", "type": "integer" }, { "path": "$.TokenModificationProperties", "type": "encoded-json" }, { "path": "$.TokenModificationProperties", "type": "string" }, { "path": "$.TokenModificationProperties::", "type": "object" }, { "path": "$.TokenModificationProperties::.currentTokenIntegrityLevelName", "type": "string" }, { "path": "$.TokenModificationProperties::.isChangedToSystemToken", "type": "boolean" }, { "path": "$.TokenModificationProperties::.originalTokenIntegrityLevelName", "type": "string" }, { "path": "$.TokenModificationProperties::.privilegesFlags", "type": "array" }, { "path": "$.TokenModificationProperties::.tokenChangeDescription", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "f0cb627e37169a883cf0", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskDeleted" }, "shapeId": "b5452c239ce3c791", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskName": "VALUE_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "f1d692e0f77e0d58d9fd", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "OpenProcessApiCall" }, "shapeId": "d3bbbf105da81b4b", "format": "json", "encoding": "json-string", "example": { "DesiredAccess": 1 }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.DesiredAccess", "type": "integer" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "faca690938133f8c7c69", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardWin32SystemCallBlocked" }, "shapeId": "07878afaedd70d3e", "format": "json", "encoding": "json-string", "example": { "IsAudit": false }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.IsAudit", "type": "boolean" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "fc93c0c800be743273a5", "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "shapeId": "d93a11f6bf8172b5", "format": "json", "encoding": "json-string", "example": { "SubjectUserName": "USERNAME_1", "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"LogonTrigger\":{\"Delay\":\"VALUE_2\",\"Enabled\":\"false\"}}}", "TaskName": "VALUE_3" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.SubjectUserName", "type": "string" }, { "path": "$.TaskContent", "type": "encoded-json" }, { "path": "$.TaskContent", "type": "string" }, { "path": "$.TaskContent::", "type": "object" }, { "path": "$.TaskContent::.Actions", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec", "type": "object" }, { "path": "$.TaskContent::.Actions.Exec.Arguments", "type": "string" }, { "path": "$.TaskContent::.Actions.Exec.Command", "type": "string" }, { "path": "$.TaskContent::.Triggers", "type": "object" }, { "path": "$.TaskContent::.Triggers.LogonTrigger", "type": "object" }, { "path": "$.TaskContent::.Triggers.LogonTrigger.Delay", "type": "string" }, { "path": "$.TaskContent::.Triggers.LogonTrigger.Enabled", "type": "encoded-json" }, { "path": "$.TaskContent::.Triggers.LogonTrigger.Enabled", "type": "string" }, { "path": "$.TaskContent::.Triggers.LogonTrigger.Enabled::", "type": "boolean" }, { "path": "$.TaskName", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 3, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "id": "1f1b7ea00e9417f6373d", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "e8eb39d05dd2a8e3", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "2306bb7a614e01d858bf", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "72a3ffa85b5a496e", "format": "json", "encoding": "json-string", "example": [ { "key": "EXAMPLE_LABEL_001", "value": "VALUE_2" }, { "key": "EXAMPLE_LABEL_002", "value": "VALUE_3" }, { "key": "EXAMPLE_LABEL_003", "value": "VALUE_3" }, { "key": "EXAMPLE_LABEL_004", "value": "VALUE_3" }, { "key": "EXAMPLE_LABEL_005", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[][key=EXAMPLE_LABEL_002]", "type": "named-property" }, { "path": "$[][key=EXAMPLE_LABEL_003]", "type": "named-property" }, { "path": "$[][key=EXAMPLE_LABEL_004]", "type": "named-property" }, { "path": "$[][key=EXAMPLE_LABEL_005]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 4, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "291fb6cd6f7b76fbe088", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "e8eb39d05dd2a8e3", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "3976f82f772fc3dd1748", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "f891520d5abb9a23", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" }, { "key": "Oauth Scope Info", "value": "[\"VALUE_2\"]" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "encoded-json" }, { "path": "$[].value", "type": "string" }, { "path": "$[].value::", "type": "array" }, { "path": "$[].value::[]", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Oauth Scope Info]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "5df3a981812e88335edf", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "67325ea7c9fe7ae7", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_2" }, { "key": "Is Legacy Store Used", "value": "VALUE_2" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_2" }, { "key": "Login Hint Present", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Login Hint Present]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "8c1de67d26b81de7b26d", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "1", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "b349c59605c7f7e4", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" }, { "key": "Root Key Type", "value": "VALUE_3" }, { "key": "Token Binding Attempted", "value": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Root Key Type]", "type": "named-property" }, { "path": "$[][key=Token Binding Attempted]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "8fe544d70459716652ba", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "6c55d23dea8b4080", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_2" }, { "key": "Is Client Capable", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_2" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_2" }, { "key": "Oauth Scope Info", "value": "[\"VALUE_3\"]" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "encoded-json" }, { "path": "$[].value", "type": "string" }, { "path": "$[].value::", "type": "array" }, { "path": "$[].value::[]", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Client Capable]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Oauth Scope Info]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "992f2b0c580030c3ad45", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "23f0cd882bc4abf4", "format": "json", "encoding": "json-string", "example": [ { "key": "EXAMPLE_LABEL_001", "value": "VALUE_1" }, { "key": "Is CAE Token", "value": "VALUE_2" }, { "key": "Is Legacy Store Used", "value": "VALUE_2" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "a80e1bdba82f2164a015", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "666664cc62526954", "format": "json", "encoding": "json-string", "example": [ { "key": "EXAMPLE_LABEL_001", "value": "VALUE_1" }, { "key": "Is CAE Token", "value": "VALUE_2" }, { "key": "Is Legacy Store Used", "value": "VALUE_2" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_2" }, { "key": "Oauth Scope Info", "value": "[\"VALUE_3\"]" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "encoded-json" }, { "path": "$[].value", "type": "string" }, { "path": "$[].value::", "type": "array" }, { "path": "$[].value::[]", "type": "string" }, { "path": "$[][key=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Oauth Scope Info]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "b4427690b513e9f88fa7", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "e8eb39d05dd2a8e3", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "c0cd21e294b37933790c", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "72b60cb51e784b3e", "format": "json", "encoding": "json-string", "example": [ { "key": "EXAMPLE_LABEL_001", "value": "VALUE_2" }, { "key": "Is CAE Token", "value": "VALUE_3" }, { "key": "Is Legacy Store Used", "value": "VALUE_3" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_3" }, { "key": "Login Hint Present", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=EXAMPLE_LABEL_001]", "type": "named-property" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Login Hint Present]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "dc507200ad71f1976370", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "f891520d5abb9a23", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" }, { "key": "Oauth Scope Info", "value": "[\"VALUE_2\"]" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "encoded-json" }, { "path": "$[].value", "type": "string" }, { "path": "$[].value::", "type": "array" }, { "path": "$[].value::[]", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Oauth Scope Info]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "e1c24e0cb08d2fe1e62c", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "b349c59605c7f7e4", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" }, { "key": "Root Key Type", "value": "VALUE_3" }, { "key": "Token Binding Attempted", "value": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Root Key Type]", "type": "named-property" }, { "path": "$[][key=Token Binding Attempted]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "e7d1026b263f854f6c5e", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "6c55d23dea8b4080", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_2" }, { "key": "Is Client Capable", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_2" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_2" }, { "key": "Oauth Scope Info", "value": "[\"VALUE_3\"]" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "encoded-json" }, { "path": "$[].value", "type": "string" }, { "path": "$[].value::", "type": "array" }, { "path": "$[].value::[]", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Client Capable]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" }, { "path": "$[][key=Oauth Scope Info]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "f293b73ae92951eadc07", "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "e8eb39d05dd2a8e3", "format": "json", "encoding": "json-string", "example": [ { "key": "Is CAE Token", "value": "VALUE_1" }, { "key": "Is Legacy Store Used", "value": "VALUE_1" }, { "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "VALUE_1" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].key", "type": "string" }, { "path": "$[].value", "type": "string" }, { "path": "$[][key=Is CAE Token]", "type": "named-property" }, { "path": "$[][key=Is Legacy Store Used]", "type": "named-property" }, { "path": "$[][key=Legacy TLS (TLS 1.0, 1.1, 3DES)]", "type": "named-property" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "186259b439bde93091a6", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "1b259fc43784bbe4", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_11", "enforcedSessionControls": [ "VALUE_5" ], "excludeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_7" } ], "id": "00000000-0000-4000-8000-000000000011", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_8" } ], "result": "VALUE_10" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_2", "id": "00000000-0000-4000-8000-000000000002", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_3" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_45", "enforcedSessionControls": [ "VALUE_5" ], "id": "00000000-0000-4000-8000-000000000049", "result": "VALUE_10" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_47", "id": "00000000-0000-4000-8000-000000000051", "result": "VALUE_10" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000012", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_12", "id": "00000000-0000-4000-8000-000000000013", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_8" } ], "result": "VALUE_10" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000028", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_27", "id": "00000000-0000-4000-8000-000000000029", "result": "VALUE_10" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000039", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_48", "enforcedSessionControls": [ "VALUE_5" ], "id": "00000000-0000-4000-8000-000000000052", "result": "VALUE_10" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000039", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_8", "enforcedGrantControls": [ "VALUE_12" ], "id": "00000000-0000-4000-8000-000000000082", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_8" } ], "result": "VALUE_19" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_15", "enforcedGrantControls": [ "VALUE_11" ], "id": "00000000-0000-4000-8000-000000000016", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_8" } ], "result": "VALUE_10" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_20", "enforcedGrantControls": [ "VALUE_13" ], "enforcedSessionControls": [ "VALUE_5" ], "id": "00000000-0000-4000-8000-000000000021", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_8" } ], "result": "VALUE_10" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_29", "enforcedGrantControls": [ "VALUE_12" ], "id": "00000000-0000-4000-8000-000000000031", "result": "VALUE_10" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_3", "id": "00000000-0000-4000-8000-000000000003", "result": "VALUE_4" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_46", "enforcedSessionControls": [ "VALUE_16" ], "id": "00000000-0000-4000-8000-000000000050", "result": "VALUE_10" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_57", "enforcedSessionControls": [ "VALUE_16" ], "id": "00000000-0000-4000-8000-000000000061", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_10" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].authenticationStrength.displayName", "type": "string" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].excludeRulesSatisfied", "type": "array" }, { "path": "$[].excludeRulesSatisfied[]", "type": "object" }, { "path": "$[].excludeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].excludeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "1b72c517e7d6ab68d57c", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "1", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "b3de639a2e07da17", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_2", "id": "00000000-0000-4000-8000-000000000002", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_4" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_46", "enforcedSessionControls": [ "VALUE_10" ], "id": "00000000-0000-4000-8000-000000000050", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_49", "id": "00000000-0000-4000-8000-000000000053", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_59", "enforcedSessionControls": [ "VALUE_10" ], "id": "00000000-0000-4000-8000-000000000063", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_11", "id": "00000000-0000-4000-8000-000000000012", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_12", "id": "00000000-0000-4000-8000-000000000013", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_47", "enforcedSessionControls": [ "VALUE_10" ], "id": "00000000-0000-4000-8000-000000000051", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_8", "enforcedGrantControls": [ "VALUE_8" ], "id": "00000000-0000-4000-8000-000000000081", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_18" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_16", "enforcedGrantControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000017", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_20", "enforcedGrantControls": [ "VALUE_7" ], "enforcedSessionControls": [ "VALUE_10" ], "id": "00000000-0000-4000-8000-000000000021", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_3", "id": "00000000-0000-4000-8000-000000000003", "result": "VALUE_5" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_36", "enforcedGrantControls": [ "VALUE_14" ], "id": "00000000-0000-4000-8000-000000000039", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_66", "enforcedSessionControls": [ "VALUE_16" ], "id": "00000000-0000-4000-8000-000000000070", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_69", "enforcedSessionControls": [ "VALUE_10" ], "id": "00000000-0000-4000-8000-000000000073", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_6" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].authenticationStrength.displayName", "type": "string" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "3150c4dee36cc7364f5d", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "1b259fc43784bbe4", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_14", "enforcedSessionControls": [ "VALUE_7" ], "excludeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_9" } ], "id": "00000000-0000-4000-8000-000000000015", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_5" } ], "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_2", "id": "00000000-0000-4000-8000-000000000002", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_3" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_45", "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000049", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_47", "id": "00000000-0000-4000-8000-000000000051", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000013", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_13", "id": "00000000-0000-4000-8000-000000000014", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_5" } ], "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000028", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_27", "id": "00000000-0000-4000-8000-000000000029", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000039", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_48", "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000052", "result": "VALUE_6" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000039", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_8", "enforcedGrantControls": [ "VALUE_12" ], "id": "00000000-0000-4000-8000-000000000082", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_5" } ], "result": "VALUE_19" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_17", "enforcedGrantControls": [ "VALUE_11" ], "id": "00000000-0000-4000-8000-000000000018", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_5" } ], "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_19", "enforcedGrantControls": [ "VALUE_13" ], "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000020", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_5" } ], "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_29", "enforcedGrantControls": [ "VALUE_12" ], "id": "00000000-0000-4000-8000-000000000031", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_3", "id": "00000000-0000-4000-8000-000000000003", "result": "VALUE_4" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_46", "enforcedSessionControls": [ "VALUE_16" ], "id": "00000000-0000-4000-8000-000000000050", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_57", "enforcedSessionControls": [ "VALUE_16" ], "id": "00000000-0000-4000-8000-000000000061", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_1" } ], "result": "VALUE_6" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].authenticationStrength.displayName", "type": "string" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].excludeRulesSatisfied", "type": "array" }, { "path": "$[].excludeRulesSatisfied[]", "type": "object" }, { "path": "$[].excludeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].excludeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "468ef1a5b91fd0ee5952", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "e0b7c4647db3cccb", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000009", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_10", "id": "00000000-0000-4000-8000-000000000011", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000009", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_6", "enforcedGrantControls": [ "VALUE_5" ], "id": "00000000-0000-4000-8000-000000000081", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_17" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000009", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_9", "id": "00000000-0000-4000-8000-000000000010", "result": "VALUE_2" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000036", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_45", "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000050", "result": "VALUE_2" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000036", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_58", "enforcedSessionControls": [ "VALUE_7" ], "excludeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_13" } ], "id": "00000000-0000-4000-8000-000000000063", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "result": "VALUE_1" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_14", "enforcedGrantControls": [ "VALUE_4" ], "id": "00000000-0000-4000-8000-000000000015", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_18", "enforcedGrantControls": [ "VALUE_4" ], "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000019", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_35", "enforcedGrantControls": [ "VALUE_11" ], "id": "00000000-0000-4000-8000-000000000039", "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_65", "enforcedSessionControls": [ "VALUE_15" ], "id": "00000000-0000-4000-8000-000000000070", "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_68", "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000073", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].excludeRulesSatisfied", "type": "array" }, { "path": "$[].excludeRulesSatisfied[]", "type": "object" }, { "path": "$[].excludeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].excludeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "47e410a0e273092ac57f", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "b3de639a2e07da17", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_2", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000002", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_5" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_35", "id": "00000000-0000-4000-8000-000000000038", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_47", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000051", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_49", "id": "00000000-0000-4000-8000-000000000053", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_11", "id": "00000000-0000-4000-8000-000000000012", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_12", "id": "00000000-0000-4000-8000-000000000013", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_48", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000052", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_8", "enforcedGrantControls": [ "VALUE_9" ], "id": "00000000-0000-4000-8000-000000000081", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_17" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_16", "enforcedGrantControls": [ "VALUE_8" ], "id": "00000000-0000-4000-8000-000000000017", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_19", "enforcedGrantControls": [ "VALUE_8" ], "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000020", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_3", "id": "00000000-0000-4000-8000-000000000003", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_37", "enforcedGrantControls": [ "VALUE_13" ], "id": "00000000-0000-4000-8000-000000000040", "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_66", "enforcedSessionControls": [ "VALUE_15" ], "id": "00000000-0000-4000-8000-000000000070", "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_69", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000073", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].authenticationStrength.displayName", "type": "string" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "5911b47699b4d300ff16", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "3be4ce2ea9f20e37", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_2", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000002", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_5" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_35", "id": "00000000-0000-4000-8000-000000000038", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_47", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000051", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_49", "id": "00000000-0000-4000-8000-000000000053", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_58", "excludeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_16" } ], "id": "00000000-0000-4000-8000-000000000062", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_17" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_11", "id": "00000000-0000-4000-8000-000000000012", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_12", "id": "00000000-0000-4000-8000-000000000013", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_48", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000052", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_8", "enforcedGrantControls": [ "VALUE_9" ], "id": "00000000-0000-4000-8000-000000000081", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_20" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_16", "enforcedGrantControls": [ "VALUE_8" ], "id": "00000000-0000-4000-8000-000000000017", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_19", "enforcedGrantControls": [ "VALUE_8" ], "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000020", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_3", "id": "00000000-0000-4000-8000-000000000003", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_56", "enforcedGrantControls": [ "VALUE_8" ], "id": "00000000-0000-4000-8000-000000000060", "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_66", "enforcedSessionControls": [ "VALUE_18" ], "id": "00000000-0000-4000-8000-000000000070", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_17" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_67", "enforcedSessionControls": [ "VALUE_18" ], "id": "00000000-0000-4000-8000-000000000071", "result": "VALUE_7" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].authenticationStrength.displayName", "type": "string" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].excludeRulesSatisfied", "type": "array" }, { "path": "$[].excludeRulesSatisfied[]", "type": "object" }, { "path": "$[].excludeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].excludeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "8977d0c68bb28992976f", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "e0b7c4647db3cccb", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000009", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_10", "id": "00000000-0000-4000-8000-000000000011", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000009", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_6", "enforcedGrantControls": [ "VALUE_5" ], "id": "00000000-0000-4000-8000-000000000081", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_17" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000009", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_9", "id": "00000000-0000-4000-8000-000000000010", "result": "VALUE_2" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000036", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_45", "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000050", "result": "VALUE_2" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000036", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_58", "enforcedSessionControls": [ "VALUE_7" ], "excludeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_13" } ], "id": "00000000-0000-4000-8000-000000000063", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_1", "id": "00000000-0000-4000-8000-000000000001", "result": "VALUE_1" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_14", "enforcedGrantControls": [ "VALUE_4" ], "id": "00000000-0000-4000-8000-000000000015", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_17", "enforcedGrantControls": [ "VALUE_4" ], "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000018", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_35", "enforcedGrantControls": [ "VALUE_11" ], "id": "00000000-0000-4000-8000-000000000039", "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_65", "enforcedSessionControls": [ "VALUE_15" ], "id": "00000000-0000-4000-8000-000000000070", "result": "VALUE_2" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_68", "enforcedSessionControls": [ "VALUE_7" ], "id": "00000000-0000-4000-8000-000000000073", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].excludeRulesSatisfied", "type": "array" }, { "path": "$[].excludeRulesSatisfied[]", "type": "object" }, { "path": "$[].excludeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].excludeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "cbaee1f3b5aa3850fb56", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "ae2d16b5ff11cadc", "format": "json", "encoding": "json-string", "example": [], "fields": [ { "path": "$", "type": "array" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "cfdf851881c15a4bbe4c", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "ae2d16b5ff11cadc", "format": "json", "encoding": "json-string", "example": [], "fields": [ { "path": "$", "type": "array" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "efcaabb710b58a412298", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "b3de639a2e07da17", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_2", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000002", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_5" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_35", "id": "00000000-0000-4000-8000-000000000038", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_47", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000051", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_50", "id": "00000000-0000-4000-8000-000000000054", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_11", "id": "00000000-0000-4000-8000-000000000012", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_12", "id": "00000000-0000-4000-8000-000000000013", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_48", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000052", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_8", "enforcedGrantControls": [ "VALUE_9" ], "id": "00000000-0000-4000-8000-000000000081", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_17" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_16", "enforcedGrantControls": [ "VALUE_8" ], "id": "00000000-0000-4000-8000-000000000017", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_20", "enforcedGrantControls": [ "VALUE_8" ], "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000021", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_3", "id": "00000000-0000-4000-8000-000000000003", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_37", "enforcedGrantControls": [ "VALUE_13" ], "id": "00000000-0000-4000-8000-000000000040", "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_66", "enforcedSessionControls": [ "VALUE_15" ], "id": "00000000-0000-4000-8000-000000000070", "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_69", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000073", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].authenticationStrength.displayName", "type": "string" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "fef87d3f6b98234c0ff0", "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "3be4ce2ea9f20e37", "format": "json", "encoding": "json-string", "example": [ { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_2", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000002", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_5" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_35", "id": "00000000-0000-4000-8000-000000000038", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_47", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000051", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_49", "id": "00000000-0000-4000-8000-000000000053", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000001", "authenticationStrengthResult": 1, "displayName": "USERNAME_1" }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_58", "excludeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_16" } ], "id": "00000000-0000-4000-8000-000000000062", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_17" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_11", "id": "00000000-0000-4000-8000-000000000012", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_12", "id": "00000000-0000-4000-8000-000000000013", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_48", "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000052", "result": "VALUE_7" }, { "authenticationStrength": { "authenticationStrengthId": "00000000-0000-4000-8000-000000000011", "authenticationStrengthResult": 1 }, "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_8", "enforcedGrantControls": [ "VALUE_9" ], "id": "00000000-0000-4000-8000-000000000081", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_20" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_16", "enforcedGrantControls": [ "VALUE_8" ], "id": "00000000-0000-4000-8000-000000000017", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_19", "enforcedGrantControls": [ "VALUE_8" ], "enforcedSessionControls": [ "VALUE_1" ], "id": "00000000-0000-4000-8000-000000000020", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_3" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_3", "id": "00000000-0000-4000-8000-000000000003", "result": "VALUE_6" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_56", "enforcedGrantControls": [ "VALUE_8" ], "id": "00000000-0000-4000-8000-000000000060", "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_66", "enforcedSessionControls": [ "VALUE_18" ], "id": "00000000-0000-4000-8000-000000000070", "includeRulesSatisfied": [ { "conditionalAccessCondition": 1, "ruleSatisfied": "VALUE_17" } ], "result": "VALUE_7" }, { "conditionsNotSatisfied": 1, "conditionsSatisfied": 1, "displayName": "USERNAME_67", "enforcedSessionControls": [ "VALUE_18" ], "id": "00000000-0000-4000-8000-000000000071", "result": "VALUE_7" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].authenticationStrength", "type": "object" }, { "path": "$[].authenticationStrength.authenticationStrengthId", "type": "string" }, { "path": "$[].authenticationStrength.authenticationStrengthResult", "type": "integer" }, { "path": "$[].authenticationStrength.displayName", "type": "string" }, { "path": "$[].conditionsNotSatisfied", "type": "integer" }, { "path": "$[].conditionsSatisfied", "type": "integer" }, { "path": "$[].displayName", "type": "string" }, { "path": "$[].enforcedGrantControls", "type": "array" }, { "path": "$[].enforcedGrantControls[]", "type": "string" }, { "path": "$[].enforcedSessionControls", "type": "array" }, { "path": "$[].enforcedSessionControls[]", "type": "string" }, { "path": "$[].excludeRulesSatisfied", "type": "array" }, { "path": "$[].excludeRulesSatisfied[]", "type": "object" }, { "path": "$[].excludeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].excludeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].id", "type": "string" }, { "path": "$[].includeRulesSatisfied", "type": "array" }, { "path": "$[].includeRulesSatisfied[]", "type": "object" }, { "path": "$[].includeRulesSatisfied[].conditionalAccessCondition", "type": "integer" }, { "path": "$[].includeRulesSatisfied[].ruleSatisfied", "type": "string" }, { "path": "$[].result", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "158fac02f9463de7d99d", "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "a2fecfa85b97e35e", "format": "json", "encoding": "json-string", "example": [ { "networkNames": [ "VALUE_1" ], "networkType": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].networkNames", "type": "array" }, { "path": "$[].networkNames[]", "type": "string" }, { "path": "$[].networkType", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "52a1c88979391d907d85", "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "a2fecfa85b97e35e", "format": "json", "encoding": "json-string", "example": [ { "networkNames": [ "VALUE_1" ], "networkType": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].networkNames", "type": "array" }, { "path": "$[].networkNames[]", "type": "string" }, { "path": "$[].networkType", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "52ab06e5210a4e27493f", "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "ae2d16b5ff11cadc", "format": "json", "encoding": "json-string", "example": [], "fields": [ { "path": "$", "type": "array" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "5a4d4d019a26adf845cf", "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "1", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "a2fecfa85b97e35e", "format": "json", "encoding": "json-string", "example": [ { "networkNames": [ "VALUE_1" ], "networkType": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].networkNames", "type": "array" }, { "path": "$[].networkNames[]", "type": "string" }, { "path": "$[].networkType", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "c35a40b2d33671b22030", "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "shapeId": "a2fecfa85b97e35e", "format": "json", "encoding": "json-string", "example": [ { "networkNames": [ "VALUE_1" ], "networkType": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].networkNames", "type": "array" }, { "path": "$[].networkNames[]", "type": "string" }, { "path": "$[].networkType", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "e5cc7763455202c5cf39", "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "shapeId": "a2fecfa85b97e35e", "format": "json", "encoding": "json-string", "example": [ { "networkNames": [ "VALUE_1" ], "networkType": "VALUE_2" } ], "fields": [ { "path": "$", "type": "array" }, { "path": "$[]", "type": "object" }, { "path": "$[].networkNames", "type": "array" }, { "path": "$[].networkNames[]", "type": "string" }, { "path": "$[].networkType", "type": "string" } ], "origin": "observed", "generatorVersion": 2, "policyVersion": 5, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-entraidsigninevents-table" }, { "id": "043615e604eb21793f0f", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5136", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "872f4509d2fc1979", "format": "xml", "encoding": "xml-string", "example": "\n VALUE_1\n VALUE_2\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_3\n VALUE_4\n VALUE_5\n VALUE_6\n VALUE_7\n VALUE_8\n USERNAME_3\n VALUE_9\n VALUE_10\n VALUE_11\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AppCorrelationID]", "type": "element" }, { "path": "/EventData/Data[@Name=AppCorrelationID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AppCorrelationID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeLDAPDisplayName]", "type": "element" }, { "path": "/EventData/Data[@Name=AttributeLDAPDisplayName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeLDAPDisplayName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeSyntaxOID]", "type": "element" }, { "path": "/EventData/Data[@Name=AttributeSyntaxOID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeSyntaxOID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]", "type": "element" }, { "path": "/EventData/Data[@Name=AttributeValue]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DSName]", "type": "element" }, { "path": "/EventData/Data[@Name=DSName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DSName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DSType]", "type": "element" }, { "path": "/EventData/Data[@Name=DSType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DSType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectClass]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectClass]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectClass]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectDN]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectGUID]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectGUID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectGUID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OpCorrelationID]", "type": "element" }, { "path": "/EventData/Data[@Name=OpCorrelationID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=OpCorrelationID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OperationType]", "type": "element" }, { "path": "/EventData/Data[@Name=OperationType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=OperationType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "05041f9b610c1630bbbe", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "72c3583d69413ce1", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:Source>USERNAME_1@example.invalid</ns0:Source>\n <ns0:Author>USERNAME_2@example.invalid</ns0:Author>\n <ns0:Description>USERNAME_3@example.invalid</ns0:Description>\n <ns0:URI>VALUE_2</ns0:URI>\n <ns0:SecurityDescriptor>VALUE_4</ns0:SecurityDescriptor>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:TimeTrigger>\n <ns0:Repetition>\n <ns0:Interval>VALUE_5</ns0:Interval>\n <ns0:StopAtDurationEnd>false</ns0:StopAtDurationEnd>\n </ns0:Repetition>\n <ns0:StartBoundary>VALUE_6</ns0:StartBoundary>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:RandomDelay>VALUE_7</ns0:RandomDelay>\n </ns0:TimeTrigger>\n <ns0:WnfStateChangeTrigger>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:StateName>VALUE_8</ns0:StateName>\n </ns0:WnfStateChangeTrigger>\n </ns0:Triggers>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_9\">\n <ns0:UserId>USERNAME_1</ns0:UserId>\n <ns0:RunLevel>VALUE_10</ns0:RunLevel>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_11</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:DisallowStartOnRemoteAppSession>false</ns0:DisallowStartOnRemoteAppSession>\n <ns0:UseUnifiedSchedulingEngine>false</ns0:UseUnifiedSchedulingEngine>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_9\">\n <ns0:ComHandler>\n <ns0:ClassId>S-1-5-21-100-200-300-1001</ns0:ClassId>\n </ns0:ComHandler>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_12\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler/ClassId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler/ClassId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Author", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Author/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Description", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Description/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Source", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Source/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/Interval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/Interval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/StateName", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/StateName/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "0c3b1cd2a3708ddb71d8", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4776", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "0ebf352d9fe8353b", "format": "xml", "encoding": "xml-string", "example": "\n