Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

Submit an example for AdditionalFields

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

EntityType ServiceSource

`AdditionalFields`

EntityType: Url · ServiceSource: Microsoft Defender for Endpoint

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Role": 1,
  "Type": "VALUE_3",
  "Url": "https://example.invalid/SAMPLE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Type`	string
`$.Url`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "AccountName": "USERNAME_1",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000002"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.AccountName`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: DNS · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DomainName": "COMPUTERNAME_1",
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.DomainName`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Url · ServiceSource: App Governance

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Role": 1,
  "Roles": [
    "VALUE_3"
  ],
  "Type": "VALUE_4",
  "Url": "https://example.invalid/SAMPLE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$.Url`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: MailMessage · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AntispamDirection": "VALUE_1",
  "AttachmentCount": 1,
  "DeliveryAction": "VALUE_2",
  "DeliveryLocation": "VALUE_3",
  "EntitySources": [
    "VALUE_4"
  ],
  "FirstSeen": "VALUE_5",
  "InternetMessageId": "USERNAME_1@example.invalid",
  "LastRemediationState": "VALUE_6",
  "LastVerdict": "VALUE_7",
  "MergeByKey": "VALUE_8",
  "MergeByKeyHex": "VALUE_9",
  "NetworkMessageId": "00000000-0000-4000-8000-000000000001",
  "P1Sender": "USERNAME_2@example.invalid",
  "P1SenderDisplayName": "USERNAME_1",
  "P1SenderDomain": "COMPUTERNAME_1",
  "P2Sender": "USERNAME_2@example.invalid",
  "P2SenderDisplayName": "USERNAME_2",
  "P2SenderDomain": "COMPUTERNAME_1",
  "ReceivedDate": "VALUE_10",
  "Recipient": "USERNAME_3@example.invalid",
  "RemediationProviders": [
    {
      "RemediationDate": "VALUE_11",
      "RemediationState": "VALUE_6",
      "Type": "VALUE_12"
    }
  ],
  "Role": 1,
  "Sender": "USERNAME_2@example.invalid",
  "SenderIP": "192.0.2.1",
  "Source": "VALUE_13",
  "Subject": "VALUE_14",
  "ThreatAnalysisSummary": [
    {
      "AnalysisDate": "VALUE_15",
      "AnalyzersResult": [
        {
          "AnalysisDate": "VALUE_16",
          "EngineReport": "VALUE_17",
          "ThreatIntelligence": {
            "ProviderName": "VALUE_13",
            "ThreatName": "VALUE_18",
            "ThreatType": "VALUE_19"
          },
          "Verdict": "VALUE_7"
        }
      ],
      "Verdict": "VALUE_7"
    }
  ],
  "ThreatIntelligence": [
    {
      "ProviderName": "VALUE_13",
      "ThreatName": "VALUE_18",
      "ThreatType": "VALUE_19"
    }
  ],
  "Threats": [
    "VALUE_18"
  ],
  "Type": "VALUE_20",
  "UrlCount": 1,
  "Urls": [
    "https://example.invalid/SAMPLE_1"
  ],
  "Urn": "VALUE_21"
}

