| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| _ResourceId |
A unique identifier for the resource that the record is associated with |
String |
| _SubscriptionId |
A unique identifier for the subscription that the record is associated with |
String |
| ActingAppId |
The ID of the application that initiated the activity reported, including a process, browser, or service. |
String |
| ActingAppName |
The name of the application that initiated the activity reported, including a service, a URL, or a SaaS application. |
String |
| ActingAppType |
The type of acting application. |
String |
| ActingOriginalAppType |
The acting application type as reported by the reporting device. |
String |
| ActorOriginalUserType |
The user type as reported by the reporting device. |
String |
| ActorScope |
The scope, such as Azure AD tenant, in which ActorUserId and ActorUsername are defined. |
String |
| ActorScopeId |
The scope ID, such as Azure AD tenant ID, in which ActorUserId and ActorUsername are defined. |
String |
| ActorSessionId |
The unique ID of the sign-in session of the Actor. |
String |
| ActorUserAadId |
The Azure Active Directory ID of the actor. |
String |
| ActorUserId |
A machine-readable, alphanumeric, unique representation of the actor. |
String |
| ActorUserIdType |
The type of the ID stored in the ActorUserId field. |
String |
| ActorUsername |
The Actor’s username, including domain information when available. |
String |
| ActorUsernameType |
The type of the Actor’s username specified in ActionUsername field |
String |
| ActorUserSid |
The Windows user ID (SIDs) of the actor. |
String |
| ActorUserType |
The type of the Actor. |
String |
| AdditionalFields |
Additional information, represented using key/value pairs provided by the source which do not map to ASim. |
Object |
| DvcAction |
For reporting security systems, the action taken by the system. |
String |
| DvcDescription |
A descriptive text associated with the device. |
String |
| DvcDomain |
The domain of the device reporting the event. |
String |
| DvcDomainType |
The type of DvcDomain. |
String |
| DvcFQDN |
The hostname of the device on which the event occurred or which reported the event. |
String |
| DvcHostname |
The hostname of the device reporting the event. |
String |
| DvcId |
The unique ID of the device on which the event occurred or which reported the event. |
String |
| DvcIdType |
The type of DvcId. |
String |
| DvcInterface |
The network interface on which data was captured. |
String |
| DvcIpAddr |
The IP Address of the device reporting the event. |
String |
| DvcMacAddr |
The MAC address of the device on which the event occurred or which reported the event. |
String |
| DvcOriginalAction |
The original DvcAction as provided by the reporting device. |
String |
| DvcOs |
The operating system running on the device on which the event occurred or which reported the event. |
String |
| DvcOsVersion |
The version of the operating system on the device on which the event occurred or which reported the event. |
String |
| DvcScope |
The cloud platform scope the device belongs to. DvcScope map to a subscription ID on Azure and to an account ID on AWS. |
String |
| DvcScopeId |
The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS. |
String |
| DvcZone |
The network on which the event occurred or which reported the event. |
String |
| EventCount |
The number of events described by the record. |
Int32 |
| EventEndTime |
The time (UTC) in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field. |
DateTime |
| EventMessage |
A general message or description. |
String |
| EventOriginalResultDetails |
The original result details provided by the source. |
String |
| EventOriginalSeverity |
The original severity as provided by the reporting device. |
String |
| EventOriginalSubType |
The original event subtype or ID, if provided by the source. |
String |
| EventOriginalType |
The original event type or ID, if provided by the source. |
String |
| EventOriginalUid |
A unique ID of the original record, if provided by the source. |
String |
| EventOwner |
The owner of the event, which is usually the department or subsidiary in which it was generated. |
String |
| EventProduct |
The product generating the event. |
String |
| EventProductVersion |
The version of the product generating the event. |
String |
| EventReportUrl |
A URL provided in the event for a resource that provides more information about the event. |
String |
| EventResult |
The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field. |
String |
| EventResultDetails |
Reason or details for the result reported in the EventResult field. |
String |
| EventSchemaVersion |
The version of the schema. |
String |
| EventSeverity |
The severity of the event. Valid values are: Informational, Low, Medium, or High. |
String |
| EventStartTime |
The time (UTC) in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field. |
DateTime |
| EventSubType |
Describes a subdivision of the operation reported in the EventType field. |
String |
| EventType |
Describes the operation reported by the record |
String |
| EventVendor |
The vendor of the product generating the event. |
String |
| HttpUserAgent |
When authentication is performed over HTTP or HTTPS, this field’s value is the user_agent HTTP header provided by the acting application when performing the authentication. |
String |
| NewValue |
The new value of Object after the operation was performed. |
String |
| Object |
The name of the object on which the operation identified by EventType is performed. |
String |
| ObjectId |
The name of the object on which the operation identified by EventType is performed. |
String |
| ObjectType |
The type of Object. |
String |
| OldValue |
The old value of Object prior to the operation. |
String |
| Operation |
The operation audited as reported by the reporting device. |