VALUE_1\n USERNAME_1\n VALUE_2\n VALUE_3\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=PackageName]", "type": "element" }, { "path": "/EventData/Data[@Name=PackageName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PackageName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Status]", "type": "element" }, { "path": "/EventData/Data[@Name=Status]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Status]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Workstation]", "type": "element" }, { "path": "/EventData/Data[@Name=Workstation]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Workstation]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "0dc4f3097a1a47a9496c", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5058", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "f15b3ef6517d4a9a", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n 1\n 2026-01-01T00:00:00Z\n VALUE_2\n VALUE_3\n VALUE_4\n VALUE_5\n SAMPLEFILE_1.txt\n VALUE_6\n VALUE_7\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AlgorithmName]", "type": "element" }, { "path": "/EventData/Data[@Name=AlgorithmName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AlgorithmName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientCreationTime]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientCreationTime]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientCreationTime]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=KeyFilePath]", "type": "element" }, { "path": "/EventData/Data[@Name=KeyFilePath]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=KeyFilePath]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=KeyName]", "type": "element" }, { "path": "/EventData/Data[@Name=KeyName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=KeyName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=KeyType]", "type": "element" }, { "path": "/EventData/Data[@Name=KeyType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=KeyType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Operation]", "type": "element" }, { "path": "/EventData/Data[@Name=Operation]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Operation]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProviderName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProviderName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProviderName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ReturnCode]", "type": "element" }, { "path": "/EventData/Data[@Name=ReturnCode]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ReturnCode]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "1276869a73380772a26b", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4701", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "2e5f26eef287d731", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:Version>1.5</ns0:Version>\n <ns0:SecurityDescriptor>VALUE_4</ns0:SecurityDescriptor>\n <ns0:Source>USERNAME_1@example.invalid</ns0:Source>\n <ns0:Author>USERNAME_1@example.invalid</ns0:Author>\n <ns0:Description>USERNAME_2@example.invalid</ns0:Description>\n <ns0:URI>VALUE_2</ns0:URI>\n </ns0:RegistrationInfo>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_5\">\n <ns0:UserId>USERNAME_1</ns0:UserId>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:MultipleInstancesPolicy>VALUE_6</ns0:MultipleInstancesPolicy>\n <ns0:RestartOnFailure>\n <ns0:Count>1</ns0:Count>\n <ns0:Interval>VALUE_7</ns0:Interval>\n </ns0:RestartOnFailure>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:IdleSettings>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:UseUnifiedSchedulingEngine>false</ns0:UseUnifiedSchedulingEngine>\n </ns0:Settings>\n <ns0:Triggers>\n <ns0:CalendarTrigger>\n <ns0:StartBoundary>VALUE_8</ns0:StartBoundary>\n <ns0:ScheduleByDay>\n <ns0:DaysInterval>1</ns0:DaysInterval>\n </ns0:ScheduleByDay>\n </ns0:CalendarTrigger>\n </ns0:Triggers>\n <ns0:Actions Context=\"VALUE_5\">\n <ns0:ComHandler>\n <ns0:ClassId>S-1-5-21-100-200-300-1001</ns0:ClassId>\n <ns0:Data>VALUE_9</ns0:Data>\n </ns0:ComHandler>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_10\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContent]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/ComHandler", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/ComHandler/ClassId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/ComHandler/ClassId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/ComHandler/Data", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/ComHandler/Data/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Author", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Author/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Description", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Description/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/SecurityDescriptor", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/SecurityDescriptor/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Source", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Source/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Version", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Version/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Version/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Version/text()::", "type": "number" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RestartOnFailure", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RestartOnFailure/Count", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RestartOnFailure/Count/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RestartOnFailure/Count/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RestartOnFailure/Count/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RestartOnFailure/Interval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RestartOnFailure/Interval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "1d2417f97926fa44192e", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5140", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "4499214d01cdbba6", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n 192.0.2.1\n 1\n VALUE_3\n \n VALUE_4\n VALUE_5\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessMask]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]", "type": "element" }, { "path": "/EventData/Data[@Name=IpAddress]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]", "type": "element" }, { "path": "/EventData/Data[@Name=IpPort]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ObjectType]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ShareLocalPath]", "type": "element" }, { "path": "/EventData/Data[@Name=ShareLocalPath]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ShareName]", "type": "element" }, { "path": "/EventData/Data[@Name=ShareName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ShareName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "216b535928b92250c544", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "a1584f3614f6beb9", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:URI>VALUE_2</ns0:URI>\n <ns0:SecurityDescriptor>VALUE_4</ns0:SecurityDescriptor>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:TimeTrigger>\n <ns0:Repetition>\n <ns0:Interval>VALUE_5</ns0:Interval>\n <ns0:StopAtDurationEnd>false</ns0:StopAtDurationEnd>\n </ns0:Repetition>\n <ns0:StartBoundary>VALUE_6</ns0:StartBoundary>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:RandomDelay>VALUE_7</ns0:RandomDelay>\n </ns0:TimeTrigger>\n </ns0:Triggers>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_8\">\n <ns0:RunLevel>VALUE_9</ns0:RunLevel>\n <ns0:UserId>USERNAME_1</ns0:UserId>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_10</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:Duration>VALUE_11</ns0:Duration>\n <ns0:WaitTimeout>2026-01-01T00:00:00Z</ns0:WaitTimeout>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_8\">\n <ns0:Exec>\n <ns0:Command>echo SAMPLE_1</ns0:Command>\n <ns0:Arguments>VALUE_12</ns0:Arguments>\n </ns0:Exec>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_13\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/Interval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/Interval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "2b3f04767c3266f061a6", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "06b495ed266262b7", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:Source>USERNAME_1@example.invalid</ns0:Source>\n <ns0:Author>USERNAME_1@example.invalid</ns0:Author>\n <ns0:Version>1.5</ns0:Version>\n <ns0:Description>USERNAME_2@example.invalid</ns0:Description>\n <ns0:URI>VALUE_2</ns0:URI>\n <ns0:SecurityDescriptor>VALUE_4</ns0:SecurityDescriptor>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:CalendarTrigger>\n <ns0:StartBoundary>VALUE_5</ns0:StartBoundary>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:ScheduleByDay>\n <ns0:DaysInterval>1</ns0:DaysInterval>\n </ns0:ScheduleByDay>\n </ns0:CalendarTrigger>\n </ns0:Triggers>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_6\">\n <ns0:UserId>USERNAME_1</ns0:UserId>\n <ns0:RunLevel>VALUE_7</ns0:RunLevel>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_8</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:DisallowStartOnRemoteAppSession>false</ns0:DisallowStartOnRemoteAppSession>\n <ns0:UseUnifiedSchedulingEngine>false</ns0:UseUnifiedSchedulingEngine>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n <ns0:RestartOnFailure>\n <ns0:Interval>VALUE_9</ns0:Interval>\n <ns0:Count>1</ns0:Count>\n </ns0:RestartOnFailure>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_6\">\n <ns0:ComHandler>\n <ns0:ClassId>S-1-5-21-100-200-300-1001</ns0:ClassId>\n <ns0:Data>VALUE_10</ns0:Data>\n </ns0:ComHandler>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_11\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler/ClassId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler/ClassId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler/Data", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/ComHandler/Data/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Author", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Author/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Description", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Description/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Source", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Source/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Version", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Version/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Version/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Version/text()::", "type": "number" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RestartOnFailure", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RestartOnFailure/Count", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RestartOnFailure/Count/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RestartOnFailure/Count/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RestartOnFailure/Count/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RestartOnFailure/Interval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RestartOnFailure/Interval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/CalendarTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "2b5b93e803910e84e5d6", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4948", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "4c5ff41d997879b6", "format": "xml", "encoding": "xml-string", "example": "\n SAMPLEFILE_1.txt\n VALUE_1\n VALUE_2\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ProfileChanged]", "type": "element" }, { "path": "/EventData/Data[@Name=ProfileChanged]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProfileChanged]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RuleId]", "type": "element" }, { "path": "/EventData/Data[@Name=RuleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RuleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RuleName]", "type": "element" }, { "path": "/EventData/Data[@Name=RuleName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RuleName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "31a781330d9c21445dd1", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5140", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "a34f6ac20a175a66", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n 192.0.2.1\n 1\n VALUE_3\n SAMPLEFILE_1.txt\n VALUE_4\n VALUE_5\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessMask]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]", "type": "element" }, { "path": "/EventData/Data[@Name=IpAddress]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]", "type": "element" }, { "path": "/EventData/Data[@Name=IpPort]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ObjectType]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ShareLocalPath]", "type": "element" }, { "path": "/EventData/Data[@Name=ShareLocalPath]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ShareLocalPath]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ShareName]", "type": "element" }, { "path": "/EventData/Data[@Name=ShareName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ShareName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "38068d7aeeb3a9c105fa", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4724", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "64e1a28f1b436a9f", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n COMPUTERNAME_1\n S-1-5-21-100-200-300-1001\n USERNAME_2\n USERNAME_3\n COMPUTERNAME_1\n VALUE_1\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "4269a0337be5eb786878", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4799", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "938d125597928bf4", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n COMPUTERNAME_1\n S-1-5-21-100-200-300-1001\n USERNAME_2\n USERNAME_3\n COMPUTERNAME_2\n VALUE_1\n S-1-5-21-100-200-300-1002\n VALUE_2\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=CallerProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=CallerProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CallerProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=CallerProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=CallerProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CallerProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "42a70d8ec033269e1c0a", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "b727dbcca54aaad0", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:URI>VALUE_2</ns0:URI>\n <ns0:SecurityDescriptor>VALUE_4</ns0:SecurityDescriptor>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:LogonTrigger>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Delay>VALUE_5</ns0:Delay>\n </ns0:LogonTrigger>\n </ns0:Triggers>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_6</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:Duration>VALUE_7</ns0:Duration>\n <ns0:WaitTimeout>2026-01-01T00:00:00Z</ns0:WaitTimeout>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_8\">\n <ns0:Exec>\n <ns0:Command>echo SAMPLE_1</ns0:Command>\n <ns0:Arguments>VALUE_9</ns0:Arguments>\n </ns0:Exec>\n </ns0:Actions>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_8\">\n <ns0:UserId>USERNAME_1</ns0:UserId>\n <ns0:RunLevel>VALUE_10</ns0:RunLevel>\n </ns0:Principal>\n </ns0:Principals>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_11\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/LogonTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/LogonTrigger/Delay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/LogonTrigger/Delay/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/LogonTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/LogonTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/LogonTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/LogonTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "4ceaf010207a04b8d994", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5379", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "fb6d940aadab993e", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n 1\n 1\n VALUE_3\n 1\n 2026-01-01T00:00:00Z\n 1\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=CountOfCredentialsReturned]", "type": "element" }, { "path": "/EventData/Data[@Name=CountOfCredentialsReturned]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CountOfCredentialsReturned]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=CountOfCredentialsReturned]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=CountOfCredentialsReturned]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ProcessCreationTime]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessCreationTime]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessCreationTime]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ReadOperation]", "type": "element" }, { "path": "/EventData/Data[@Name=ReadOperation]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ReadOperation]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ReturnCode]", "type": "element" }, { "path": "/EventData/Data[@Name=ReturnCode]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ReturnCode]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ReturnCode]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ReturnCode]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Type]", "type": "element" }, { "path": "/EventData/Data[@Name=Type]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Type]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=Type]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Type]/text()::", "type": "integer" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "54cb08cded9dab7f6a22", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4771", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "0db694d9e47b53aa", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n S-1-5-21-100-200-300-1001\n VALUE_1\n VALUE_2\n VALUE_3\n 1\n 192.0.2.1\n 1\n \n \n \n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=CertIssuerName]", "type": "element" }, { "path": "/EventData/Data[@Name=CertIssuerName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CertSerialNumber]", "type": "element" }, { "path": "/EventData/Data[@Name=CertSerialNumber]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CertThumbprint]", "type": "element" }, { "path": "/EventData/Data[@Name=CertThumbprint]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]", "type": "element" }, { "path": "/EventData/Data[@Name=IpAddress]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]", "type": "element" }, { "path": "/EventData/Data[@Name=IpPort]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=PreAuthType]", "type": "element" }, { "path": "/EventData/Data[@Name=PreAuthType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PreAuthType]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=PreAuthType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PreAuthType]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ServiceName]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Status]", "type": "element" }, { "path": "/EventData/Data[@Name=Status]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Status]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]", "type": "element" }, { "path": "/EventData/Data[@Name=TicketOptions]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "5610ac6d0a1b32fbf83d", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4798", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "938d125597928bf4", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n COMPUTERNAME_1\n S-1-5-21-100-200-300-1001\n USERNAME_2\n USERNAME_3\n COMPUTERNAME_2\n VALUE_1\n S-1-5-21-100-200-300-1002\n VALUE_2\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=CallerProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=CallerProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CallerProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=CallerProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=CallerProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CallerProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "62510c25ad0b5d90ee2c", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4770", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "abb4c2ea6f91aac8", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1@example.invalid\n COMPUTERNAME_1\n VALUE_1\n S-1-5-21-100-200-300-1001\n VALUE_2\n VALUE_3\n 192.0.2.1\n 1\n 0000000000000000000000000000000000000000000000000000000000000001\n 