Payload fields and types

Path	Type
`$`	object
`$.AntispamDirection`	string
`$.AttachmentCount`	integer
`$.DeliveryAction`	string
`$.DeliveryLocation`	string
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.InternetMessageId`	string
`$.LastRemediationState`	string
`$.LastVerdict`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.NetworkMessageId`	string
`$.P1Sender`	string
`$.P1SenderDisplayName`	string
`$.P1SenderDomain`	string
`$.P2Sender`	string
`$.P2SenderDisplayName`	string
`$.P2SenderDomain`	string
`$.ReceivedDate`	string
`$.Recipient`	string
`$.RemediationProviders`	array
`$.RemediationProviders[]`	object
`$.RemediationProviders[].RemediationDate`	string
`$.RemediationProviders[].RemediationState`	string
`$.RemediationProviders[].Type`	string
`$.Role`	integer
`$.Sender`	string
`$.SenderIP`	string
`$.Source`	string
`$.Subject`	string
`$.ThreatAnalysisSummary`	array
`$.ThreatAnalysisSummary[]`	object
`$.ThreatAnalysisSummary[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult`	array
`$.ThreatAnalysisSummary[].AnalyzersResult[]`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].EngineReport`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ProviderName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatType`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].Verdict`	string
`$.ThreatAnalysisSummary[].Verdict`	string
`$.ThreatIntelligence`	array
`$.ThreatIntelligence[]`	object
`$.ThreatIntelligence[].ProviderName`	string
`$.ThreatIntelligence[].ThreatName`	string
`$.ThreatIntelligence[].ThreatType`	string
`$.Threats`	array
`$.Threats[]`	string
`$.Type`	string
`$.UrlCount`	integer
`$.Urls`	array
`$.Urls[]`	string
`$.Urn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: CloudApplication · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AppId": 1,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.AppId`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: File · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "Host": {
    "$id": "1",
    "Asset": false,
    "HostName": "VALUE_1",
    "IsDomainJoined": false,
    "MachineId": "VALUE_2",
    "MachineIdType": 1,
    "MergeByKey": "VALUE_3",
    "MergeByKeyHex": "VALUE_4",
    "RbacScopes": {
      "ScopesPerType": {
        "Mde_MachineGroupIds": {
          "Mode": "VALUE_5",
          "Scopes": [
            "1"
          ]
        },
        "Workloads": {
          "Mode": "VALUE_5",
          "Scopes": [
            "VALUE_6"
          ]
        }
      }
    },
    "Role": 1,
    "Tags": [
      {
        "ProviderName": "VALUE_7",
        "TagId": "VALUE_8",
        "TagName": "VALUE_8",
        "TagType": "VALUE_9"
      }
    ],
    "Type": "VALUE_12"
  },
  "MergeByKey": "VALUE_13",
  "MergeByKeyHex": "VALUE_14",
  "Name": "USERNAME_1",
  "Role": 1,
  "Type": "VALUE_15"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.Host`	object
`$.Host.Asset`	boolean
`$.Host.HostName`	string
`$.Host.IsDomainJoined`	boolean
`$.Host.MachineId`	string
`$.Host.MachineIdType`	integer
`$.Host.MergeByKey`	string
`$.Host.MergeByKeyHex`	string
`$.Host.RbacScopes`	object
`$.Host.RbacScopes.ScopesPerType`	object
`$.Host.RbacScopes.ScopesPerType.Mde_MachineGroupIds`	object
`$.Host.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Mode`	string
`$.Host.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes`	array
`$.Host.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	encoded-json
`$.Host.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	string
`$.Host.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]::<json>`	integer
`$.Host.RbacScopes.ScopesPerType.Workloads`	object
`$.Host.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.Host.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.Host.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Host.Role`	integer
`$.Host.Tags`	array
`$.Host.Tags[]`	object
`$.Host.Tags[].ProviderName`	string
`$.Host.Tags[].TagId`	string
`$.Host.Tags[].TagName`	string
`$.Host.Tags[].TagType`	string
`$.Host.Type`	string
`$.Host["$id"]`	encoded-json
`$.Host["$id"]`	string
`$.Host["$id"]::<json>`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Ip · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Address": "VALUE_1",
  "EntitySources": [
    "VALUE_2"
  ],
  "FirstSeen": "VALUE_3",
  "LastVerdict": "VALUE_4",
  "MergeByKey": "VALUE_5",
  "MergeByKeyHex": "VALUE_6",
  "Role": 1,
  "Source": "VALUE_7",
  "ThreatAnalysisSummary": [
    {
      "AnalysisDate": "VALUE_8",
      "AnalyzersResult": [],
      "Verdict": "VALUE_4"
    }
  ],
  "Type": "VALUE_9",
  "Urn": "VALUE_10"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.LastVerdict`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Source`	string
`$.ThreatAnalysisSummary`	array
`$.ThreatAnalysisSummary[]`	object
`$.ThreatAnalysisSummary[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult`	array
`$.ThreatAnalysisSummary[].Verdict`	string
`$.Type`	string
`$.Urn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: MailMessage · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AttachmentCount": 1,
  "EndTimeUtc": "2026-01-01T00:00:00Z",
  "EntitySources": [
    "VALUE_1"
  ],
  "FirstSeen": "VALUE_2",
  "InternetMessageId": "USERNAME_1@example.invalid",
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "NetworkMessageId": "00000000-0000-4000-8000-000000000001",
  "P2Sender": "USERNAME_2@example.invalid",
  "ReceivedDate": "VALUE_5",
  "Recipient": "USERNAME_3@example.invalid",
  "Role": 1,
  "Sender": "USERNAME_2@example.invalid",
  "SenderIP": "192.0.2.1",
  "Source": "VALUE_6",
  "SourceEntityId": "VALUE_7",
  "SourceEntityType": "VALUE_8",
  "SourceThreatName": "VALUE_9",
  "SourceThreatType": "VALUE_9",
  "StartTimeUtc": "2026-01-01T00:00:00Z",
  "Subject": "VALUE_10",
  "Type": "VALUE_11",
  "UrlCount": 1,
  "Urls": [
    "https://example.invalid/SAMPLE_1"
  ],
  "Urn": null
}

Payload fields and types

Path	Type
`$`	object
`$.AttachmentCount`	integer
`$.EndTimeUtc`	string
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.InternetMessageId`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.NetworkMessageId`	string
`$.P2Sender`	string
`$.ReceivedDate`	string
`$.Recipient`	string
`$.Role`	integer
`$.Sender`	string
`$.SenderIP`	string
`$.Source`	string
`$.SourceEntityId`	string
`$.SourceEntityType`	string
`$.SourceThreatName`	string
`$.SourceThreatType`	string
`$.StartTimeUtc`	string
`$.Subject`	string
`$.Type`	string
`$.UrlCount`	integer
`$.Urls`	array
`$.Urls[]`	string
`$.Urn`	null

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "ObjectGuid": "00000000-0000-4000-8000-000000000001",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000002"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.ObjectGuid`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Ip · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Address": "VALUE_1",
  "Asset": false,
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "Role": 1,
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: CloudApplication · ServiceSource: App Governance

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Name": "USERNAME_1",
  "Role": 1,
  "Roles": [
    "VALUE_3"
  ],
  "SaasId": 1,
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.SaasId`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Url · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "EntitySources": [
    "VALUE_1"
  ],
  "FirstSeen": "VALUE_2",
  "LastRemediationState": "VALUE_3",
  "LastVerdict": "VALUE_4",
  "MergeByKey": "VALUE_5",
  "MergeByKeyHex": "VALUE_6",
  "RemediationProviders": [
    {
      "RemediationDate": "VALUE_7",
      "RemediationState": "VALUE_3",
      "Type": "VALUE_8"
    }
  ],
  "Role": 1,
  "Source": "VALUE_9",
  "ThreatAnalysisSummary": [
    {
      "AnalysisDate": "VALUE_10",
      "AnalyzersResult": [
        {
          "AnalysisDate": "VALUE_11",
          "EngineReport": "VALUE_12",
          "ThreatIntelligence": {
            "ProviderName": "VALUE_9",
            "ThreatName": "VALUE_13",
            "ThreatType": "VALUE_14"
          },
          "Verdict": "VALUE_4"
        }
      ],
      "Verdict": "VALUE_4"
    }
  ],
  "ThreatIntelligence": [
    {
      "ProviderName": "VALUE_9",
      "ThreatName": "VALUE_13",
      "ThreatType": "VALUE_14"
    }
  ],
  "Type": "VALUE_15",
  "Url": "https://example.invalid/SAMPLE_1",
  "Urn": "VALUE_16"
}

