| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| AccountId |
An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers. |
String |
| Action |
Action taken on the entity |
String |
| AzId |
The ID of the Availability Zone. |
String |
| Bytes |
The number of bytes transferred during the flow. |
Int64 |
| DstAddr |
The destination address for outgoing traffic. |
String |
| DstPort |
The destination port of the traffic. |
Int32 |
| EcsClusterArn |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsClusterName |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsContainerId |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsContainerInstanceArn |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsContainerInstanceId |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsSecondContainerId |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsServiceName |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsTaskArn |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsTaskDefinitionArn |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| EcsTaskId |
Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. |
String |
| End |
The time when the last packet of the flow was received within the aggregation interval. |
DateTime |
| FlowDirection |
The direction of the flow with respect to the interface where traffic is captured. |
String |
| InstanceId |
The ID of the instance that’s associated with network interface for which the traffic is recorded. |
String |
| InterfaceId |
The ID of the network interface for which the traffic is recorded. |
String |
| LogStatus |
The logging status of the flow log. |
String |
| Packets |
The number of packets transferred during the flow. |
Int32 |
| PktDstAddr |
The packet-level (original) destination IP address for the traffic. |
String |
| PktDstAwsService |
The name of the subset of IP address ranges for the PktDstAddr field, if the destination IP address is for an AWS service. |
String |
| PktSrcAddr |
The packet-level (original) source IP address of the traffic. |
String |
| PktSrcAwsService |
The name of the subset of IP address ranges for the PktSrcAddr field, if the source IP address is for an AWS service. |
String |
| Protocol |
Protocol used during the communication |
Int32 |
| Region |
The Region that contains the network interface for which traffic is recorded. |
String |
| SourceSystem |
|
String |
| SrcAddr |
The source address for incoming traffic. |
String |
| SrcPort |
The source port of the traffic. |
Int32 |
| Start |
The remote ip of the request. |
DateTime |
| SublocationId |
The ID of the sublocation that contains the network interface for which traffic is recorded. |
String |
| SublocationType |
The type of sublocation that is returned in the sublocationId field. |
String |
| SubnetId |
The ID of the subnet. |
String |
| TcpFlags |
The bitmask value for the following TCP flags. |
Int32 |
| TenantId |
Unique identifier of the tenant into which the data connector ingests data. |
String |
| TimeGenerated |
The timestamp (UTC) of when the event was generated. This value will be the same as ‘start’ input field or the data arrival time to Azure Monitor in case the ‘start’ input field is empty or missing. |
DateTime |
| TrafficPath |
The path that egress traffic takes to the destination. |
String |
| TrafficType |
The type of traffic. The possible values are: IPv4, IPv6, and EFA. For more information search for ‘Elastic Fabric Adapter (EFA)’. |
String |
| Type |
The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other |
String |
| Version |
Version of the agent. |
Int32 |
| VpcId |
The ID of the VPC. |
String |