0000000000000000000000000000000000000000000000000000000000000002\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=IpAddress]", "type": "element" }, { "path": "/EventData/Data[@Name=IpAddress]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]", "type": "element" }, { "path": "/EventData/Data[@Name=IpPort]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RequestTicketHash]", "type": "element" }, { "path": "/EventData/Data[@Name=RequestTicketHash]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RequestTicketHash]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ResponseTicketHash]", "type": "element" }, { "path": "/EventData/Data[@Name=ResponseTicketHash]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ResponseTicketHash]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSid]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]", "type": "element" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]", "type": "element" }, { "path": "/EventData/Data[@Name=TicketOptions]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "7e26a800a5cd7cef1a18", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4670", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "56bf18108f166734", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n VALUE_3\n VALUE_4\n VALUE_5\n VALUE_6\n VALUE_7\n S-1-5-21-100-200-300-1001\n VALUE_8\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=HandleId]", "type": "element" }, { "path": "/EventData/Data[@Name=HandleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=HandleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=NewSd]", "type": "element" }, { "path": "/EventData/Data[@Name=NewSd]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=NewSd]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectServer]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OldSd]", "type": "element" }, { "path": "/EventData/Data[@Name=OldSd]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=OldSd]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "83b64e48b969669468b0", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4723", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "e7b198e789b4c2ed", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n COMPUTERNAME_1\n S-1-5-21-100-200-300-1001\n USERNAME_2\n USERNAME_1\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "880a74bb3b5c68972d99", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4699", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "a720c24760014652", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n \n 1\n 1\n 1\n 1\n VALUE_3\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "8ceaf0f047dde08977b1", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4754", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "f4e13cf24c34dad2", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n COMPUTERNAME_1\n S-1-5-21-100-200-300-1001\n USERNAME_2\n USERNAME_3\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n USERNAME_1\n S-1-5-21-100-200-300-1002\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SamAccountName]", "type": "element" }, { "path": "/EventData/Data[@Name=SamAccountName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SamAccountName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SidHistory]", "type": "element" }, { "path": "/EventData/Data[@Name=SidHistory]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SidHistory]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "8dfe4a7094b6ca836cac", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "706b32db3d0d4fe8", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:URI>VALUE_2</ns0:URI>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:TimeTrigger>\n <ns0:Repetition>\n <ns0:Interval>VALUE_4</ns0:Interval>\n <ns0:StopAtDurationEnd>false</ns0:StopAtDurationEnd>\n </ns0:Repetition>\n <ns0:StartBoundary>VALUE_5</ns0:StartBoundary>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:RandomDelay>VALUE_6</ns0:RandomDelay>\n </ns0:TimeTrigger>\n </ns0:Triggers>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_7\">\n <ns0:UserId>USERNAME_1</ns0:UserId>\n <ns0:RunLevel>VALUE_8</ns0:RunLevel>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_9</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:Duration>VALUE_10</ns0:Duration>\n <ns0:WaitTimeout>2026-01-01T00:00:00Z</ns0:WaitTimeout>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_7\">\n <ns0:Exec>\n <ns0:Command>echo SAMPLE_1</ns0:Command>\n <ns0:Arguments>VALUE_11</ns0:Arguments>\n </ns0:Exec>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_12\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/Interval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/Interval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "8f7beefc3ce12c9f74d3", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4768", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "c79348b87e8daf7e", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n COMPUTERNAME_1\n S-1-5-21-100-200-300-1001\n VALUE_1\n S-1-5-21-100-200-300-1002\n VALUE_2\n VALUE_3\n VALUE_4\n 1\n 192.0.2.1\n 1\n \n \n \n VALUE_5\n VALUE_6\n VALUE_7\n VALUE_8\n VALUE_7\n VALUE_8\n VALUE_7\n VALUE_9\n VALUE_4\n VALUE_4\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccountAvailableKeys]", "type": "element" }, { "path": "/EventData/Data[@Name=AccountAvailableKeys]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccountAvailableKeys]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AccountSupportedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=AccountSupportedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccountSupportedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=CertIssuerName]", "type": "element" }, { "path": "/EventData/Data[@Name=CertIssuerName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CertSerialNumber]", "type": "element" }, { "path": "/EventData/Data[@Name=CertSerialNumber]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CertThumbprint]", "type": "element" }, { "path": "/EventData/Data[@Name=CertThumbprint]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DCAvailableKeys]", "type": "element" }, { "path": "/EventData/Data[@Name=DCAvailableKeys]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DCAvailableKeys]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DCSupportedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=DCSupportedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DCSupportedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]", "type": "element" }, { "path": "/EventData/Data[@Name=IpAddress]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]", "type": "element" }, { "path": "/EventData/Data[@Name=IpPort]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=PreAuthEncryptionType]", "type": "element" }, { "path": "/EventData/Data[@Name=PreAuthEncryptionType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PreAuthEncryptionType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PreAuthType]", "type": "element" }, { "path": "/EventData/Data[@Name=PreAuthType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PreAuthType]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=PreAuthType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PreAuthType]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ResponseTicket]", "type": "element" }, { "path": "/EventData/Data[@Name=ResponseTicket]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ResponseTicket]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceAvailableKeys]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceAvailableKeys]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceAvailableKeys]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSid]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSupportedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SessionKeyEncryptionType]", "type": "element" }, { "path": "/EventData/Data[@Name=SessionKeyEncryptionType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SessionKeyEncryptionType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Status]", "type": "element" }, { "path": "/EventData/Data[@Name=Status]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Status]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]", "type": "element" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]", "type": "element" }, { "path": "/EventData/Data[@Name=TicketOptions]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "9c3de244cd4adc2777ee", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4957", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "10117fd467365fa3", "format": "xml", "encoding": "xml-string", "example": "\n VALUE_1\n VALUE_2\n VALUE_3\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=RuleAttr]", "type": "element" }, { "path": "/EventData/Data[@Name=RuleAttr]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RuleAttr]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RuleId]", "type": "element" }, { "path": "/EventData/Data[@Name=RuleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RuleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RuleName]", "type": "element" }, { "path": "/EventData/Data[@Name=RuleName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RuleName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "9e838af8bae6eef9ae21", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4659", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "695f822a1c431a51", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n VALUE_3\n VALUE_4\n VALUE_5\n VALUE_6\n VALUE_7\n VALUE_8\n VALUE_9\n S-1-5-21-100-200-300-1001\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessMask]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=HandleId]", "type": "element" }, { "path": "/EventData/Data[@Name=HandleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=HandleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectServer]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TransactionId]", "type": "element" }, { "path": "/EventData/Data[@Name=TransactionId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TransactionId]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "a9caf366204a4cda83c0", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4698", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "a5e1f51ecd67ee47", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:Description>VALUE_4</ns0:Description>\n <ns0:URI>VALUE_2</ns0:URI>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:CalendarTrigger>\n <ns0:StartBoundary>VALUE_5</ns0:StartBoundary>\n <ns0:EndBoundary>VALUE_6</ns0:EndBoundary>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:ScheduleByDay>\n <ns0:DaysInterval>1</ns0:DaysInterval>\n </ns0:ScheduleByDay>\n </ns0:CalendarTrigger>\n </ns0:Triggers>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_7\">\n <ns0:UserId>USERNAME_1</ns0:UserId>\n <ns0:RunLevel>VALUE_8</ns0:RunLevel>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_9</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:Duration>VALUE_10</ns0:Duration>\n <ns0:WaitTimeout>2026-01-01T00:00:00Z</ns0:WaitTimeout>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:DisallowStartOnRemoteAppSession>false</ns0:DisallowStartOnRemoteAppSession>\n <ns0:UseUnifiedSchedulingEngine>false</ns0:UseUnifiedSchedulingEngine>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_7\">\n <ns0:Exec>\n <ns0:Command>echo SAMPLE_1</ns0:Command>\n <ns0:Arguments>VALUE_11</ns0:Arguments>\n </ns0:Exec>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_12\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContent]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/Exec", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/Exec/Arguments", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/Exec/Arguments/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/Exec/Command", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Actions/Exec/Command/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Description", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/Description/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartOnRemoteAppSession", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/Duration", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/Duration/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/WaitTimeout", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/IdleSettings/WaitTimeout/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/EndBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/EndBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContent]/text()::/Task/Triggers/CalendarTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "aa385562f205d6f0a77c", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4719", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "804f238448f0cb53", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n VALUE_3\n VALUE_4\n VALUE_5\n 1\n 1\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AuditPolicyChanges]", "type": "element" }, { "path": "/EventData/Data[@Name=AuditPolicyChanges]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AuditPolicyChanges]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=CategoryId]", "type": "element" }, { "path": "/EventData/Data[@Name=CategoryId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CategoryId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubcategoryGuid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubcategoryGuid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubcategoryGuid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubcategoryId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubcategoryId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubcategoryId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "ab85bc41f9e388180872", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4673", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "ecd2bf129e5c2580", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n VALUE_3\n VALUE_4\n S-1-5-21-100-200-300-1001\n VALUE_5\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectServer]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectServer]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Service]", "type": "element" }, { "path": "/EventData/Data[@Name=Service]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Service]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "b6a646dbf792920059ef", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4769", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "da605c4bd1c73fec", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1@example.invalid\n COMPUTERNAME_1\n VALUE_1\n S-1-5-21-100-200-300-1001\n VALUE_2\n VALUE_3\n 192.0.2.1\n 1\n VALUE_4\n VALUE_5\n VALUE_6\n 0000000000000000000000000000000000000000000000000000000000000001\n 0000000000000000000000000000000000000000000000000000000000000002\n VALUE_7\n VALUE_7\n VALUE_8\n VALUE_9\n VALUE_8\n VALUE_9\n VALUE_10\n VALUE_11\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccountAvailableKeys]", "type": "element" }, { "path": "/EventData/Data[@Name=AccountAvailableKeys]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccountAvailableKeys]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AccountSupportedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=AccountSupportedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccountSupportedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DCAvailableKeys]", "type": "element" }, { "path": "/EventData/Data[@Name=DCAvailableKeys]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DCAvailableKeys]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DCSupportedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=DCSupportedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DCSupportedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]", "type": "element" }, { "path": "/EventData/Data[@Name=IpAddress]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpAddress]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]", "type": "element" }, { "path": "/EventData/Data[@Name=IpPort]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=IpPort]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=IpPort]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=LogonGuid]", "type": "element" }, { "path": "/EventData/Data[@Name=LogonGuid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=LogonGuid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RequestTicketHash]", "type": "element" }, { "path": "/EventData/Data[@Name=RequestTicketHash]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RequestTicketHash]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ResponseTicketHash]", "type": "element" }, { "path": "/EventData/Data[@Name=ResponseTicketHash]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ResponseTicketHash]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceAvailableKeys]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceAvailableKeys]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceAvailableKeys]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSid]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSupportedEncryptionTypes]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SessionKeyEncryptionType]", "type": "element" }, { "path": "/EventData/Data[@Name=SessionKeyEncryptionType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SessionKeyEncryptionType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=Status]", "type": "element" }, { "path": "/EventData/Data[@Name=Status]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=Status]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]", "type": "element" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TicketEncryptionType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]", "type": "element" }, { "path": "/EventData/Data[@Name=TicketOptions]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TicketOptions]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TransmittedServices]", "type": "element" }, { "path": "/EventData/Data[@Name=TransmittedServices]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TransmittedServices]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "ba8aef26726d8f975b10", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5712", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "6b77703c81a977e4", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n 1\n 1\n VALUE_1\n 192.0.2.1\n 1\n VALUE_2\n VALUE_3\n 1\n 1\n 1\n \n \n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AuthenticationLevel]", "type": "element" }, { "path": "/EventData/Data[@Name=AuthenticationLevel]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AuthenticationLevel]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=AuthenticationLevel]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AuthenticationLevel]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=AuthenticationService]", "type": "element" }, { "path": "/EventData/Data[@Name=AuthenticationService]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AuthenticationService]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=AuthenticationService]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AuthenticationService]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=Endpoint]", "type": "element" }, { "path": "/EventData/Data[@Name=Endpoint]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=InterfaceUuid]", "type": "element" }, { "path": "/EventData/Data[@Name=InterfaceUuid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=InterfaceUuid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OpNum]", "type": "element" }, { "path": "/EventData/Data[@Name=OpNum]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=OpNum]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=OpNum]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OpNum]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProtocolSequence]", "type": "element" }, { "path": "/EventData/Data[@Name=ProtocolSequence]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProtocolSequence]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RemoteHost]", "type": "element" }, { "path": "/EventData/Data[@Name=RemoteHost]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RemoteIpAddress]", "type": "element" }, { "path": "/EventData/Data[@Name=RemoteIpAddress]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RemoteIpAddress]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RemotePort]", "type": "element" }, { "path": "/EventData/Data[@Name=RemotePort]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RemotePort]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RemotePort]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RemotePort]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "c159c379f7c663adbbc9", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5136", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "37061b17445fc405", "format": "xml", "encoding": "xml-string", "example": "\n VALUE_1\n VALUE_2\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_3\n VALUE_4\n VALUE_5\n VALUE_6\n VALUE_7\n VALUE_8\n USERNAME_3\n VALUE_9\n {\"Domain\":\"COMPUTERNAME_2\",\"Forest\":\"VALUE_4\",\"HeartbeatUTC\":\"VALUE_10\",\"PasswordPolicyDateUTC\":\"VALUE_11\",\"ServerFQDN\":\"VALUE_12\",\"Site\":\"VALUE_13\",\"SoftwareVersion\":\"VALUE_14\",\"TenantId\":\"00000000-0000-4000-8000-000000000001\",\"TenantName\":null}\n