HuntingBookmark

HuntingBookmark Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel Azure sentinel hunting bookmarks audit table

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
_ResourceId A unique identifier for the resource that the record is associated with String
_SubscriptionId A unique identifier for the subscription that the record is associated with String
BookmarkId Guid - the bookmark ARM resource name String
BookmarkName Bookmark name given by the user String
BookmarkType Can be used to mark bookmark origin - currently not used String
CreatedBy JSON object with the user who created the bookmark, including: ObjectID, email and name String
CreatedTime The timestamp of bookmark first creation time DateTime
Entities A serialized JSON of entities mapped by this bookmark String
EventTime The timestamp of the original event that is bookmarked DateTime
LastUpdatedTime The timestamp of bookmark last update time DateTime
Notes Notes provided by user String
QueryEndTime Query time range end time DateTime
QueryResultRow JSON object with a single result row of the query String
QueryStartTime Query time range start time DateTime
QueryText Original log analytics query text String
SoftDeleted Was the bookmark deleted by user Boolean
SourceSystem String
Tags Comma seperated list of tags provided by user String
TenantId String
TimeGenerated The timestamp (UTC) of the log DateTime
Type The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other String
UpdatedBy JSON object with the user who last updated the bookmark, including: ObjectID, email and name String

Schema changes #

Date Action
2024-10-18 Table added to tracking