Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

Submit an example for AdditionalFields

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Action

`AdditionalFields`

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "AttackTechniques": "VALUE_2",
  "Category": "VALUE_3",
  "Count": "1",
  "DestinationComputerDnsName": "COMPUTERNAME_1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_3",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_4",
  "SourceAccountId": "00000000-0000-4000-8000-000000000002",
  "SourceAccountSid": "S-1-5-21-100-200-300-1001",
  "SourceComputerId": "00000000-0000-4000-8000-000000000003",
  "SourceComputerObjectGuid": "00000000-0000-4000-8000-000000000003",
  "SourceComputerOperatingSystem": "COMPUTERNAME_5",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_3",
  "SourceComputerOperatingSystemVersion": "COMPUTERNAME_6",
  "SourceComputerSid": "COMPUTERNAME_7"
}

Payload fields and types

Path	Type
`$`	object
`$.AttackTechniques`	string
`$.Category`	string
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerDnsName`	string
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.SourceAccountId`	string
`$.SourceAccountSid`	string
`$.SourceComputerId`	string
`$.SourceComputerObjectGuid`	string
`$.SourceComputerOperatingSystem`	string
`$.SourceComputerOperatingSystemType`	string
`$.SourceComputerOperatingSystemVersion`	string
`$.SourceComputerSid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "AttackTechniques": "VALUE_2",
  "Category": "VALUE_3",
  "CertificateIssuer": "null",
  "CertificateThumbprint": "null",
  "Count": "1",
  "DestinationComputerDnsName": "COMPUTERNAME_1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_3",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_4",
  "IsResourceAccountTrustedForUnconstrainedDelegation": "false",
  "SourceAccountId": "00000000-0000-4000-8000-000000000002",
  "SourceAccountSid": "S-1-5-21-100-200-300-1001",
  "SourceComputerId": "COMPUTERNAME_5",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_6",
  "Spns": "[\"VALUE_4\"]",
  "TargetComputerObjectGuid": "00000000-0000-4000-8000-000000000003",
  "TargetComputerOperatingSystem": "COMPUTERNAME_7",
  "TargetComputerOperatingSystemType": "COMPUTERNAME_3",
  "TargetComputerOperatingSystemVersion": "COMPUTERNAME_8"
}

Payload fields and types

Path	Type
`$`	object
`$.AttackTechniques`	string
`$.Category`	string
`$.CertificateIssuer`	encoded-json
`$.CertificateIssuer`	string
`$.CertificateIssuer::<json>`	null
`$.CertificateThumbprint`	encoded-json
`$.CertificateThumbprint`	string
`$.CertificateThumbprint::<json>`	null
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerDnsName`	string
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.IsResourceAccountTrustedForUnconstrainedDelegation`	encoded-json
`$.IsResourceAccountTrustedForUnconstrainedDelegation`	string
`$.IsResourceAccountTrustedForUnconstrainedDelegation::<json>`	boolean
`$.SourceAccountId`	string
`$.SourceAccountSid`	string
`$.SourceComputerId`	string
`$.SourceComputerOperatingSystemType`	string
`$.Spns`	encoded-json
`$.Spns`	string
`$.Spns::<json>`	array
`$.Spns::<json>[]`	string
`$.TargetComputerObjectGuid`	string
`$.TargetComputerOperatingSystem`	string
`$.TargetComputerOperatingSystemType`	string
`$.TargetComputerOperatingSystemVersion`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "ActionTypeInner": "VALUE_2",
  "AttackTechniques": "VALUE_3",
  "Category": "VALUE_4",
  "Count": "1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_1",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_3",
  "EncryptionType": "VALUE_5",
  "IsNtlmV1": "false",
  "IsResourceAccountTrustedForUnconstrainedDelegation": "VALUE_6",
  "KdcOptions": "VALUE_7",
  "KerberosType": "VALUE_8",
  "RequestTicketHash": "0000000000000000000000000000000000000000000000000000000000000001",
  "ResponseTicketHash": "0000000000000000000000000000000000000000000000000000000000000002",
  "SourceComputerId": "00000000-0000-4000-8000-000000000002",
  "SourceComputerObjectGuid": "00000000-0000-4000-8000-000000000002",
  "SourceComputerOperatingSystem": "COMPUTERNAME_4",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_2",
  "SourceComputerOperatingSystemVersion": "COMPUTERNAME_5",
  "SourceComputerSid": "COMPUTERNAME_6",
  "Spns": "VALUE_9",
  "TargetComputerObjectGuid": "00000000-0000-4000-8000-000000000003",
  "TargetComputerOperatingSystem": "COMPUTERNAME_7",
  "TargetComputerOperatingSystemType": "COMPUTERNAME_2",
  "TargetComputerOperatingSystemVersion": "COMPUTERNAME_8"
}

