LLMActivity

LLMActivity Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel Audit logs for Copilot and other AI workloads. Extensible for future AI audit types.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
ActorName User principal name or email address. String
ActorUserId Internal user key or GUID. String
ActorUserType Type of user (e.g., Regular, Admin, System). String
AgentId The version number or version ID of the agent involved. String
AgentName A friendly readable name of the agent. String
AIModelName Name of the AI model used (for extensibility). String
AIModelVersion Version of the AI model used. String
AppHost Application that hosts copilot. String
AppIdentity Identity of the application hosting the copilot interaction. String
ClientRegion Region of the client. String
LLMEventData Parsed LLM event data (for copilot different RecordTypes). Object
LogVersion Version of the LLM log format. String
OrganizationId Organization GUID. String
RecordId Unique identifier for the audit record. String
RecordType Normalized record type name (e.g., CopilotInteraction, UpdateCopilotSettings). String
SourceSystem String
SrcIpAddr IP address of the client. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated Timestamp of the audit event. DateTime
Type The name of the table String
Version Version of the audit schema or event. String
Workload The workload or product (e.g., Copilot, AzureOpenAI). String

Schema changes #

Date Action
2026-01-02 Table added to tracking