Payload fields and types

Path	Type
`$`	object
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.LastRemediationState`	string
`$.LastVerdict`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RemediationProviders`	array
`$.RemediationProviders[]`	object
`$.RemediationProviders[].RemediationDate`	string
`$.RemediationProviders[].RemediationState`	string
`$.RemediationProviders[].Type`	string
`$.Role`	integer
`$.Source`	string
`$.ThreatAnalysisSummary`	array
`$.ThreatAnalysisSummary[]`	object
`$.ThreatAnalysisSummary[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult`	array
`$.ThreatAnalysisSummary[].AnalyzersResult[]`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].EngineReport`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ProviderName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatType`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].Verdict`	string
`$.ThreatAnalysisSummary[].Verdict`	string
`$.ThreatIntelligence`	array
`$.ThreatIntelligence[]`	object
`$.ThreatIntelligence[].ProviderName`	string
`$.ThreatIntelligence[].ThreatName`	string
`$.ThreatIntelligence[].ThreatType`	string
`$.Type`	string
`$.Url`	string
`$.Urn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: MailCluster · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "ClusterBy": "VALUE_1",
  "ClusterByValue": "VALUE_2",
  "ClusterGroup": "VALUE_3",
  "ClusterQueryEndTime": "2026-01-01T00:00:00Z",
  "ClusterQueryStartTime": "2026-01-01T00:00:00Z",
  "ClusterSourceIdentifier": "VALUE_4",
  "ClusterSourceType": "VALUE_5",
  "CountByDeliveryLocation": {
    "JunkFolder": 1
  },
  "CountByProtectionStatus": {
    "DeliveredAsSpam": 1
  },
  "CountByThreatType": {
    "HighConfPhish": 1,
    "Malware": 1,
    "Phish": 1,
    "Spam": 1
  },
  "EntitySources": [
    "VALUE_6"
  ],
  "FirstSeen": "VALUE_7",
  "IsVolumeAnomaly": false,
  "LastVerdict": "VALUE_8",
  "MailCount": 1,
  "MergeByKey": "VALUE_9",
  "MergeByKeyHex": "VALUE_10",
  "Query": "VALUE_11",
  "QueryStartTime": "2026-01-01T00:00:00Z",
  "QueryTime": "2026-01-01T00:00:00Z",
  "Role": 1,
  "Source": "VALUE_12",
  "ThreatAnalysisSummary": [
    {
      "AnalysisDate": "VALUE_13",
      "AnalyzersResult": [
        {
          "AnalysisDate": "VALUE_14",
          "EngineReport": "VALUE_15",
          "ThreatIntelligence": {
            "ProviderName": "VALUE_12",
            "ThreatName": "VALUE_16",
            "ThreatType": "VALUE_17"
          },
          "Verdict": "VALUE_8"
        }
      ],
      "Verdict": "VALUE_8"
    }
  ],
  "ThreatIntelligence": [
    {
      "ProviderName": "VALUE_12",
      "ThreatName": "VALUE_16",
      "ThreatType": "VALUE_17"
    }
  ],
  "Type": "VALUE_18",
  "Urn": "VALUE_19"
}

Payload fields and types

Path	Type
`$`	object
`$.ClusterBy`	string
`$.ClusterByValue`	string
`$.ClusterGroup`	string
`$.ClusterQueryEndTime`	string
`$.ClusterQueryStartTime`	string
`$.ClusterSourceIdentifier`	string
`$.ClusterSourceType`	string
`$.CountByDeliveryLocation`	object
`$.CountByDeliveryLocation.JunkFolder`	integer
`$.CountByProtectionStatus`	object
`$.CountByProtectionStatus.DeliveredAsSpam`	integer
`$.CountByThreatType`	object
`$.CountByThreatType.HighConfPhish`	integer
`$.CountByThreatType.Malware`	integer
`$.CountByThreatType.Phish`	integer
`$.CountByThreatType.Spam`	integer
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.IsVolumeAnomaly`	boolean
`$.LastVerdict`	string
`$.MailCount`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Query`	string
`$.QueryStartTime`	string
`$.QueryTime`	string
`$.Role`	integer
`$.Source`	string
`$.ThreatAnalysisSummary`	array
`$.ThreatAnalysisSummary[]`	object
`$.ThreatAnalysisSummary[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult`	array
`$.ThreatAnalysisSummary[].AnalyzersResult[]`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].EngineReport`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ProviderName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatType`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].Verdict`	string
`$.ThreatAnalysisSummary[].Verdict`	string
`$.ThreatIntelligence`	array
`$.ThreatIntelligence[]`	object
`$.ThreatIntelligence[].ProviderName`	string
`$.ThreatIntelligence[].ThreatName`	string
`$.ThreatIntelligence[].ThreatType`	string
`$.Type`	string
`$.Urn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Mailbox · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Mailbox · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadId": "00000000-0000-4000-8000-000000000001",
  "AccountName": "USERNAME_1",
  "DisplayName": "USERNAME_2",
  "DomainName": "COMPUTERNAME_1",
  "EndTimeUtc": "2026-01-01T00:00:00Z",
  "EntitySources": [
    "VALUE_1"
  ],
  "FirstSeen": "VALUE_2",
  "MailboxPrimaryAddress": "USERNAME_1@example.invalid",
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "RiskLevel": "VALUE_5",
  "Role": 1,
  "Source": "VALUE_6",
  "SourceEntityId": "VALUE_7",
  "SourceEntityType": "VALUE_8",
  "SourceThreatName": "VALUE_9",
  "SourceThreatType": "VALUE_9",
  "StartTimeUtc": "2026-01-01T00:00:00Z",
  "Type": "VALUE_10",
  "Upn": "USERNAME_1@example.invalid",
  "Urn": "VALUE_11",
  "UserSid": "USERNAME_3"
}