VALUE_15\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AppCorrelationID]", "type": "element" }, { "path": "/EventData/Data[@Name=AppCorrelationID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AppCorrelationID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeLDAPDisplayName]", "type": "element" }, { "path": "/EventData/Data[@Name=AttributeLDAPDisplayName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeLDAPDisplayName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeSyntaxOID]", "type": "element" }, { "path": "/EventData/Data[@Name=AttributeSyntaxOID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeSyntaxOID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]", "type": "element" }, { "path": "/EventData/Data[@Name=AttributeValue]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::", "type": "object" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.Domain", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.Forest", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.HeartbeatUTC", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.PasswordPolicyDateUTC", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.ServerFQDN", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.Site", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.SoftwareVersion", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.TenantId", "type": "string" }, { "path": "/EventData/Data[@Name=AttributeValue]/text()::.TenantName", "type": "null" }, { "path": "/EventData/Data[@Name=DSName]", "type": "element" }, { "path": "/EventData/Data[@Name=DSName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DSName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DSType]", "type": "element" }, { "path": "/EventData/Data[@Name=DSType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DSType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectClass]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectClass]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectClass]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectDN]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectGUID]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectGUID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectGUID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OpCorrelationID]", "type": "element" }, { "path": "/EventData/Data[@Name=OpCorrelationID]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=OpCorrelationID]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OperationType]", "type": "element" }, { "path": "/EventData/Data[@Name=OperationType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=OperationType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 8, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "c57dfd20a240143eb6a4", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4674", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "1a49670d9bf32203", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n VALUE_3\n VALUE_3\n VALUE_4\n 1\n VALUE_5\n S-1-5-21-100-200-300-1001\n VALUE_6\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccessMask]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessMask]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=AccessMask]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=HandleId]", "type": "element" }, { "path": "/EventData/Data[@Name=HandleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=HandleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectServer]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "c7e459663fff64c31681", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4697", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "a60c7aadc7dbc0ea", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n SAMPLEFILE_1.txt\n VALUE_3\n 1\n VALUE_4\n 1\n 1\n 1\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ServiceAccount]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceAccount]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceAccount]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceFileName]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceFileName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceFileName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceStartType]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceStartType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceStartType]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ServiceStartType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceStartType]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ServiceType]", "type": "element" }, { "path": "/EventData/Data[@Name=ServiceType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServiceType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "c8999e3627b276dc4806", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "a4958c9377c2b03c", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:Source>VALUE_4</ns0:Source>\n <ns0:Author>VALUE_4</ns0:Author>\n <ns0:Description>VALUE_5</ns0:Description>\n <ns0:URI>VALUE_2</ns0:URI>\n <ns0:SecurityDescriptor>VALUE_6</ns0:SecurityDescriptor>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:TimeTrigger>\n <ns0:StartBoundary>VALUE_7</ns0:StartBoundary>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:RandomDelay>VALUE_8</ns0:RandomDelay>\n </ns0:TimeTrigger>\n <ns0:SessionStateChangeTrigger>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:StateChange>VALUE_9</ns0:StateChange>\n </ns0:SessionStateChangeTrigger>\n <ns0:SessionStateChangeTrigger>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:StateChange>VALUE_10</ns0:StateChange>\n </ns0:SessionStateChangeTrigger>\n <ns0:WnfStateChangeTrigger>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:StateName>VALUE_11</ns0:StateName>\n <ns0:Data>VALUE_12</ns0:Data>\n <ns0:DataOffset>1</ns0:DataOffset>\n </ns0:WnfStateChangeTrigger>\n </ns0:Triggers>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_13\">\n <ns0:RunLevel>VALUE_14</ns0:RunLevel>\n <ns0:UserId>USERNAME_3</ns0:UserId>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_15</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:Duration>VALUE_16</ns0:Duration>\n <ns0:WaitTimeout>2026-01-01T00:00:00Z</ns0:WaitTimeout>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:DisallowStartOnRemoteAppSession>false</ns0:DisallowStartOnRemoteAppSession>\n <ns0:UseUnifiedSchedulingEngine>false</ns0:UseUnifiedSchedulingEngine>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_13\">\n <ns0:Exec>\n <ns0:Command>echo SAMPLE_1</ns0:Command>\n <ns0:Arguments>VALUE_17</ns0:Arguments>\n </ns0:Exec>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_18\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Author", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Author/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Description", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Description/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Source", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/Source/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartOnRemoteAppSession/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/UseUnifiedSchedulingEngine/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/SessionStateChangeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/SessionStateChangeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/SessionStateChangeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/SessionStateChangeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/SessionStateChangeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/SessionStateChangeTrigger/StateChange", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/SessionStateChangeTrigger/StateChange/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/RandomDelay/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Data", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Data/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/DataOffset", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/DataOffset/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/DataOffset/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/DataOffset/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/StateName", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/WnfStateChangeTrigger/StateName/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "dd3a85e3d1fa64a900ed", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4627", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "74ba3d0e737c2136", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n USERNAME_3\n USERNAME_4\n COMPUTERNAME_2\n VALUE_2\n 1\n 1\n 1\n 192.0.2.1\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=EventCountTotal]", "type": "element" }, { "path": "/EventData/Data[@Name=EventCountTotal]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=EventCountTotal]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=EventCountTotal]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=EventCountTotal]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=EventIdx]", "type": "element" }, { "path": "/EventData/Data[@Name=EventIdx]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=EventIdx]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=EventIdx]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=EventIdx]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=GroupMembership]", "type": "element" }, { "path": "/EventData/Data[@Name=GroupMembership]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=GroupMembership]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=LogonType]", "type": "element" }, { "path": "/EventData/Data[@Name=LogonType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=LogonType]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=LogonType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=LogonType]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "e1ab4b14715487d70399", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4742", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "6b88a3f3eae6bdb3", "format": "xml", "encoding": "xml-string", "example": "\n COMPUTERNAME_1\n USERNAME_1\n COMPUTERNAME_2\n S-1-5-21-100-200-300-1001\n USERNAME_2\n USERNAME_3\n COMPUTERNAME_3\n VALUE_1\n VALUE_2\n USERNAME_4\n USERNAME_4\n USERNAME_1@example.invalid\n VALUE_2\n SAMPLEFILE_1.txt\n SAMPLEFILE_1.txt\n SAMPLEFILE_1.txt\n USERNAME_4\n VALUE_2\n VALUE_2\n VALUE_2\n VALUE_2\n VALUE_2\n VALUE_2\n USERNAME_4\n USERNAME_4\n S-1-5-21-100-200-300-1002\n VALUE_2\n VALUE_2\n USERNAME_1@example.invalid\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccountExpires]", "type": "element" }, { "path": "/EventData/Data[@Name=AccountExpires]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccountExpires]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AllowedToDelegateTo]", "type": "element" }, { "path": "/EventData/Data[@Name=AllowedToDelegateTo]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AllowedToDelegateTo]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ComputerAccountChange]", "type": "element" }, { "path": "/EventData/Data[@Name=ComputerAccountChange]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ComputerAccountChange]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DisplayName]", "type": "element" }, { "path": "/EventData/Data[@Name=DisplayName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DisplayName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=DnsHostName]", "type": "element" }, { "path": "/EventData/Data[@Name=DnsHostName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=DnsHostName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=HomeDirectory]", "type": "element" }, { "path": "/EventData/Data[@Name=HomeDirectory]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=HomeDirectory]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=HomePath]", "type": "element" }, { "path": "/EventData/Data[@Name=HomePath]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=HomePath]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=LogonHours]", "type": "element" }, { "path": "/EventData/Data[@Name=LogonHours]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=LogonHours]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=NewUacValue]", "type": "element" }, { "path": "/EventData/Data[@Name=NewUacValue]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=NewUacValue]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=OldUacValue]", "type": "element" }, { "path": "/EventData/Data[@Name=OldUacValue]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=OldUacValue]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PasswordLastSet]", "type": "element" }, { "path": "/EventData/Data[@Name=PasswordLastSet]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PasswordLastSet]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PrimaryGroupId]", "type": "element" }, { "path": "/EventData/Data[@Name=PrimaryGroupId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PrimaryGroupId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]", "type": "element" }, { "path": "/EventData/Data[@Name=PrivilegeList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PrivilegeList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProfilePath]", "type": "element" }, { "path": "/EventData/Data[@Name=ProfilePath]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProfilePath]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SamAccountName]", "type": "element" }, { "path": "/EventData/Data[@Name=SamAccountName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SamAccountName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ScriptPath]", "type": "element" }, { "path": "/EventData/Data[@Name=ScriptPath]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ScriptPath]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ServicePrincipalNames]", "type": "element" }, { "path": "/EventData/Data[@Name=ServicePrincipalNames]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ServicePrincipalNames]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SidHistory]", "type": "element" }, { "path": "/EventData/Data[@Name=SidHistory]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SidHistory]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TargetUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=UserAccountControl]", "type": "element" }, { "path": "/EventData/Data[@Name=UserAccountControl]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=UserAccountControl]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=UserParameters]", "type": "element" }, { "path": "/EventData/Data[@Name=UserParameters]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=UserParameters]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=UserPrincipalName]", "type": "element" }, { "path": "/EventData/Data[@Name=UserPrincipalName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=UserPrincipalName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=UserWorkstations]", "type": "element" }, { "path": "/EventData/Data[@Name=UserWorkstations]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=UserWorkstations]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "e3b2417d01c72f24bfba", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Microsoft-Windows-AppLocker/EXE and DLL", "EventID": "8002", "EventSourceName": "Microsoft-Windows-AppLocker" }, "shapeId": "957ac72529f26ae8", "format": "xml", "encoding": "xml-string", "example": "\n \n 1\n VALUE_1\n VALUE_2\n 1\n VALUE_3\n 1\n VALUE_4\n USERNAME_1\n 1\n 1\n SAMPLEFILE_1.txt\n 1\n \n 1\n VALUE_5\n VALUE_6\n 1\n SAMPLEFILE_2.txt\n \n", "fields": [ { "path": "/UserData", "type": "element" }, { "path": "/UserData/RuleAndFileData", "type": "element" }, { "path": "/UserData/RuleAndFileData/FileHash", "type": "element" }, { "path": "/UserData/RuleAndFileData/FileHashLength", "type": "element" }, { "path": "/UserData/RuleAndFileData/FileHashLength/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/FileHashLength/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/FileHashLength/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/FilePath", "type": "element" }, { "path": "/UserData/RuleAndFileData/FilePath/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/FilePathLength", "type": "element" }, { "path": "/UserData/RuleAndFileData/FilePathLength/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/FilePathLength/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/FilePathLength/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/Fqbn", "type": "element" }, { "path": "/UserData/RuleAndFileData/Fqbn/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/FqbnLength", "type": "element" }, { "path": "/UserData/RuleAndFileData/FqbnLength/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/FqbnLength/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/FqbnLength/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/FullFilePath", "type": "element" }, { "path": "/UserData/RuleAndFileData/FullFilePath/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/FullFilePathLength", "type": "element" }, { "path": "/UserData/RuleAndFileData/FullFilePathLength/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/FullFilePathLength/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/FullFilePathLength/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/PolicyName", "type": "element" }, { "path": "/UserData/RuleAndFileData/PolicyName/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/PolicyNameLength", "type": "element" }, { "path": "/UserData/RuleAndFileData/PolicyNameLength/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/PolicyNameLength/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/PolicyNameLength/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/RuleId", "type": "element" }, { "path": "/UserData/RuleAndFileData/RuleId/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/RuleName", "type": "element" }, { "path": "/UserData/RuleAndFileData/RuleName/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/RuleNameLength", "type": "element" }, { "path": "/UserData/RuleAndFileData/RuleNameLength/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/RuleNameLength/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/RuleNameLength/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/RuleSddl", "type": "element" }, { "path": "/UserData/RuleAndFileData/RuleSddl/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/RuleSddlLength", "type": "element" }, { "path": "/UserData/RuleAndFileData/RuleSddlLength/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/RuleSddlLength/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/RuleSddlLength/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/TargetLogonId", "type": "element" }, { "path": "/UserData/RuleAndFileData/TargetLogonId/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/TargetProcessId", "type": "element" }, { "path": "/UserData/RuleAndFileData/TargetProcessId/text()", "type": "encoded-json" }, { "path": "/UserData/RuleAndFileData/TargetProcessId/text()", "type": "string" }, { "path": "/UserData/RuleAndFileData/TargetProcessId/text()::", "type": "integer" }, { "path": "/UserData/RuleAndFileData/TargetUser", "type": "element" }, { "path": "/UserData/RuleAndFileData/TargetUser/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "e404b54e39d24449374d", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "988a065b2ffb9afb", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n <ns0:Task xmlns:ns0=\"http://schemas.microsoft.com/windows/2004/02/mit/task\" version=\"VALUE_3\">\n <ns0:RegistrationInfo>\n <ns0:URI>VALUE_2</ns0:URI>\n <ns0:SecurityDescriptor>VALUE_4</ns0:SecurityDescriptor>\n </ns0:RegistrationInfo>\n <ns0:Triggers>\n <ns0:TimeTrigger>\n <ns0:StartBoundary>VALUE_5</ns0:StartBoundary>\n <ns0:Enabled>false</ns0:Enabled>\n </ns0:TimeTrigger>\n </ns0:Triggers>\n <ns0:Principals>\n <ns0:Principal id=\"VALUE_6\">\n <ns0:RunLevel>VALUE_7</ns0:RunLevel>\n <ns0:UserId>USERNAME_1</ns0:UserId>\n </ns0:Principal>\n </ns0:Principals>\n <ns0:Settings>\n <ns0:MultipleInstancesPolicy>VALUE_8</ns0:MultipleInstancesPolicy>\n <ns0:DisallowStartIfOnBatteries>false</ns0:DisallowStartIfOnBatteries>\n <ns0:StopIfGoingOnBatteries>false</ns0:StopIfGoingOnBatteries>\n <ns0:AllowHardTerminate>false</ns0:AllowHardTerminate>\n <ns0:StartWhenAvailable>false</ns0:StartWhenAvailable>\n <ns0:RunOnlyIfNetworkAvailable>false</ns0:RunOnlyIfNetworkAvailable>\n <ns0:IdleSettings>\n <ns0:Duration>VALUE_9</ns0:Duration>\n <ns0:WaitTimeout>2026-01-01T00:00:00Z</ns0:WaitTimeout>\n <ns0:StopOnIdleEnd>false</ns0:StopOnIdleEnd>\n <ns0:RestartOnIdle>false</ns0:RestartOnIdle>\n </ns0:IdleSettings>\n <ns0:AllowStartOnDemand>false</ns0:AllowStartOnDemand>\n <ns0:Enabled>false</ns0:Enabled>\n <ns0:Hidden>false</ns0:Hidden>\n <ns0:RunOnlyIfIdle>false</ns0:RunOnlyIfIdle>\n <ns0:WakeToRun>false</ns0:WakeToRun>\n <ns0:ExecutionTimeLimit>2026-01-01T00:00:00Z</ns0:ExecutionTimeLimit>\n <ns0:Priority>1</ns0:Priority>\n </ns0:Settings>\n <ns0:Actions Context=\"VALUE_6\">\n <ns0:Exec>\n <ns0:Command>echo SAMPLE_1</ns0:Command>\n <ns0:Arguments>VALUE_10</ns0:Arguments>\n </ns0:Exec>\n </ns0:Actions>\n</ns0:Task>\n 1\n 1\n 1\n 1\n