SecurityIncident Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Usx		Microsoft Sentinel	Incidents generated by security products.	Sentinel

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
AdditionalData	Additional data on the incident	Object
AlertIds	The IDs of the alerts related to the incident	Object
BookmarkIds	The IDs of the bookmarks related to the incident	Object
Classification	The classification the incident was given when closed	String
ClassificationComment	Description of the reason the incident was closed	String
ClassificationReason	The classification reason the incident was given when closed	String
ClosedTime	Timestamp (UTC) of when the incident was last closed	DateTime
Comments	The comments added to the incident	Object
CreatedTime	Timestamp (UTC) of when the incident was created	DateTime
Description	Description of the information gathered	String
FirstActivityTime	Timestamp (UTC) of when the first activity in the incident occured	DateTime
FirstModifiedTime	Timestamp (UTC) of when the incident was first modified	DateTime
IncidentName	The resource name of the incident	String
IncidentNumber	The sequential number of the incident	Int32
IncidentUrl	The URI to open the incident in Azure Sentinel portal	String
Labels	The labels added to the incident	Object
LastActivityTime	Timestamp (UTC) of when the last activity in the incident occured	DateTime
LastModifiedTime	Date and time the item or related metadata was last modified	DateTime
ModifiedBy	The source of the change in the incident	String
Owner	The user the incident is assigned to	Object
ProviderIncidentId	The incident ID assigned by the incident provider	String
ProviderName	The name of the source provider that generated the incident	String
RelatedAnalyticRuleIds	The IDs of the Analytic rules associated with the incident	Object
Severity	Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert	String
SourceSystem		String
Status	Indicator of the profile status - can be Enabled or Disabled	String
Tasks	The tasks added to the incident	Object
TenantId	Unique identifier of the tenant into which the data connector ingests data.	String
TimeGenerated	Timestamp (UTC) of when the incident was ingested	DateTime
Title	Title of the alert	String
Type	The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other	String

Schema changes

Date	Action
2026-10-07	Table added to tracking
2026-02-27	Table removed from tracking
2024-10-18	Table added to tracking

SecurityIncident Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Usx		Microsoft Sentinel	Incidents generated by security products.	Sentinel

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
AdditionalData	Additional data on the incident	Object
AlertIds	The IDs of the alerts related to the incident	Object
BookmarkIds	The IDs of the bookmarks related to the incident	Object
Classification	The classification the incident was given when closed	String
ClassificationComment	Description of the reason the incident was closed	String
ClassificationReason	The classification reason the incident was given when closed	String
ClosedTime	Timestamp (UTC) of when the incident was last closed	DateTime
Comments	The comments added to the incident	Object
CreatedTime	Timestamp (UTC) of when the incident was created	DateTime
Description	Description of the information gathered	String
FirstActivityTime	Timestamp (UTC) of when the first activity in the incident occured	DateTime
FirstModifiedTime	Timestamp (UTC) of when the incident was first modified	DateTime
IncidentName	The resource name of the incident	String
IncidentNumber	The sequential number of the incident	Int32
IncidentUrl	The URI to open the incident in Azure Sentinel portal	String
Labels	The labels added to the incident	Object
LastActivityTime	Timestamp (UTC) of when the last activity in the incident occured	DateTime
LastModifiedTime	Date and time the item or related metadata was last modified	DateTime
ModifiedBy	The source of the change in the incident	String
Owner	The user the incident is assigned to	Object
ProviderIncidentId	The incident ID assigned by the incident provider	String
ProviderName	The name of the source provider that generated the incident	String
RelatedAnalyticRuleIds	The IDs of the Analytic rules associated with the incident	Object
Severity	Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert	String
SourceSystem		String
Status	Indicator of the profile status - can be Enabled or Disabled	String
Tasks	The tasks added to the incident	Object
TenantId	Unique identifier of the tenant into which the data connector ingests data.	String
TimeGenerated	Timestamp (UTC) of when the incident was ingested	DateTime
Title	Title of the alert	String
Type	The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other	String

Schema changes

Date	Action
2026-10-07	Table added to tracking
2026-02-27	Table removed from tracking
2024-10-18	Table added to tracking