Payload fields and types

Path	Type
`$`	object
`$.AadId`	string
`$.AccountName`	string
`$.DisplayName`	string
`$.DomainName`	string
`$.EndTimeUtc`	string
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.MailboxPrimaryAddress`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RiskLevel`	string
`$.Role`	integer
`$.Source`	string
`$.SourceEntityId`	string
`$.SourceEntityType`	string
`$.SourceThreatName`	string
`$.SourceThreatType`	string
`$.StartTimeUtc`	string
`$.Type`	string
`$.Upn`	string
`$.Urn`	string
`$.UserSid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: CloudResource · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "ResourceId": "VALUE_3",
  "Role": 1,
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.ResourceId`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Url · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5",
  "Url": "https://example.invalid/SAMPLE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string
`$.Url`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000002"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Ip · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Address": "VALUE_1",
  "Asset": false,
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "Role": 1,
  "Roles": [
    "VALUE_4"
  ],
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Machine · ServiceSource: Microsoft Defender for Endpoint

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "HostName": "VALUE_1",
  "IsDomainJoined": false,
  "MachineId": "VALUE_2",
  "MachineIdType": 1,
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "RbacScopes": {
    "ScopesPerType": {
      "MachineGroupIds": {
        "Mode": "VALUE_5",
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Mode": "VALUE_5",
        "Scopes": [
          "VALUE_6"
        ]
      }
    }
  },
  "Role": 1,
  "Tags": [
    {
      "ProviderName": "VALUE_7",
      "TagId": "VALUE_8",
      "TagName": "VALUE_8",
      "TagType": "VALUE_9"
    }
  ],
  "Type": "VALUE_12"
}

Payload fields and types

Path	Type
`$`	object
`$.HostName`	string
`$.IsDomainJoined`	boolean
`$.MachineId`	string
`$.MachineIdType`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.MachineGroupIds`	object
`$.RbacScopes.ScopesPerType.MachineGroupIds.Mode`	string
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes`	array
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes[]`	string
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Tags`	array
`$.Tags[]`	object
`$.Tags[].ProviderName`	string
`$.Tags[].TagId`	string
`$.Tags[].TagName`	string
`$.Tags[].TagType`	string
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "Asset": false,
  "DisplayName": "USERNAME_1@example.invalid",
  "InventoryIdentityId": "VALUE_1",
  "IsDomainJoined": false,
  "LastVerdict": "VALUE_2",
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "Name": "USERNAME_1",
  "Role": 1,
  "Roles": [
    "VALUE_5"
  ],
  "Sid": "S-1-5-21-100-200-300-1001",
  "ThreatAnalysisSummary": [
    {
      "AnalysisDate": "VALUE_6",
      "AnalyzersResult": [
        {
          "AnalysisDate": "VALUE_6",
          "EngineReport": "VALUE_7",
          "ThreatIntelligence": {
            "ProviderName": "VALUE_8",
            "ThreatName": "VALUE_9",
            "ThreatType": "VALUE_9"
          },
          "Verdict": "VALUE_2"
        }
      ],
      "Verdict": "VALUE_2"
    }
  ],
  "ThreatIntelligence": [
    {
      "ProviderName": "VALUE_8",
      "ThreatName": "VALUE_9",
      "ThreatType": "VALUE_9"
    }
  ],
  "Type": "VALUE_10",
  "UPNSuffix": "VALUE_11",
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.Asset`	boolean
`$.DisplayName`	string
`$.InventoryIdentityId`	string
`$.IsDomainJoined`	boolean
`$.LastVerdict`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Sid`	string
`$.ThreatAnalysisSummary`	array
`$.ThreatAnalysisSummary[]`	object
`$.ThreatAnalysisSummary[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult`	array
`$.ThreatAnalysisSummary[].AnalyzersResult[]`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].EngineReport`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ProviderName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatType`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].Verdict`	string
`$.ThreatAnalysisSummary[].Verdict`	string
`$.ThreatIntelligence`	array
`$.ThreatIntelligence[]`	object
`$.ThreatIntelligence[].ProviderName`	string
`$.ThreatIntelligence[].ThreatName`	string
`$.ThreatIntelligence[].ThreatType`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.Upn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "DisplayName": "USERNAME_1",
  "InventoryIdentityId": "VALUE_1",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "Name": "USERNAME_2",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_4",
        "Scopes": [
          "VALUE_5"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_4",
        "Scopes": [
          "00000000-0000-4000-8000-000000000002"
        ]
      }
    }
  },
  "Role": 1,
  "Sid": "S-1-5-21-100-200-300-1001",
  "Tags": [
    {
      "ProviderName": "VALUE_6",
      "TagId": "00000000-0000-4000-8000-000000000003",
      "TagName": "VALUE_7",
      "TagType": "VALUE_8"
    }
  ],
  "Type": "VALUE_9",
  "UPNSuffix": "VALUE_10"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.DisplayName`	string
`$.InventoryIdentityId`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Sid`	string
`$.Tags`	array
`$.Tags[]`	object
`$.Tags[].ProviderName`	string
`$.Tags[].TagId`	string
`$.Tags[].TagName`	string
`$.Tags[].TagType`	string
`$.Type`	string
`$.UPNSuffix`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AccountName": "USERNAME_1",
  "DisplayName": "USERNAME_2",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "NTDomain": "COMPUTERNAME_1",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.AccountName`	string
`$.DisplayName`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.NTDomain`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Machine · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "DnsDomain": "COMPUTERNAME_1",
  "HostName": "VALUE_1",
  "IsDomainJoined": false,
  "MachineId": "VALUE_2",
  "MachineIdType": 1,
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "RbacScopes": {
    "ScopesPerType": {
      "Mde_MachineGroupIds": {
        "Mode": "VALUE_5",
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Mode": "VALUE_5",
        "Scopes": [
          "VALUE_6"
        ]
      }
    }
  },
  "Role": 1,
  "Tags": [
    {
      "ProviderName": "VALUE_7",
      "TagId": "00000000-0000-4000-8000-000000000001",
      "TagName": "VALUE_8",
      "TagType": "VALUE_9"
    }
  ],
  "Type": "VALUE_10"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.DnsDomain`	string
`$.HostName`	string
`$.IsDomainJoined`	boolean
`$.MachineId`	string
`$.MachineIdType`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds`	object
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Mode`	string
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes`	array
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Tags`	array
`$.Tags[]`	object
`$.Tags[].ProviderName`	string
`$.Tags[].TagId`	string
`$.Tags[].TagName`	string
`$.Tags[].TagType`	string
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Machine · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "HostName": "VALUE_1",
  "IsDomainJoined": false,
  "MachineId": "VALUE_2",
  "MachineIdType": 1,
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_5",
        "Scopes": [
          "VALUE_6"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_5",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_7"
}

