Audit logs for operations performed on Azure Sentinel resources, such as Data Connectors, Analytic Rules and more. These logs can be used to audit operations on your Sentinel resources.
Sentinel
Schema
Name
Description
Type
_BilledSize
Double
_IsBillable
String
CorrelationId
Unique identifier of the sign-in event
String
Description
Description of the information gathered
String
ExtendedProperties
Additional information based on the resource type.
Object
OperationName
Audit event operation name as appeared in the raw event schema. Usually includes both resource type and operation
String
SentinelResourceId
The Sentinel resource ID.
String
SentinelResourceKind
The resource kind, for example: connector kind (such as Office365, AmazonWebServicesCloudTrail), alert rule kind (scheduld).
String
SentinelResourceName
The Sentinel resource name.
String
SentinelResourceType
The resource type, for example: DataConnector, AlertRule, etc.
String
SourceSystem
String
Status
Indicator of the profile status - can be Enabled or Disabled
String
TenantId
Unique identifier of the tenant into which the data connector ingests data.
String
TimeGenerated
The timestamp (UTC) of when the event was generated.
DateTime
Type
The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other