VALUE_11\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]", "type": "element" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ClientProcessStartKey]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=FQDN]", "type": "element" }, { "path": "/EventData/Data[@Name=FQDN]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=FQDN]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ParentProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ParentProcessId]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]", "type": "element" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RpcCallClientLocality]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "encoded-xml" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/@version", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/@Context", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Arguments/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Actions/Exec/Command/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/@id", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/RunLevel/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Principals/Principal/UserId/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/SecurityDescriptor/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/RegistrationInfo/URI/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowHardTerminate/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/AllowStartOnDemand/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/DisallowStartIfOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/ExecutionTimeLimit/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Hidden/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/Duration/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/RestartOnIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/StopOnIdleEnd/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/IdleSettings/WaitTimeout/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/MultipleInstancesPolicy/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/Priority/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfIdle/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/RunOnlyIfNetworkAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StartWhenAvailable/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/StopIfGoingOnBatteries/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Settings/WakeToRun/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/Enabled/text()::", "type": "boolean" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary", "type": "element" }, { "path": "/EventData/Data[@Name=TaskContentNew]/text()::/Task/Triggers/TimeTrigger/StartBoundary/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]", "type": "element" }, { "path": "/EventData/Data[@Name=TaskName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TaskName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "e6daa4157110ed75a737", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4660", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "e6ccd7a91bba6eb9", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n VALUE_3\n S-1-5-21-100-200-300-1001\n VALUE_4\n VALUE_5\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=HandleId]", "type": "element" }, { "path": "/EventData/Data[@Name=HandleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=HandleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectServer]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TransactionId]", "type": "element" }, { "path": "/EventData/Data[@Name=TransactionId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TransactionId]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "effdadb42cb5fd9bf799", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4985", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "63a5af8b26905a45", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n 1\n VALUE_3\n S-1-5-21-100-200-300-1001\n VALUE_4\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=NewState]", "type": "element" }, { "path": "/EventData/Data[@Name=NewState]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=NewState]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=NewState]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=NewState]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ResourceManager]", "type": "element" }, { "path": "/EventData/Data[@Name=ResourceManager]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ResourceManager]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=TransactionId]", "type": "element" }, { "path": "/EventData/Data[@Name=TransactionId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=TransactionId]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "f06bff88ebb37d30f43a", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4872", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "7e0bd0df0fab299b", "format": "xml", "encoding": "xml-string", "example": "\n VALUE_1\n 1\n VALUE_2\n VALUE_3\n https://example.invalid/SAMPLE_1\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=CRLNumber]", "type": "element" }, { "path": "/EventData/Data[@Name=CRLNumber]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=CRLNumber]/text()", "type": "encoded-json" }, { "path": "/EventData/Data[@Name=CRLNumber]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=CRLNumber]/text()::", "type": "integer" }, { "path": "/EventData/Data[@Name=IsBaseCRL]", "type": "element" }, { "path": "/EventData/Data[@Name=IsBaseCRL]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=IsBaseCRL]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=KeyContainer]", "type": "element" }, { "path": "/EventData/Data[@Name=KeyContainer]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=KeyContainer]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=NextPublish]", "type": "element" }, { "path": "/EventData/Data[@Name=NextPublish]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=NextPublish]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=PublishURLs]", "type": "element" }, { "path": "/EventData/Data[@Name=PublishURLs]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=PublishURLs]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "f6e926ada83c70413036", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4946", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "4c5ff41d997879b6", "format": "xml", "encoding": "xml-string", "example": "\n SAMPLEFILE_1.txt\n VALUE_1\n VALUE_2\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=ProfileChanged]", "type": "element" }, { "path": "/EventData/Data[@Name=ProfileChanged]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProfileChanged]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RuleId]", "type": "element" }, { "path": "/EventData/Data[@Name=RuleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RuleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=RuleName]", "type": "element" }, { "path": "/EventData/Data[@Name=RuleName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=RuleName]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "fc3e5fe4ec1c04d11785", "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4663", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "shapeId": "ca02845571dcdd3c", "format": "xml", "encoding": "xml-string", "example": "\n USERNAME_1\n USERNAME_2\n COMPUTERNAME_1\n VALUE_1\n VALUE_2\n VALUE_3\n VALUE_4\n VALUE_5\n VALUE_6\n VALUE_7\n S-1-5-21-100-200-300-1001\n VALUE_8\n VALUE_9\n", "fields": [ { "path": "/EventData", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessList]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessList]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]", "type": "element" }, { "path": "/EventData/Data[@Name=AccessMask]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=AccessMask]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=HandleId]", "type": "element" }, { "path": "/EventData/Data[@Name=HandleId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=HandleId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectServer]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectServer]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]", "type": "element" }, { "path": "/EventData/Data[@Name=ObjectType]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ObjectType]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]", "type": "element" }, { "path": "/EventData/Data[@Name=ProcessName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ProcessName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=ResourceAttributes]", "type": "element" }, { "path": "/EventData/Data[@Name=ResourceAttributes]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=ResourceAttributes]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectDomainName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectLogonId]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserName]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserName]/text()", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]", "type": "element" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/@Name", "type": "string" }, { "path": "/EventData/Data[@Name=SubjectUserSid]/text()", "type": "string" } ], "origin": "observed", "generatorVersion": 3, "policyVersion": 7, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; :: paths mark another XML parsing boundary.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent" }, { "id": "541a22fe24c00f432501", "table": "WindowsEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4624", "Provider": "Microsoft-Windows-Security-Auditing" }, "shapeId": "a7a2a789619475ac", "format": "json", "encoding": "native-json", "example": { "IpAddress": "192.0.2.1", "LogonType": "1", "TargetUserName": "USERNAME_1" }, "fields": [ { "path": "$", "type": "object" }, { "path": "$.IpAddress", "type": "string" }, { "path": "$.LogonType", "type": "encoded-json" }, { "path": "$.LogonType", "type": "string" }, { "path": "$.LogonType::", "type": "integer" }, { "path": "$.TargetUserName", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/windowsevent" }, { "id": "2691e42f4c32dcbe60af", "table": "WindowsEvent", "column": "RawEventData", "discriminators": { "Channel": "Security", "EventID": "4624", "Provider": "Microsoft-Windows-Security-Auditing" }, "shapeId": "0799e61427792c46", "format": "xml", "encoding": "xml-string", "example": "\n \n USERNAME_1\n 192.0.2.1\n 1\n \n", "fields": [ { "path": "/Event", "type": "element" }, { "path": "/Event/EventData", "type": "element" }, { "path": "/Event/EventData/Data[@Name=IpAddress]", "type": "element" }, { "path": "/Event/EventData/Data[@Name=IpAddress]/@Name", "type": "string" }, { "path": "/Event/EventData/Data[@Name=IpAddress]/text()", "type": "string" }, { "path": "/Event/EventData/Data[@Name=LogonType]", "type": "element" }, { "path": "/Event/EventData/Data[@Name=LogonType]/@Name", "type": "string" }, { "path": "/Event/EventData/Data[@Name=LogonType]/text()", "type": "encoded-json" }, { "path": "/Event/EventData/Data[@Name=LogonType]/text()", "type": "string" }, { "path": "/Event/EventData/Data[@Name=LogonType]/text()::", "type": "integer" }, { "path": "/Event/EventData/Data[@Name=TargetUserName]", "type": "element" }, { "path": "/Event/EventData/Data[@Name=TargetUserName]/@Name", "type": "string" }, { "path": "/Event/EventData/Data[@Name=TargetUserName]/text()", "type": "string" } ], "origin": "illustrative", "generatorVersion": 1, "policyVersion": 1, "notes": "XML string; paths identify elements, attributes, and text. No required fields are inferred.", "sourceUrl": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/windowsevent" } ], "combinations": [ { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment to service principal" }, "observedShapes": [ "0a1afcf70b7d929d" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "observedShapes": [ "2c91d3e3131b5c47" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "observedShapes": [ "0a1afcf70b7d929d" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal credentials" }, "observedShapes": [ "13f935868bad877a", "290a9b92f3ac2551" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "observedShapes": [ "13f935868bad877a", "290a9b92f3ac2551", "2e1fdc79a0311fd1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Consent to application" }, "observedShapes": [ "0a1afcf70b7d929d", "2e1fdc79a0311fd1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Create application \u2013 Certificates and secrets management " }, "observedShapes": [ "2c91d3e3131b5c47" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal credentials" }, "observedShapes": [ "13f935868bad877a", "290a9b92f3ac2551" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal" }, "observedShapes": [ "290a9b92f3ac2551" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "observedShapes": [ "2c91d3e3131b5c47", "6078758a642f5418" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "observedShapes": [ "290a9b92f3ac2551", "2e1fdc79a0311fd1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "Authentication", "LoggedByService": "B2C", "OperationName": "Validate user authentication" }, "observedShapes": [ "00723f5ee2db5bba" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "observedShapes": [ "35c1edeaeccc646d", "8fbde03e79e0437e" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupLifecyclePolicies_Get" }, "observedShapes": [ "b1ae68ab4d366e4c" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Group_GetDynamicGroupProperties" }, "observedShapes": [ "b1ae68ab4d366e4c" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupsODataV4_Get" }, "observedShapes": [ "b1ae68ab4d366e4c" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Settings_GetSettingsAsync" }, "observedShapes": [ "b1ae68ab4d366e4c" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Execution" }, "observedShapes": [ "2b0aa158812d0727" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Import" }, "observedShapes": [ "2b0aa158812d0727" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Other" }, "observedShapes": [ "2b0aa158812d0727" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "observedShapes": [ "2b0aa158812d0727" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "RoleManagement", "LoggedByService": "Core Directory", "OperationName": "Add member to role" }, "observedShapes": [ "ae2d16b5ff11cadc" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment grant to user" }, "observedShapes": [ "0a1afcf70b7d929d" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "AdditionalDetails", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "observedShapes": [ "8bb8a1a04d03e987", "ba43b38f1e381554" ], "illustrativeShapes": [ "1550927c48d87b3e" ] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment to service principal" }, "observedShapes": [ "020ba0cde8532f17" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "observedShapes": [ "020ba0cde8532f17", "d66b0064cd657ea0" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "observedShapes": [ "020ba0cde8532f17", "d66b0064cd657ea0" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal credentials" }, "observedShapes": [ "f0ddd6dfc7ea57e1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "observedShapes": [ "020ba0cde8532f17", "d66b0064cd657ea0", "f0ddd6dfc7ea57e1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Consent to application" }, "observedShapes": [ "020ba0cde8532f17" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Create application \u2013 Certificates and secrets management " }, "observedShapes": [ "020ba0cde8532f17", "d66b0064cd657ea0" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal credentials" }, "observedShapes": [ "f0ddd6dfc7ea57e1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal" }, "observedShapes": [ "f0ddd6dfc7ea57e1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "observedShapes": [ "020ba0cde8532f17", "d66b0064cd657ea0" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "observedShapes": [ "020ba0cde8532f17", "d66b0064cd657ea0", "f0ddd6dfc7ea57e1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "Authentication", "LoggedByService": "B2C", "OperationName": "Validate user authentication" }, "observedShapes": [ "020ba0cde8532f17" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "observedShapes": [ "f0ddd6dfc7ea57e1" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupLifecyclePolicies_Get" }, "observedShapes": [ "83f7087f380f66f0" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Group_GetDynamicGroupProperties" }, "observedShapes": [ "30fc2dedc70bac5a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupsODataV4_Get" }, "observedShapes": [ "30fc2dedc70bac5a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Settings_GetSettingsAsync" }, "observedShapes": [ "30fc2dedc70bac5a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Execution" }, "observedShapes": [ "30fc2dedc70bac5a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Import" }, "observedShapes": [ "30fc2dedc70bac5a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Other" }, "observedShapes": [ "30fc2dedc70bac5a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "observedShapes": [ "30fc2dedc70bac5a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "RoleManagement", "LoggedByService": "PIM", "OperationName": "Add member to role in PIM completed (timebound)" }, "observedShapes": [ "97dc185df1b6133c" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment grant to user" }, "observedShapes": [ "020ba0cde8532f17", "d66b0064cd657ea0" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "InitiatedBy", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "observedShapes": [ "f0ddd6dfc7ea57e1" ], "illustrativeShapes": [ "7b8c3d4515abb825" ] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment to service principal" }, "observedShapes": [ "af4a65b991833595" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add application" }, "observedShapes": [ "9c51e884a048b928", "a3fb40f2536e7da7", "cfd294eacb50c489", "f5e08913179090ef" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add delegated permission grant" }, "observedShapes": [ "4585bc1ea7e6d92f", "9274b336a65ccc90", "bbf221947a0a432f", "cf87c0dcbceaaffb" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal credentials" }, "observedShapes": [ "6ab18dabef4343f9" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Add service principal" }, "observedShapes": [ "002c54e03bbec1ae", "47994d27b2e783a6", "65a0174558329768", "e0d0ee0c1cc4e520", "f021706f76c4e13f" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Consent to application" }, "observedShapes": [ "97a5bd26864bdbc7" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Create application \u2013 Certificates and secrets management " }, "observedShapes": [ "83060a43f56720cf" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal credentials" }, "observedShapes": [ "6ab18dabef4343f9" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Remove service principal" }, "observedShapes": [ "d76e464f30e6b61a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update application" }, "observedShapes": [ "330bd399ec516255", "3323d84ef30fe231", "6aec36d1bc3ff8d4", "6fcd032979ca74cd", "7726c00bcd27f198", "7d9a52d2789ea332", "93c8d1baf3d22a7d", "9da1f051ec064f12", "a7af99e174f4222b", "b5cda13c5ed86c10", "be720cd4684d7ba8", "c363df4e5cac9086", "de0c730900f5563f", "f444c70ec02ac425", "f66b5fb6bc354a34" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ApplicationManagement", "LoggedByService": "Core Directory", "OperationName": "Update service principal" }, "observedShapes": [ "12d9e71d86f72081", "93816ca2b39e8149", "ca73123d3f31d8aa", "d76e464f30e6b61a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Authentication", "LoggedByService": "B2C", "OperationName": "Validate user authentication" }, "observedShapes": [ "065e37e2527a3a2b" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "Device", "LoggedByService": "Core Directory", "OperationName": "Update device" }, "observedShapes": [ "12fe9d0c77e09aeb", "2230a3f8980cfaba", "32e2aa0c59f5e5c6", "40c0d31775455b4d", "94857a262c4e794f" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupLifecyclePolicies_Get" }, "observedShapes": [ "3bc0a92f8f9ceeb9" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Group_GetDynamicGroupProperties" }, "observedShapes": [ "0ef9a95f59d33a99" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "GroupsODataV4_Get" }, "observedShapes": [ "3bc0a92f8f9ceeb9" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "GroupManagement", "LoggedByService": "Self-service Group Management", "OperationName": "Settings_GetSettingsAsync" }, "observedShapes": [ "3bc0a92f8f9ceeb9" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Execution" }, "observedShapes": [ "d76e464f30e6b61a" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Import" }, "observedShapes": [ "a9623d0b61778df3" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Other" }, "observedShapes": [ "5848a2d5a3c47cc9", "d3fb62acf4e7179b" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "ProvisioningManagement", "LoggedByService": "Account Provisioning", "OperationName": "Synchronization rule action" }, "observedShapes": [ "1d4a7fc57a9b264b", "695293043cf09c21", "d3fb62acf4e7179b" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "RoleManagement", "LoggedByService": "PIM", "OperationName": "Add member to role in PIM requested (timebound)" }, "observedShapes": [ "e0b11f9fb4f4def0" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Add app role assignment grant to user" }, "observedShapes": [ "1bb0becc60ac5757" ], "illustrativeShapes": [] }, { "table": "AuditLogs", "column": "TargetResources", "discriminators": { "Category": "UserManagement", "LoggedByService": "Core Directory", "OperationName": "Update user" }, "observedShapes": [ "5d66071e131a87f4", "b906ba76be64b6df", "da3f29edcb978dd5" ], "illustrativeShapes": [ "4b5882908f69fcca" ] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "AnonymousLinkCreated", "Application": "Microsoft OneDrive for Business" }, "observedShapes": [], "illustrativeShapes": [ "5c3053a679f326ee" ] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Assume role with web identity", "Application": "Amazon Web Services" }, "observedShapes": [ "e71e62c01e4e195d" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "FileDownloaded", "Application": "Microsoft SharePoint Online" }, "observedShapes": [], "illustrativeShapes": [ "6fccd6c6b9bee228" ] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Get policy", "Application": "Amazon Web Services" }, "observedShapes": [ "16c44e1960833a0e" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Get role", "Application": "Amazon Web Services" }, "observedShapes": [ "4a7889bc6375a366" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "Get service last accessed details", "Application": "Amazon Web Services" }, "observedShapes": [ "791f0f3d8be248ec" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "GetBucketLocation", "Application": "Amazon Web Services" }, "observedShapes": [ "043921b04079f841" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List attached role policies", "Application": "Amazon Web Services" }, "observedShapes": [ "43b149454a9aea7b", "4a7889bc6375a366" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List entities for policy", "Application": "Amazon Web Services" }, "observedShapes": [ "1187c8bee446ecf2" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "List role policies", "Application": "Amazon Web Services" }, "observedShapes": [ "43b149454a9aea7b", "4a7889bc6375a366" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListApplications", "Application": "Amazon Web Services" }, "observedShapes": [ "3c2e8f7a80f4a88b", "4defd9287d07d1c6", "907634f3edddaa2b" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListCertificates", "Application": "Amazon Web Services" }, "observedShapes": [ "29db6db22ff60f7c", "5e1c404de27fdaa7" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListClusters", "Application": "Amazon Web Services" }, "observedShapes": [ "2053fb1710bf1ccf" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListDetectors", "Application": "Amazon Web Services" }, "observedShapes": [ "3c2e8f7a80f4a88b", "4defd9287d07d1c6" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListDomains", "Application": "Amazon Web Services" }, "observedShapes": [ "907634f3edddaa2b" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListFunctions20150331", "Application": "Amazon Web Services" }, "observedShapes": [ "c871032b51638394" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListKeys", "Application": "Amazon Web Services" }, "observedShapes": [ "015cf647ff283457" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "ListMalwareProtectionPlans", "Application": "Amazon Web Services" }, "observedShapes": [ "3c2e8f7a80f4a88b", "4defd9287d07d1c6" ], "illustrativeShapes": [] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "New-InboxRule", "Application": "Microsoft Exchange Online" }, "observedShapes": [], "illustrativeShapes": [ "515aa9906b44dc12" ] }, { "table": "CloudAppEvents", "column": "RawEventData", "discriminators": { "ActionType": "UserLoggedIn", "Application": "Office 365" }, "observedShapes": [], "illustrativeShapes": [ "419b93357ec48417" ] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AccountCheckedForBlankPassword" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusDefinitionsUpdateFailed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusDefinitionsUpdated" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusDetection" }, "observedShapes": [], "illustrativeShapes": [ "36abed46e73090ac" ] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusEmergencyUpdatesInstalled" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusError" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusMalwareActionFailed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusMalwareBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusReport" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanCancelled" }, "observedShapes": [ "efa9e753f01f6ed6" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanCompleted" }, "observedShapes": [ "efa9e753f01f6ed6" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanFailed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusTroubleshootModeEvent" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlAppInstallationAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlAppInstallationBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCIScriptAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCIScriptBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityDriverRevoked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityImageAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityImageRevoked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityOriginAllowed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityOriginAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityOriginBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityPolicyAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityPolicyBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityPolicyLoaded" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegritySigningInformation" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlExecutableAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlExecutableBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlPackagedAppAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlPackagedAppBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlPolicyApplied" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlScriptAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlScriptBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardBrowseToUrl" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardCreateContainer" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardLaunchedWithUrl" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardResumeContainer" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardStopContainer" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardSuspendContainer" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockExecutable" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockPackagedApp" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockPackagedAppInstallation" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockScript" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAbusedSystemToolAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAbusedSystemToolBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAbusedSystemToolWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAdobeReaderChildProcessAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAdobeReaderChildProcessBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAdobeReaderChildProcessWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableEmailContentAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableEmailContentBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableEmailContentWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableOfficeContentAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableOfficeContentBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableOfficeContentWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftAudited" }, "observedShapes": [ "79a36f9659b2824a" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftBlocked" }, "observedShapes": [ "79a36f9659b2824a" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrObfuscatedScriptAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrObfuscatedScriptBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrObfuscatedScriptWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeChildProcessAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeChildProcessBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeChildProcessWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeCommAppChildProcessAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeCommAppChildProcessBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeCommAppChildProcessWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeMacroWin32ApiCallsAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeMacroWin32ApiCallsBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeMacroWin32ApiCallsWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeProcessInjectionAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeProcessInjectionBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeProcessInjectionWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPersistenceThroughWmiAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPersistenceThroughWmiBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPersistenceThroughWmiWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPsexecWmiChildProcessAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPsexecWmiChildProcessBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPsexecWmiChildProcessWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrRansomwareAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrRansomwareBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrRansomwareWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrSafeModeRebootAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrSafeModeRebootBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrSafeModeRebootWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrScriptExecutableDownloadAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrScriptExecutableDownloadBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrScriptExecutableDownloadWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedExecutableAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedExecutableBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedExecutableWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedUsbProcessAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedUsbProcessBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedUsbProcessWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrVulnerableSignedDriverAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrVulnerableSignedDriverBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrVulnerableSignedDriverWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrWebShellOnServerAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrWebShellOnServerBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrWebShellWarnBypassed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AuditPolicyModification" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BitLockerAuditCompleted" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BluetoothPolicyTriggered" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BrowserLaunchedToOpenUrl" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BruteForceActivityDetected" }, "observedShapes": [ "6d1c733a4a911090" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CertificateServicesApprovedCertificateRequest" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CertificateServicesLoadedTemplate" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CertificateServicesReceivedCertificateRequest" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ControlFlowGuardViolation" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ControlledFolderAccessViolationAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ControlledFolderAccessViolationBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CreateRemoteThreadApiCall" }, "observedShapes": [ "aefe2f8148715aef" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CredentialsBackup" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DeviceBootAttestationInfo" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DirectoryServiceObjectCreated" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DirectoryServiceObjectModified" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DnsQueryResponse" }, "observedShapes": [ "15af20d40af183e6", "7e67fbf5fa04968a", "ed174481ab1b0aea" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DpapiAccessed" }, "observedShapes": [ "0a263d0c4b0aa1b8", "75d7a6f8d229c114", "bcf51103ecf2c357" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DriverLoad" }, "observedShapes": [ "b2fa431d04976935" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardAcgAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardAcgEnforced" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardChildProcessAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardChildProcessBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardEafViolationAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardEafViolationBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardIafViolationAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardIafViolationBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardLowIntegrityImageAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardLowIntegrityImageBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNetworkProtectionAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNetworkProtectionBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNonMicrosoftSignedAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNonMicrosoftSignedBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardRopExploitAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardRopExploitBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardSharedBinaryAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardSharedBinaryBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardWin32SystemCallAudited" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardWin32SystemCallBlocked" }, "observedShapes": [ "07878afaedd70d3e" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExternalDeviceConnected" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExternalDeviceDisconnected" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FileTimestampModificationEvent" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallInboundConnectionBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallInboundConnectionToAppBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallOutboundConnectionBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallServiceStopped" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "GetAsyncKeyStateApiCall" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "GetClipboardData" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "LdapSearch" }, "observedShapes": [ "203248dfc7e820c6", "a288cc3896acc742", "d719b180d044012d" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "LogonRightsSettingEnabled" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "MemoryRemoteProtect" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NamedPipeEvent" }, "observedShapes": [ "c0073ad8d740c546" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkProtectionUserBypassEvent" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectAccessChecked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectAdded" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectDeleted" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectModified" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtAllocateVirtualMemoryApiCall" }, "observedShapes": [ "d9f0b1ee727b1aec" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtAllocateVirtualMemoryRemoteApiCall" }, "observedShapes": [ "aefe2f8148715aef" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtMapViewOfSectionRemoteApiCall" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtProtectVirtualMemoryApiCall" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "OpenProcessApiCall" }, "observedShapes": [ "d3bbbf105da81b4b" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PTraceDetected" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PasswordChangeAttempt" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PlistPropertyModified" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PnpDeviceAllowed" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PnpDeviceBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PnpDeviceConnected" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PowerShellCommand" }, "observedShapes": [ "5b6cd0f3c73de130" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PrintJobBlocked" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ProcessCreatedUsingWmiQuery" }, "observedShapes": [ "1308305237e7b60f" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ProcessPrimaryTokenModified" }, "observedShapes": [ "8a3fcfdfec044fed" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "QueueUserApcRemoteApiCall" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ReadProcessMemoryApiCall" }, "observedShapes": [ "62befa7119c3b896" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemoteDesktopConnection" }, "observedShapes": [ "2fb241fc7ffe77bb" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemoteWmiOperation" }, "observedShapes": [ "3635fde86a114177", "ed1cbdc951f96799" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemovableStorageFileEvent" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemovableStoragePolicyTriggered" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SafeDocFileScan" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskCreated" }, "observedShapes": [ "1814c7b9a4cfcec5", "6052478f9ec2743d", "8a331d64c3df236e", "9a25fe9809c5edf3" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskDeleted" }, "observedShapes": [ "b5452c239ce3c791" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskDisabled" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskEnabled" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "observedShapes": [ "2feae14a4fc1e698", "338cd9a6c3b9671e", "6052478f9ec2743d", "d22b0e63a005052a", "d2d73b88b4c6f198", "d93a11f6bf8172b5" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScreenshotTaken" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SecurityGroupCreated" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SecurityGroupDeleted" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SecurityLogCleared" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SensitiveFileRead" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ServiceInstalled" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SetThreadContextRemoteApiCall" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ShellLinkCreateFileEvent" }, "observedShapes": [ "29de6bcfe9b7f3ce", "9af73c802fb3a065", "a1324509785e832f", "e8f37f5cfc5471b7" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenAppWarning" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenExploitWarning" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenUrlWarning" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenUserOverride" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "TamperingAttempt" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UntrustedWifiConnection" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveDriveLetterChanged" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveMounted" }, "observedShapes": [ "0fcbe1c7d1b0e597", "b1ae06e8c29cbe29" ], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveUnmounted" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountAddedToLocalGroup" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountCreated" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountDeleted" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountModified" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountPasswordResetAttempt" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountRemovedFromLocalGroup" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "WmiBindEventFilterToConsumer" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "WriteToLsassProcessMemory" }, "observedShapes": [], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "observedShapes": [ "23f0cd882bc4abf4", "67325ea7c9fe7ae7", "72a3ffa85b5a496e", "72b60cb51e784b3e", "e8eb39d05dd2a8e3" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "666664cc62526954", "6c55d23dea8b4080", "e8eb39d05dd2a8e3", "f891520d5abb9a23" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "1", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "b349c59605c7f7e4" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"interactiveUser\"]" }, "observedShapes": [ "e8eb39d05dd2a8e3" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "AuthenticationProcessingDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "6c55d23dea8b4080", "b349c59605c7f7e4", "e8eb39d05dd2a8e3", "f891520d5abb9a23" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "observedShapes": [ "1b259fc43784bbe4", "3be4ce2ea9f20e37", "b3de639a2e07da17", "e0b7c4647db3cccb" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "1b259fc43784bbe4", "3be4ce2ea9f20e37", "b3de639a2e07da17", "e0b7c4647db3cccb" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "1", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "b3de639a2e07da17" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"interactiveUser\"]" }, "observedShapes": [ "ae2d16b5ff11cadc" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "ConditionalAccessPolicies", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "ae2d16b5ff11cadc" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"interactiveUser\"]" }, "observedShapes": [ "a2fecfa85b97e35e" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "0", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "a2fecfa85b97e35e" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "1", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "a2fecfa85b97e35e" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"interactiveUser\"]" }, "observedShapes": [ "a2fecfa85b97e35e" ], "illustrativeShapes": [] }, { "table": "EntraIdSignInEvents", "column": "NetworkLocationDetails", "discriminators": { "ConditionalAccessStatus": "2", "LogonType": "[\"nonInteractiveUser\"]" }, "observedShapes": [ "a2fecfa85b97e35e", "ae2d16b5ff11cadc" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Microsoft-Windows-AppLocker/EXE and DLL", "EventID": "8002", "EventSourceName": "Microsoft-Windows-AppLocker" }, "observedShapes": [ "957ac72529f26ae8" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4627", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "74ba3d0e737c2136" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4659", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "695f822a1c431a51" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4660", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "e6ccd7a91bba6eb9" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4663", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "ca02845571dcdd3c" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4670", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "56bf18108f166734" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4673", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "ecd2bf129e5c2580" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4674", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "1a49670d9bf32203" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4697", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "a60c7aadc7dbc0ea" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4698", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "a5e1f51ecd67ee47" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4699", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "a720c24760014652" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4701", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "2e5f26eef287d731" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4702", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "06b495ed266262b7", "706b32db3d0d4fe8", "72c3583d69413ce1", "988a065b2ffb9afb", "a1584f3614f6beb9", "a4958c9377c2b03c", "b727dbcca54aaad0" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4719", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "804f238448f0cb53" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4723", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "e7b198e789b4c2ed" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4724", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "64e1a28f1b436a9f" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4742", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "6b88a3f3eae6bdb3" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4754", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "f4e13cf24c34dad2" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4768", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "c79348b87e8daf7e" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4769", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "da605c4bd1c73fec" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4770", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "abb4c2ea6f91aac8" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4771", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "0db694d9e47b53aa" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4776", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "0ebf352d9fe8353b" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4798", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "938d125597928bf4" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4799", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "938d125597928bf4" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4872", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "7e0bd0df0fab299b" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4946", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "4c5ff41d997879b6" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4948", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "4c5ff41d997879b6" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4957", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "10117fd467365fa3" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4985", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "63a5af8b26905a45" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5058", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "f15b3ef6517d4a9a" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5136", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "37061b17445fc405", "872f4509d2fc1979" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5140", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "4499214d01cdbba6", "a34f6ac20a175a66" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5379", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "fb6d940aadab993e" ], "illustrativeShapes": [] }, { "table": "SecurityEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "5712", "EventSourceName": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [ "6b77703c81a977e4" ], "illustrativeShapes": [] }, { "table": "WindowsEvent", "column": "EventData", "discriminators": { "Channel": "Security", "EventID": "4624", "Provider": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [], "illustrativeShapes": [ "a7a2a789619475ac" ] }, { "table": "WindowsEvent", "column": "RawEventData", "discriminators": { "Channel": "Security", "EventID": "4624", "Provider": "Microsoft-Windows-Security-Auditing" }, "observedShapes": [], "illustrativeShapes": [ "0799e61427792c46" ] } ], "knownActions": [ { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AccountCheckedForBlankPassword" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusDefinitionsUpdateFailed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusDefinitionsUpdated" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusDetection" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusEmergencyUpdatesInstalled" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusError" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusMalwareActionFailed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusMalwareBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusReport" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanCancelled" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanCompleted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusScanFailed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AntivirusTroubleshootModeEvent" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlAppInstallationAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlAppInstallationBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCIScriptAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCIScriptBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityDriverRevoked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityImageAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityImageRevoked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityOriginAllowed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityOriginAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityOriginBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityPolicyAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityPolicyBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegrityPolicyLoaded" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlCodeIntegritySigningInformation" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlExecutableAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlExecutableBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlPackagedAppAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlPackagedAppBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlPolicyApplied" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlScriptAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppControlScriptBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardBrowseToUrl" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardCreateContainer" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardLaunchedWithUrl" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardResumeContainer" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardStopContainer" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppGuardSuspendContainer" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockExecutable" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockPackagedApp" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockPackagedAppInstallation" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AppLockerBlockScript" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAbusedSystemToolAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAbusedSystemToolBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAbusedSystemToolWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAdobeReaderChildProcessAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAdobeReaderChildProcessBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrAdobeReaderChildProcessWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableEmailContentAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableEmailContentBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableEmailContentWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableOfficeContentAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableOfficeContentBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrExecutableOfficeContentWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrLsassCredentialTheftWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrObfuscatedScriptAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrObfuscatedScriptBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrObfuscatedScriptWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeChildProcessAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeChildProcessBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeChildProcessWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeCommAppChildProcessAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeCommAppChildProcessBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeCommAppChildProcessWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeMacroWin32ApiCallsAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeMacroWin32ApiCallsBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeMacroWin32ApiCallsWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeProcessInjectionAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeProcessInjectionBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrOfficeProcessInjectionWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPersistenceThroughWmiAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPersistenceThroughWmiBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPersistenceThroughWmiWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPsexecWmiChildProcessAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPsexecWmiChildProcessBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrPsexecWmiChildProcessWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrRansomwareAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrRansomwareBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrRansomwareWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrSafeModeRebootAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrSafeModeRebootBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrSafeModeRebootWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrScriptExecutableDownloadAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrScriptExecutableDownloadBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrScriptExecutableDownloadWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedExecutableAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedExecutableBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedExecutableWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedUsbProcessAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedUsbProcessBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrUntrustedUsbProcessWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrVulnerableSignedDriverAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrVulnerableSignedDriverBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrVulnerableSignedDriverWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrWebShellOnServerAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrWebShellOnServerBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AsrWebShellWarnBypassed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "AuditPolicyModification" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BitLockerAuditCompleted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BluetoothPolicyTriggered" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BrowserLaunchedToOpenUrl" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "BruteForceActivityDetected" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CertificateServicesApprovedCertificateRequest" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CertificateServicesLoadedTemplate" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CertificateServicesReceivedCertificateRequest" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ControlFlowGuardViolation" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ControlledFolderAccessViolationAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ControlledFolderAccessViolationBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CreateRemoteThreadApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "CredentialsBackup" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DeviceBootAttestationInfo" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DirectoryServiceObjectCreated" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DirectoryServiceObjectModified" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DnsQueryResponse" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DpapiAccessed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "DriverLoad" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardAcgAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardAcgEnforced" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardChildProcessAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardChildProcessBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardEafViolationAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardEafViolationBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardIafViolationAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardIafViolationBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardLowIntegrityImageAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardLowIntegrityImageBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNetworkProtectionAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNetworkProtectionBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNonMicrosoftSignedAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardNonMicrosoftSignedBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardRopExploitAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardRopExploitBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardSharedBinaryAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardSharedBinaryBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardWin32SystemCallAudited" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExploitGuardWin32SystemCallBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExternalDeviceConnected" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ExternalDeviceDisconnected" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FileTimestampModificationEvent" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallInboundConnectionBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallInboundConnectionToAppBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallOutboundConnectionBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "FirewallServiceStopped" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "GetAsyncKeyStateApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "GetClipboardData" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "LdapSearch" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "LogonRightsSettingEnabled" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "MemoryRemoteProtect" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NamedPipeEvent" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkProtectionUserBypassEvent" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectAccessChecked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectAdded" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectDeleted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NetworkShareObjectModified" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtAllocateVirtualMemoryApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtAllocateVirtualMemoryRemoteApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtMapViewOfSectionRemoteApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "NtProtectVirtualMemoryApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "OpenProcessApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PTraceDetected" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PasswordChangeAttempt" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PlistPropertyModified" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PnpDeviceAllowed" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PnpDeviceBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PnpDeviceConnected" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PowerShellCommand" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "PrintJobBlocked" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ProcessCreatedUsingWmiQuery" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ProcessPrimaryTokenModified" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "QueueUserApcRemoteApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ReadProcessMemoryApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemoteDesktopConnection" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemoteWmiOperation" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemovableStorageFileEvent" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "RemovableStoragePolicyTriggered" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SafeDocFileScan" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskCreated" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskDeleted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskDisabled" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskEnabled" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScheduledTaskUpdated" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ScreenshotTaken" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SecurityGroupCreated" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SecurityGroupDeleted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SecurityLogCleared" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SensitiveFileRead" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ServiceInstalled" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SetThreadContextRemoteApiCall" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "ShellLinkCreateFileEvent" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenAppWarning" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenExploitWarning" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenUrlWarning" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "SmartScreenUserOverride" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "TamperingAttempt" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UntrustedWifiConnection" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveDriveLetterChanged" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveMounted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UsbDriveUnmounted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountAddedToLocalGroup" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountCreated" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountDeleted" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountModified" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountPasswordResetAttempt" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "UserAccountRemovedFromLocalGroup" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "WmiBindEventFilterToConsumer" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" }, { "table": "DeviceEvents", "column": "AdditionalFields", "discriminators": { "ActionType": "WriteToLsassProcessMemory" }, "sourcePath": "content/ActionTypeSchema-latest.json", "sourceUrl": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceevents-table" } ] }