Payload fields and types

Path	Type
`$`	object
`$.HostName`	string
`$.IsDomainJoined`	boolean
`$.MachineId`	string
`$.MachineIdType`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Machine · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "DnsDomain": "COMPUTERNAME_1",
  "HostName": "VALUE_1",
  "IsDomainJoined": false,
  "MachineId": "VALUE_2",
  "MachineIdType": 1,
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "RbacScopes": {
    "ScopesPerType": {
      "Mde_MachineGroupIds": {
        "Mode": "VALUE_5",
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Mode": "VALUE_5",
        "Scopes": [
          "VALUE_6"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_7"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.DnsDomain`	string
`$.HostName`	string
`$.IsDomainJoined`	boolean
`$.MachineId`	string
`$.MachineIdType`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds`	object
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Mode`	string
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes`	array
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: MailCluster · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "ClusterBy": "VALUE_1",
  "ClusterByValue": "VALUE_2",
  "ClusterGroup": "VALUE_3",
  "ClusterQueryEndTime": "2026-01-01T00:00:00Z",
  "ClusterQueryStartTime": "2026-01-01T00:00:00Z",
  "ClusterSourceIdentifier": "VALUE_4",
  "ClusterSourceType": "VALUE_5",
  "CountByDeliveryLocation": {
    "Quarantine": 1
  },
  "CountByProtectionStatus": {
    "Blocked": 1
  },
  "CountByThreatType": {
    "HighConfPhish": 1,
    "Malware": 1,
    "Phish": 1,
    "Spam": 1
  },
  "EntitySources": [
    "VALUE_6"
  ],
  "FirstSeen": "VALUE_7",
  "IsVolumeAnomaly": false,
  "LastRemediationState": "VALUE_8",
  "LastVerdict": "VALUE_9",
  "MailCount": 1,
  "MergeByKey": "VALUE_10",
  "MergeByKeyHex": "VALUE_11",
  "Query": "VALUE_12",
  "QueryStartTime": "2026-01-01T00:00:00Z",
  "QueryTime": "2026-01-01T00:00:00Z",
  "RemediationProviders": [
    {
      "RemediationDate": "VALUE_13",
      "RemediationState": "VALUE_8",
      "Type": "VALUE_14"
    }
  ],
  "Role": 1,
  "Source": "VALUE_15",
  "ThreatAnalysisSummary": [
    {
      "AnalysisDate": "VALUE_16",
      "AnalyzersResult": [
        {
          "AnalysisDate": "VALUE_17",
          "EngineReport": "VALUE_18",
          "ThreatIntelligence": {
            "ProviderName": "VALUE_15",
            "ThreatName": "VALUE_19",
            "ThreatType": "VALUE_20"
          },
          "Verdict": "VALUE_9"
        }
      ],
      "Verdict": "VALUE_9"
    }
  ],
  "ThreatIntelligence": [
    {
      "ProviderName": "VALUE_15",
      "ThreatName": "VALUE_19",
      "ThreatType": "VALUE_20"
    }
  ],
  "Type": "VALUE_21",
  "Urn": "VALUE_22"
}

Payload fields and types

Path	Type
`$`	object
`$.ClusterBy`	string
`$.ClusterByValue`	string
`$.ClusterGroup`	string
`$.ClusterQueryEndTime`	string
`$.ClusterQueryStartTime`	string
`$.ClusterSourceIdentifier`	string
`$.ClusterSourceType`	string
`$.CountByDeliveryLocation`	object
`$.CountByDeliveryLocation.Quarantine`	integer
`$.CountByProtectionStatus`	object
`$.CountByProtectionStatus.Blocked`	integer
`$.CountByThreatType`	object
`$.CountByThreatType.HighConfPhish`	integer
`$.CountByThreatType.Malware`	integer
`$.CountByThreatType.Phish`	integer
`$.CountByThreatType.Spam`	integer
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.IsVolumeAnomaly`	boolean
`$.LastRemediationState`	string
`$.LastVerdict`	string
`$.MailCount`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Query`	string
`$.QueryStartTime`	string
`$.QueryTime`	string
`$.RemediationProviders`	array
`$.RemediationProviders[]`	object
`$.RemediationProviders[].RemediationDate`	string
`$.RemediationProviders[].RemediationState`	string
`$.RemediationProviders[].Type`	string
`$.Role`	integer
`$.Source`	string
`$.ThreatAnalysisSummary`	array
`$.ThreatAnalysisSummary[]`	object
`$.ThreatAnalysisSummary[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult`	array
`$.ThreatAnalysisSummary[].AnalyzersResult[]`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].EngineReport`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence`	object
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ProviderName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatName`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].ThreatIntelligence.ThreatType`	string
`$.ThreatAnalysisSummary[].AnalyzersResult[].Verdict`	string
`$.ThreatAnalysisSummary[].Verdict`	string
`$.ThreatIntelligence`	array
`$.ThreatIntelligence[]`	object
`$.ThreatIntelligence[].ProviderName`	string
`$.ThreatIntelligence[].ThreatName`	string
`$.ThreatIntelligence[].ThreatType`	string
`$.Type`	string
`$.Urn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: ServicePrincipal · ServiceSource: App Governance

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AppId": "00000000-0000-4000-8000-000000000001",
  "Asset": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Role": 1,
  "Roles": [
    "VALUE_3"
  ],
  "ServicePrincipalObjectId": "00000000-0000-4000-8000-000000000002",
  "ServicePrincipalType": "VALUE_4",
  "TenantId": "00000000-0000-4000-8000-000000000003",
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.AppId`	string
`$.Asset`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.ServicePrincipalObjectId`	string
`$.ServicePrincipalType`	string
`$.TenantId`	string
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Machine · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "HostName": "VALUE_1",
  "IsDomainJoined": false,
  "MachineId": "VALUE_2",
  "MachineIdType": 1,
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "RbacScopes": {
    "ScopesPerType": {
      "Mde_MachineGroupIds": {
        "Mode": "VALUE_5",
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Mode": "VALUE_5",
        "Scopes": [
          "VALUE_6"
        ]
      }
    }
  },
  "Role": 1,
  "Tags": [
    {
      "ProviderName": "VALUE_7",
      "TagId": "VALUE_8",
      "TagName": "VALUE_8",
      "TagType": "VALUE_9"
    }
  ],
  "Type": "VALUE_12"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.HostName`	string
`$.IsDomainJoined`	boolean
`$.MachineId`	string
`$.MachineIdType`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds`	object
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Mode`	string
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes`	array
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Mde_MachineGroupIds.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Tags`	array
`$.Tags[]`	object
`$.Tags[].ProviderName`	string
`$.Tags[].TagId`	string
`$.Tags[].TagName`	string
`$.Tags[].TagType`	string
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Mailbox · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadId": "00000000-0000-4000-8000-000000000001",
  "AccountName": "USERNAME_1",
  "DisplayName": "USERNAME_2",
  "DomainName": "COMPUTERNAME_1",
  "EntitySources": [
    "VALUE_1"
  ],
  "FirstSeen": "VALUE_2",
  "LastVerdict": "VALUE_3",
  "MailboxPrimaryAddress": "USERNAME_1@example.invalid",
  "MergeByKey": "VALUE_4",
  "MergeByKeyHex": "VALUE_5",
  "RiskLevel": "VALUE_6",
  "Role": 1,
  "Source": "VALUE_7",
  "ThreatAnalysisSummary": [
    {
      "AnalysisDate": "VALUE_8",
      "AnalyzersResult": [],
      "Verdict": "VALUE_3"
    }
  ],
  "Type": "VALUE_9",
  "Upn": "USERNAME_1@example.invalid",
  "Urn": "VALUE_10",
  "UserSid": "USERNAME_3"
}

Payload fields and types

Path	Type
`$`	object
`$.AadId`	string
`$.AccountName`	string
`$.DisplayName`	string
`$.DomainName`	string
`$.EntitySources`	array
`$.EntitySources[]`	string
`$.FirstSeen`	string
`$.LastVerdict`	string
`$.MailboxPrimaryAddress`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RiskLevel`	string
`$.Role`	integer
`$.Source`	string
`$.ThreatAnalysisSummary`	array
`$.ThreatAnalysisSummary[]`	object
`$.ThreatAnalysisSummary[].AnalysisDate`	string
`$.ThreatAnalysisSummary[].AnalyzersResult`	array
`$.ThreatAnalysisSummary[].Verdict`	string
`$.Type`	string
`$.Upn`	string
`$.Urn`	string
`$.UserSid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Ip · ServiceSource: Microsoft Defender for Endpoint

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Address": "VALUE_1",
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "Role": 1,
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Mailbox · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "MailboxPrimaryAddress": "USERNAME_1@example.invalid",
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.MailboxPrimaryAddress`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Machine · ServiceSource: Microsoft Defender for Endpoint

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DnsDomain": "COMPUTERNAME_1",
  "HostName": "VALUE_1",
  "IsDomainJoined": false,
  "MachineId": "VALUE_2",
  "MachineIdType": 1,
  "MergeByKey": "VALUE_3",
  "MergeByKeyHex": "VALUE_4",
  "RbacScopes": {
    "ScopesPerType": {
      "MachineGroupIds": {
        "Mode": "VALUE_5",
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Mode": "VALUE_5",
        "Scopes": [
          "VALUE_6"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_7"
}

Payload fields and types

Path	Type
`$`	object
`$.DnsDomain`	string
`$.HostName`	string
`$.IsDomainJoined`	boolean
`$.MachineId`	string
`$.MachineIdType`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.MachineGroupIds`	object
`$.RbacScopes.ScopesPerType.MachineGroupIds.Mode`	string
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes`	array
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes[]`	string
`$.RbacScopes.ScopesPerType.MachineGroupIds.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AccountName": "USERNAME_1",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_3",
        "Scopes": [
          "VALUE_4"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_3",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_5",
  "UPNSuffix": "VALUE_6",
  "UserPrincipalName": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AccountName`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string
`$.UPNSuffix`	string
`$.UserPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: CloudResource · ServiceSource: Microsoft Defender for Endpoint

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "ResourceId": "VALUE_3",
  "Role": 1,
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.ResourceId`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Machine · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "HostName": "VALUE_1",
  "MachineId": "VALUE_1",
  "MachineIdType": 1,
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_4",
        "Scopes": [
          "VALUE_5"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_4",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_6"
}

Payload fields and types

Path	Type
`$`	object
`$.HostName`	string
`$.MachineId`	string
`$.MachineIdType`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: CloudResource · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "ResourceId": "VALUE_3",
  "Role": 1,
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.ResourceId`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "AccountName": "USERNAME_1",
  "DisplayName": "USERNAME",
  "InventoryIdentityId": "VALUE_1",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_4",
        "Scopes": [
          "VALUE_5"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_4",
        "Scopes": [
          "00000000-0000-4000-8000-000000000002"
        ]
      }
    }
  },
  "Role": 1,
  "Sid": "S-1-5-21-100-200-300-1001",
  "Tags": [
    {
      "ProviderName": "VALUE_6",
      "TagId": "00000000-0000-4000-8000-000000000003",
      "TagName": "VALUE_7",
      "TagType": "VALUE_8"
    }
  ],
  "Type": "VALUE_9",
  "UPNSuffix": "VALUE_10",
  "UserPrincipalName": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.AccountName`	string
`$.DisplayName`	string
`$.InventoryIdentityId`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Sid`	string
`$.Tags`	array
`$.Tags[]`	object
`$.Tags[].ProviderName`	string
`$.Tags[].TagId`	string
`$.Tags[].TagName`	string
`$.Tags[].TagType`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.UserPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "AccountName": "USERNAME_1",
  "DisplayName": "USERNAME_2",
  "InventoryIdentityId": "VALUE_1",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "NTDomain": "COMPUTERNAME_1",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_4",
        "Scopes": [
          "VALUE_5"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_4",
        "Scopes": [
          "00000000-0000-4000-8000-000000000002"
        ]
      }
    }
  },
  "Role": 1,
  "Sid": "S-1-5-21-100-200-300-1001",
  "Type": "VALUE_6",
  "UPNSuffix": "VALUE_7",
  "UserPrincipalName": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.AccountName`	string
`$.DisplayName`	string
`$.InventoryIdentityId`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.NTDomain`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Sid`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.UserPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Defender for Office 365

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "DisplayName": "USERNAME_1",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "NTDomain": "COMPUTERNAME_1",
  "Name": "USERNAME_2",
  "Role": 1,
  "Sid": "S-1-5-21-100-200-300-1001",
  "Type": "VALUE_3",
  "UPNSuffix": "VALUE_4",
  "UserPrincipalName": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.DisplayName`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.NTDomain`	string
`$.Name`	string
`$.Role`	integer
`$.Sid`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.UserPrincipalName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: OAuthApplication · ServiceSource: App Governance

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "MergeByKey": "VALUE_1",
  "MergeByKeyHex": "VALUE_2",
  "Name": "USERNAME_1",
  "OAuthAppId": "00000000-0000-4000-8000-000000000001",
  "Role": 1,
  "Roles": [
    "VALUE_3"
  ],
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.OAuthAppId`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: CloudLogonSession · ServiceSource: Microsoft Defender XDR

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Asset": false,
  "Browser": "VALUE_1",
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "Role": 1,
  "Roles": [
    "VALUE_4"
  ],
  "SessionId": "00000000-0000-4000-8000-000000000001",
  "Type": "VALUE_5",
  "UserAgent": "USERNAME_1"
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.Browser`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.SessionId`	string
`$.Type`	string
`$.UserAgent`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: User · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "DisplayName": "USERNAME_1@example.invalid",
  "InventoryIdentityId": "VALUE_1",
  "IsDomainJoined": false,
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_4",
        "Scopes": [
          "VALUE_5"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_4",
        "Scopes": [
          "00000000-0000-4000-8000-000000000002"
        ]
      }
    }
  },
  "Role": 1,
  "Sid": "S-1-5-21-100-200-300-1001",
  "Type": "VALUE_6",
  "UPNSuffix": "VALUE_7"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.DisplayName`	string
`$.InventoryIdentityId`	string
`$.IsDomainJoined`	boolean
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Sid`	string
`$.Type`	string
`$.UPNSuffix`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Process · ServiceSource: Microsoft Defender for Endpoint

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Account": {
    "$id": "1",
    "DisplayName": "USERNAME_1",
    "DnsDomain": "COMPUTERNAME_1",
    "IsDomainJoined": false,
    "Name": "USERNAME_2",
    "Sid": "S-1-5-21-100-200-300-1001",
    "Type": "VALUE_1"
  },
  "CommandLine": "\"echo SAMPLE_1\"",
  "CreatedTimeUtc": "2026-01-01T00:00:00Z",
  "CreationTimeUtc": "2026-01-01T00:00:00Z",
  "ElevationToken": "VALUE_2",
  "FriendlyName": "VALUE_3",
  "ImageFile": {
    "$id": "1",
    "Directory": "VALUE_4",
    "FileHashes": [
      {
        "$id": "1",
        "Algorithm": "VALUE_5",
        "Type": "VALUE_6",
        "Value": "VALUE_7"
      }
    ],
    "Name": "USERNAME_3",
    "Type": "VALUE_12"
  },
  "MergeByKey": "VALUE_13",
  "MergeByKeyHex": "VALUE_14",
  "ParentProcess": {
    "$id": "1",
    "CreatedTimeUtc": "2026-01-01T00:00:00Z",
    "CreationTimeUtc": "2026-01-01T00:00:00Z",
    "FriendlyName": "VALUE_15",
    "ProcessId": "1",
    "Type": "VALUE_16"
  },
  "ProcessId": "1",
  "Role": 1,
  "Type": "VALUE_16"
}

