ThreatIntelExportOperation

ThreatIntelExportOperation Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel Threat Intelligence Export Operation Logs.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
_ResourceId A unique identifier for the resource that the record is associated with String
_SubscriptionId A unique identifier for the subscription that the record is associated with String
DestinationInfo Additional information about the export destination depending on ExportType. Object
ErrorDetails Additional information when Status is ‘Failure’ / ‘Timeout’. String
ExportDuration The total time, in milliseconds, taken to complete the export operation. Int32
ExportedBy The user who initiated the export operation (email address). String
ExportId A value that uniquely identifies the Export operation. String
ExportType Represents the export destination type. e.g. TAXII String
ExternallyExportedId The unique identifier of the exported object. String
Id A Sentinel internal unique identifier that identifies a STIX object and can be used with Sentinel APIs. String
SourceSystem The name of the STIX object source. String
Status Status of the export operation, possible values: ‘Success’, ‘Failure’, ‘Timeout’. String
StixId A globally unique identifier that identifies a STIX object. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeExported The time of export to destination (UTC). DateTime
TimeGenerated The timestamp of when the log entry was generated (UTC). DateTime
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking