WindowsEvent

WindowsEvent Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel Windows events which are collected and sent by the agent.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
_ResourceId A unique identifier for the resource that the record is associated with String
_SubscriptionId A unique identifier for the subscription that the record is associated with String
Channel The channel to which the event was logged. String
Computer The name of the computer on which the event occurred. String
Correlation The activity identifiers that consumers can use to group related events together. String
EventData Contains the event data parsed to dynamic type. If the parsing fails then this field will contain null and the RawEventData field will be populated. Object
EventID The identifier that the provider used to identify the event. Int32
EventLevel Contains the severity level of the event. Int32
EventLevelName The rendered message string of the level specified in the event. String
EventOriginId VM ID obtained from the Azure Instance Metadata Service (IMDS). String
EventRecordId The record number assigned to the event when it was logged. String
Keywords A bitmask of the keywords defined in the event. String
ManagementGroupName Additional information based on the resource type. String
Opcode The opcode element is defined by the SystemPropertiesType complex type. String
Provider System Properties Type - Identifies the provider that logged the event. String
RawEventData The raw event XML when parsing fails. It’s null when parsing successful. String
SystemProcessId Identifies the process that generated the event. Int32
SystemThreadId Identifies the thread that generated the event. Int32
SystemUserId The ID of the user who is responsible for the event. String
Task The task defined in the event. Int32
TenantId String
TimeGenerated The time stamp when the event was generated on the computer. DateTime
Type The name of the table String
Version Contains the version number of the event’s definition. Int32

Schema changes #

Date Action
2024-10-18 Table added to tracking