Payload fields and types

Path	Type
`$`	object
`$.Account`	object
`$.Account.DisplayName`	string
`$.Account.DnsDomain`	string
`$.Account.IsDomainJoined`	boolean
`$.Account.Name`	string
`$.Account.Sid`	string
`$.Account.Type`	string
`$.Account["$id"]`	encoded-json
`$.Account["$id"]`	string
`$.Account["$id"]::<json>`	integer
`$.CommandLine`	encoded-json
`$.CommandLine`	string
`$.CommandLine::<json>`	string
`$.CreatedTimeUtc`	string
`$.CreationTimeUtc`	string
`$.ElevationToken`	string
`$.FriendlyName`	string
`$.ImageFile`	object
`$.ImageFile.Directory`	string
`$.ImageFile.FileHashes`	array
`$.ImageFile.FileHashes[]`	object
`$.ImageFile.FileHashes[].Algorithm`	string
`$.ImageFile.FileHashes[].Type`	string
`$.ImageFile.FileHashes[].Value`	string
`$.ImageFile.FileHashes[]["$id"]`	encoded-json
`$.ImageFile.FileHashes[]["$id"]`	string
`$.ImageFile.FileHashes[]["$id"]::<json>`	integer
`$.ImageFile.Name`	string
`$.ImageFile.Type`	string
`$.ImageFile["$id"]`	encoded-json
`$.ImageFile["$id"]`	string
`$.ImageFile["$id"]::<json>`	integer
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.ParentProcess`	object
`$.ParentProcess.CreatedTimeUtc`	string
`$.ParentProcess.CreationTimeUtc`	string
`$.ParentProcess.FriendlyName`	string
`$.ParentProcess.ProcessId`	encoded-json
`$.ParentProcess.ProcessId`	string
`$.ParentProcess.ProcessId::<json>`	integer
`$.ParentProcess.Type`	string
`$.ParentProcess["$id"]`	encoded-json
`$.ParentProcess["$id"]`	string
`$.ParentProcess["$id"]::<json>`	integer
`$.ProcessId`	encoded-json
`$.ProcessId`	string
`$.ProcessId::<json>`	integer
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

EntityType: Ip · ServiceSource: Microsoft Sentinel

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Address": "VALUE_1",
  "MergeByKey": "VALUE_2",
  "MergeByKeyHex": "VALUE_3",
  "RbacScopes": {
    "ScopesPerType": {
      "Workloads": {
        "Mode": "VALUE_4",
        "Scopes": [
          "VALUE_5"
        ]
      },
      "Workspace": {
        "Mode": "VALUE_4",
        "Scopes": [
          "00000000-0000-4000-8000-000000000001"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_6"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.MergeByKey`	string
`$.MergeByKeyHex`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Mode`	string
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Workspace`	object
`$.RbacScopes.ScopesPerType.Workspace.Mode`	string
`$.RbacScopes.ScopesPerType.Workspace.Scopes`	array
`$.RbacScopes.ScopesPerType.Workspace.Scopes[]`	string
`$.Role`	integer
`$.Type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

AlertEvidence Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
AlertsAndObservations	Regular		Files, IP addresses, URLs, users, or devices associated with alerts	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
AdditionalFields	Additional information about the entity or event	String
AlertId	Unique identifier for the alert	String
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	Int32
AttackTechniques	MITRE ATT&CK techniques associated with the activity that triggered the alert	String
Categories	List of categories that the information belongs to, in JSON array format	String
CloudPlatform	The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform	String
CloudResource	Cloud resource name	String
DetectionSource	Detection technology or sensor that identified the notable component or activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
EmailSubject	Subject of the email	String
EntityType	Type of object, such as a file, a process, a device, or a user	String
EvidenceDirection	Indicates whether the entity is the source or the destination of a network connection	String
EvidenceRole	How the entity is involved in an alert, indicating whether it is impacted or is merely related	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
LocalIP	IP address assigned to the local machine used during communication	String
MachineGroup		String
NetworkMessageId	Unique identifier for the email, generated by Microsoft 365	String
OAuthApplicationId	Unique identifier of the third-party OAuth application	String
ProcessCommandLine	Command line used to create the new process	String
RegistryKey	Registry key that the recorded action was applied to	String
RegistryValueData	Data of the registry value that the recorded action was applied to	String
RegistryValueName	Name of the registry value that the recorded action was applied to	String
RemoteIP	IP address that was being connected to	String
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ResourceID	Unique identifier of the cloud resource accessed	String
ResourceType	Type of cloud resource	String
SentinelWorkspaceIds	The unique identifiers of the Microsoft Sentinel workspace this alert is associated with	String
ServiceSource	Product or service that provided the alert information	String
Severity	Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert	String
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
SubscriptionId	Unique identifier of the cloud service subscription	String
TenantId		String
ThreatFamily	Malware family that the suspicious or malicious file or process has been classified under	String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Title	Title of the alert	String
Type		String

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column SentinelWorkspaceIds added
2024-10-18	Table added to tracking

AlertEvidence Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
AlertsAndObservations	Regular		Files, IP addresses, URLs, users, or devices associated with alerts	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
AdditionalFields	Additional information about the entity or event	String
AlertId	Unique identifier for the alert	String
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	Int32
AttackTechniques	MITRE ATT&CK techniques associated with the activity that triggered the alert	String
Categories	List of categories that the information belongs to, in JSON array format	String
CloudPlatform	The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform	String
CloudResource	Cloud resource name	String
DetectionSource	Detection technology or sensor that identified the notable component or activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
EmailSubject	Subject of the email	String
EntityType	Type of object, such as a file, a process, a device, or a user	String
EvidenceDirection	Indicates whether the entity is the source or the destination of a network connection	String
EvidenceRole	How the entity is involved in an alert, indicating whether it is impacted or is merely related	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
LocalIP	IP address assigned to the local machine used during communication	String
MachineGroup		String
NetworkMessageId	Unique identifier for the email, generated by Microsoft 365	String
OAuthApplicationId	Unique identifier of the third-party OAuth application	String
ProcessCommandLine	Command line used to create the new process	String
RegistryKey	Registry key that the recorded action was applied to	String
RegistryValueData	Data of the registry value that the recorded action was applied to	String
RegistryValueName	Name of the registry value that the recorded action was applied to	String
RemoteIP	IP address that was being connected to	String
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ResourceID	Unique identifier of the cloud resource accessed	String
ResourceType	Type of cloud resource	String
SentinelWorkspaceIds	The unique identifiers of the Microsoft Sentinel workspace this alert is associated with	String
ServiceSource	Product or service that provided the alert information	String
Severity	Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert	String
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
SubscriptionId	Unique identifier of the cloud service subscription	String
TenantId		String
ThreatFamily	Malware family that the suspicious or malicious file or process has been classified under	String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Title	Title of the alert	String
Type		String

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column SentinelWorkspaceIds added
2024-10-18	Table added to tracking