AWSEKSLogs

AWSEKSLogs Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel AWS EKS audit logs, which ingested from Sentinel’s connector, contain detailed information about API server requests, authentication decisions, and cluster activities from Amazon Elastic Kubernetes Service. These logs provide comprehensive security monitoring and compliance tracking for Kubernetes clusters.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AuthDecision The authorization decision made by the Kubernetes RBAC system (e.g., allow, forbid). String
AwsAccountId The AWS account ID where the EKS cluster is located. String
ClusterName The name of the EKS cluster that generated the audit event. String
ObjectRef Reference to the Kubernetes object that was accessed (namespace/resource/name). String
RawEvent The complete raw EKS audit event data containing additional context and metadata. Object
Region The AWS region where the EKS cluster is located. String
ResponseCode The HTTP response status code of the API request. Int32
SourceIPs Array of source IP addresses from where the request originated. Object
SourceSystem String
Stage The stage of request processing when the audit event was generated (e.g., RequestReceived, ResponseComplete). String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The timestamp (UTC) when the EKS audit event was generated. DateTime
Type The name of the table String
User The user or service account that performed the action. String
UserAgent The user agent string of the client that made the request. String
Verb The Kubernetes API verb (action) performed (e.g., get, create, update, delete). String

Schema changes #

Date Action
2026-02-15 Table added to tracking