String |
| OriginalObjectType |
The object type as reported by the reporting device. |
String |
| RuleName |
The name or ID of the rule associated with the inspection results. |
String |
| RuleNumber |
The number of the rule associated with the inspection results. |
Int32 |
| SourceSystem |
|
String |
| SrcDescription |
A descriptive text associated with the source device. |
String |
| SrcDeviceType |
The type of the source device. |
String |
| SrcDomain |
The domain of the source device. |
String |
| SrcDomainType |
The type of SrcDomain. |
String |
| SrcDvcId |
The ID of the source device. |
String |
| SrcDvcIdType |
The type of SrcDvcId. |
String |
| SrcDvcScope |
The cloud platform scope the source device belongs to. SrcDvcScope map to a subscription ID on Azure and to an account ID on AWS. |
String |
| SrcDvcScopeId |
The cloud platform scope ID the source device belongs to. SrcDvcScopeId map to a subscription ID on Azure and to an account ID on AWS. |
String |
| SrcFQDN |
The source device hostname, including domain information when available. |
String |
| SrcGeoCity |
The city associated with the source IP address. |
String |
| SrcGeoCountry |
The country associated with the source IP address. |
String |
| SrcGeoLatitude |
The latitude of the geographical coordinate associated with the source IP address. |
Double |
| SrcGeoLongitude |
The longitude of the geographical coordinate associated with the source IP address. |
Double |
| SrcGeoRegion |
The region within a country associated with the source IP address. |
String |
| SrcHostname |
The source device hostname, excluding domain information. |
String |
| SrcIpAddr |
The Source IP address from which the connection or session originated. |
String |
| SrcOriginalRiskLevel |
The risk level associaeted with the identified Source as reported by the reporting device. |
String |
| SrcPortNumber |
The Source IP port from which the connection originated. |
Int32 |
| SrcRiskLevel |
The risk level associated with the identified Source. |
Int32 |
| TargetAppId |
The ID of the application to which the event applies, including a process, browser, or service. |
String |
| TargetAppName |
The name of the application to which event applies, including a service, a URL, or a SaaS application. |
String |
| TargetAppType |
The type of the application authorizing on behalf of the Actor. |
String |
| TargetDescription |
A descriptive text associated with the target device. |
String |
| TargetDeviceType |
The type of the target device. |
String |
| TargetDomain |
The domain of the target device. |
String |
| TargetDomainType |
The type of TargetDomain. |
String |
| TargetDvcId |
The ID of the target device. |
String |
| TargetDvcIdType |
The type of TargetDvcId. |
String |
| TargetDvcOs |
The OS of the target device. |
String |
| TargetDvcScope |
The cloud platform scope the target device belongs to. TargetDvcScope map to a subscription ID on Azure and to an account ID on AWS. |
String |
| TargetDvcScopeId |
The cloud platform scope ID the target device belongs to. TargetDvcScopeId map to a subscription ID on Azure and to an account ID on AWS. |
String |
| TargetFQDN |
The target device hostname, including domain information when available. |
String |
| TargetGeoCity |
The city associated with the target IP address. |
String |
| TargetGeoCountry |
The country associated with the target IP address. |
String |
| TargetGeoLatitude |
The latitude of the geographical coordinate associated with the target IP address. |
Double |
| TargetGeoLongitude |
The longitude of the geographical coordinate associated with the target IP address. |
Double |
| TargetGeoRegion |
The region within a country associated with the target IP address. |
String |
| TargetHostname |
The target device hostname, excluding domain information. |
String |
| TargetIpAddr |
The Target IP address from which the connection or session originated. |
String |
| TargetOriginalAppType |
The target application type as reported by the reporting device. |
String |
| TargetOriginalRiskLevel |
The risk level associated with the target, as reported by the reporting device. |
String |
| TargetPortNumber |
The Target IP port from which the connection originated. |
Int32 |
| TargetRiskLevel |
The risk level associated with the target. |
Int32 |
| TargetUrl |
A URL associated with the target application. |
String |
| TenantId |
|
String |
| ThreatCategory |
The category of the threat or malware identified in audit activity. |
String |
| ThreatConfidence |
The confidence level of the threat identified, normalized to a value between 0 and a 100. |
Int32 |
| ThreatField |
The field for which a threat was identified. |
String |
| ThreatFirstReportedTime |
The first time the IP address or domain were identified as a threat. |
DateTime |
| ThreatId |
The ID of the threat or malware identified in the audit activity. |
String |
| ThreatIpAddr |
An IP address or Domain for which a threat was identified. |
String |
| ThreatIsActive |
True if the threat identified is considered an active threat. |
Boolean |
| ThreatLastReportedTime |
The last time the IP address or domain were identified as a threat. |
DateTime |
| ThreatName |
The name of the threat or malware identified in the audit activity. |
String |
| ThreatOriginalConfidence |
The original confidence level of the threat identified, as reported by the reporting device. |
String |
| ThreatOriginalRiskLevel |
The risk level as reported by the reporting device. |
String |
| ThreatRiskLevel |
The risk level associated with the identified threat. The level should be a number between 0 and 100. |
Int32 |
| TimeGenerated |
The timestamp (UTC) reflecting the time in which the event was generated. |
DateTime |
| Type |
The name of the table |
String |
| ValueType |
The type of the old and new values. |
String |