Events collected from identity services such as IDP, PIM, PAM and others
Defender
Table retention
ColdDays
HotDays
TotalInteractiveDays
0
30
30
Schema
Name
Description
Type
AccountDisplayName
Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.
String
AccountId
Unique identifier for the account in the source application
String
AccountType
Type of user account, indicating its general role like User, SystemPrincipal
String
AccountUpn
Alternate Id, email or name for the account in the source application
String
ActionFailureReason
Information explaining why the recorded action failed
String
ActionResult
Result of the action
String
ActionType
Type of activity that triggered the event in the raw format received from the source application
String
AdditionalFields
Additional information about the entity or event
Object
Application
The source application where this event was received from
String
ApplicationEventId
Raw event ID provided by the source application
String
ApplicationInstanceId
Domain of the source application
String
ApplicationSessionId
Raw session ID provided by the source application
String
IPAddress
IP address assigned to the device and used during related network communications
String
RawEventData
Full raw event information from the source application or service in JSON format
Object
ReportId
Unique identifier for the event
String
SourceSystem
String
TargetObjects
List of the target objects of this activity. Target object can be user, group, role, domain, application and more.
Object
TenantId
String
TimeGenerated
DateTime
Timestamp
Date and time when the record was generated
DateTime
Type
String
UserAgent
User agent information from the web browser or other client application