IdentityEvents

IdentityEvents Schema #

Table description #

TableSection TableType TableSectionName Description
Itp Regular Events collected from identity services such as IDP, PIM, PAM and others

Table retention #

HotDays ColdDays TotalInteractiveDays
30 0 30

Schema #

Name Description Type
AccountDisplayName Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user. String
AccountId Unique identifier for the account in the source application String
AccountType Type of user account, indicating its general role like User, SystemPrincipal String
AccountUpn Alternate Id, email or name for the account in the source application String
ActionFailureReason Information explaining why the recorded action failed String
ActionResult Result of the action String
ActionType Type of activity that triggered the event in the raw format received from the source application String
AdditionalFields Additional information about the entity or event Object
Application The source application where this event was received from String
ApplicationEventId Raw event ID provided by the source application String
ApplicationInstanceId Domain of the source application String
ApplicationSessionId Raw session ID provided by the source application String
IPAddress IP address assigned to the device and used during related network communications String
RawEventData Full raw event information from the source application or service in JSON format Object
ReportId Unique identifier for the event String
SourceSystem String
TargetObjects List of the target objects of this activity. Target object can be user, group, role, domain, application and more. Object
TenantId String
TimeGenerated DateTime
Timestamp Date and time when the record was generated DateTime
Type String
UserAgent User agent information from the web browser or other client application String

Schema changes #

Date Action
2026-01-02 Table added to tracking