Payload fields and types

Path	Type
`$`	object
`$.ActionTypeInner`	string
`$.AttackTechniques`	string
`$.Category`	string
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.EncryptionType`	string
`$.IsNtlmV1`	encoded-json
`$.IsNtlmV1`	string
`$.IsNtlmV1::<json>`	boolean
`$.IsResourceAccountTrustedForUnconstrainedDelegation`	string
`$.KdcOptions`	string
`$.KerberosType`	string
`$.RequestTicketHash`	string
`$.ResponseTicketHash`	string
`$.SourceComputerId`	string
`$.SourceComputerObjectGuid`	string
`$.SourceComputerOperatingSystem`	string
`$.SourceComputerOperatingSystemType`	string
`$.SourceComputerOperatingSystemVersion`	string
`$.SourceComputerSid`	string
`$.Spns`	string
`$.TargetComputerObjectGuid`	string
`$.TargetComputerOperatingSystem`	string
`$.TargetComputerOperatingSystemType`	string
`$.TargetComputerOperatingSystemVersion`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "ActionTypeInner": "VALUE_2",
  "AttackTechniques": "VALUE_3",
  "Category": "VALUE_4",
  "Count": "1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_1",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_3",
  "IsNtlmV1": "false",
  "IsResourceAccountTrustedForUnconstrainedDelegation": "VALUE_5",
  "KdcOptions": "VALUE_6",
  "KerberosType": "VALUE_7",
  "RequestTicketHash": "0000000000000000000000000000000000000000000000000000000000000001",
  "ResponseTicketHash": "0000000000000000000000000000000000000000000000000000000000000002",
  "SourceAccountId": "00000000-0000-4000-8000-000000000002",
  "SourceAccountSid": "S-1-5-21-100-200-300-1001",
  "SourceComputerId": "COMPUTERNAME_4",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_5",
  "Spns": "VALUE_8",
  "TargetAccountId": "00000000-0000-4000-8000-000000000003",
  "TargetAccountSid": "S-1-5-21-100-200-300-1002"
}

Payload fields and types

Path	Type
`$`	object
`$.ActionTypeInner`	string
`$.AttackTechniques`	string
`$.Category`	string
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.IsNtlmV1`	encoded-json
`$.IsNtlmV1`	string
`$.IsNtlmV1::<json>`	boolean
`$.IsResourceAccountTrustedForUnconstrainedDelegation`	string
`$.KdcOptions`	string
`$.KerberosType`	string
`$.RequestTicketHash`	string
`$.ResponseTicketHash`	string
`$.SourceAccountId`	string
`$.SourceAccountSid`	string
`$.SourceComputerId`	string
`$.SourceComputerOperatingSystemType`	string
`$.Spns`	string
`$.TargetAccountId`	string
`$.TargetAccountSid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "ActionTypeInner": "VALUE_2",
  "AttackTechniques": "VALUE_3",
  "Category": "VALUE_4",
  "Count": "1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_1",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_3",
  "IsNtlmV1": "false",
  "IsResourceAccountTrustedForUnconstrainedDelegation": "VALUE_5",
  "KdcOptions": "VALUE_6",
  "KerberosType": "VALUE_7",
  "RequestTicketHash": "0000000000000000000000000000000000000000000000000000000000000001",
  "ResponseTicketHash": "0000000000000000000000000000000000000000000000000000000000000002",
  "SourceComputerId": "00000000-0000-4000-8000-000000000002",
  "SourceComputerObjectGuid": "00000000-0000-4000-8000-000000000002",
  "SourceComputerOperatingSystem": "COMPUTERNAME_4",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_2",
  "SourceComputerOperatingSystemVersion": "COMPUTERNAME_5",
  "SourceComputerSid": "COMPUTERNAME_6",
  "Spns": "VALUE_8",
  "TargetComputerObjectGuid": "00000000-0000-4000-8000-000000000003",
  "TargetComputerOperatingSystem": "COMPUTERNAME_7",
  "TargetComputerOperatingSystemType": "COMPUTERNAME_2",
  "TargetComputerOperatingSystemVersion": "COMPUTERNAME_8"
}

