McasShadowItReporting Schema #
Table description #
| TableSection | TableType | TableSectionName | Description |
|---|---|---|---|
| Usx | Regular | Microsoft Sentinel | McasShadowItReporting |
Table retention #
| HotDays | ColdDays | TotalInteractiveDays |
|---|---|---|
| 14 | 76 | 90 |
Schema #
| Name | Description | Type |
|---|---|---|
| _BilledSize | Double | |
| _IsBillable | String | |
| AadTenantId | String | |
| AppCategory | String | |
| AppId | String | |
| AppInstance | String | |
| AppName | The application’s display name as exposed by the associated service principal | String |
| AppScore | Int32 | |
| AppTags | Object | |
| BlockedEvents | Int32 | |
| Date | DateTime | |
| DownloadedBytes | Int32 | |
| EnrichedUserName | String | |
| IpAddress | String | |
| MachineId | Unique identifier for the machine in the service | String |
| MachineName | String | |
| RawUserName | String | |
| RichUserName | String | |
| SourceSystem | String | |
| StreamName | String | |
| TenantId | String | |
| TimeGenerated | DateTime | |
| TotalBytes | Int32 | |
| TotalEvents | Int32 | |
| Type | The name of the table | String |
| UploadedBytes | Int32 | |
| UserName | String |
Schema changes #
| Date | Action |
|---|---|
| 2024-10-18 | Table added to tracking |