← Browse all tablesLoading table information…
Contribute structured examples for this table using the PowerShell tool. Submit a synthetic example.
McasShadowItReporting Schema
Table description
| TableSection |
TableType |
TableSectionName |
Description |
Source |
| Usx |
|
Microsoft Sentinel |
McasShadowItReporting |
Sentinel |
Schema
| Name |
Description |
Type |
| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| AadTenantId |
|
String |
| AppCategory |
|
String |
| AppId |
|
String |
| AppInstance |
|
String |
| AppName |
The application’s display name as exposed by the associated service principal |
String |
| AppScore |
|
Int32 |
| AppTags |
|
Object |
| BlockedEvents |
|
Int32 |
| Date |
|
DateTime |
| DownloadedBytes |
|
Int32 |
| EnrichedUserName |
|
String |
| IpAddress |
IP address that the attacker attempted to access |
String |
| MachineId |
Unique identifier for the machine in the service |
String |
| MachineName |
|
String |
| RawUserName |
|
String |
| RichUserName |
|
String |
| SourceSystem |
|
String |
| StreamName |
|
String |
| TenantId |
Unique identifier of the tenant into which the data connector ingests data. |
String |
| TimeGenerated |
|
DateTime |
| TotalBytes |
|
Int32 |
| TotalEvents |
|
Int32 |
| Type |
The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other |
String |
| UploadedBytes |
|
Int32 |
| UserName |
|
String |
Schema changes
| Date |
Action |
| 2026-10-07 |
Table added to tracking |
| 2026-02-27 |
Table removed from tracking |
| 2024-10-18 |
Table added to tracking |