Payload fields and types

Path	Type
`$`	object
`$.ActionTypeInner`	string
`$.AttackTechniques`	string
`$.Category`	string
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.IsNtlmV1`	encoded-json
`$.IsNtlmV1`	string
`$.IsNtlmV1::<json>`	boolean
`$.IsResourceAccountTrustedForUnconstrainedDelegation`	string
`$.KdcOptions`	string
`$.KerberosType`	string
`$.RequestTicketHash`	string
`$.ResponseTicketHash`	string
`$.SourceComputerId`	string
`$.SourceComputerObjectGuid`	string
`$.SourceComputerOperatingSystem`	string
`$.SourceComputerOperatingSystemType`	string
`$.SourceComputerOperatingSystemVersion`	string
`$.SourceComputerSid`	string
`$.Spns`	string
`$.TargetComputerObjectGuid`	string
`$.TargetComputerOperatingSystem`	string
`$.TargetComputerOperatingSystemType`	string
`$.TargetComputerOperatingSystemVersion`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "Pass-through authentication": "false",
  "Request ID": "00000000-0000-4000-8000-000000000001"
}

Payload fields and types

Path	Type
`$`	object
`$["Pass-through authentication"]`	encoded-json
`$["Pass-through authentication"]`	string
`$["Pass-through authentication"]::<json>`	boolean
`$["Request ID"]`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "ActionTypeInner": "VALUE_2",
  "AttackTechniques": "VALUE_3",
  "Category": "VALUE_4",
  "Count": "1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_1",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_3",
  "IsNtlmV1": "false",
  "IsResourceAccountTrustedForUnconstrainedDelegation": "VALUE_5",
  "KdcOptions": "VALUE_6",
  "KerberosType": "VALUE_7",
  "RequestTicketHash": "0000000000000000000000000000000000000000000000000000000000000001",
  "ResponseTicketHash": "0000000000000000000000000000000000000000000000000000000000000002",
  "SourceComputerId": "00000000-0000-4000-8000-000000000001",
  "SourceComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "SourceComputerOperatingSystem": "COMPUTERNAME_1",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_2",
  "SourceComputerOperatingSystemVersion": "COMPUTERNAME_3",
  "SourceComputerSid": "COMPUTERNAME_4",
  "Spns": "VALUE_8",
  "TargetAccountId": "00000000-0000-4000-8000-000000000002",
  "TargetAccountSid": "S-1-5-21-100-200-300-1001"
}

Payload fields and types

Path	Type
`$`	object
`$.ActionTypeInner`	string
`$.AttackTechniques`	string
`$.Category`	string
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.IsNtlmV1`	encoded-json
`$.IsNtlmV1`	string
`$.IsNtlmV1::<json>`	boolean
`$.IsResourceAccountTrustedForUnconstrainedDelegation`	string
`$.KdcOptions`	string
`$.KerberosType`	string
`$.RequestTicketHash`	string
`$.ResponseTicketHash`	string
`$.SourceComputerId`	string
`$.SourceComputerObjectGuid`	string
`$.SourceComputerOperatingSystem`	string
`$.SourceComputerOperatingSystemType`	string
`$.SourceComputerOperatingSystemVersion`	string
`$.SourceComputerSid`	string
`$.Spns`	string
`$.TargetAccountId`	string
`$.TargetAccountSid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonFailed

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "Pass-through authentication": "false",
  "Request ID": "00000000-0000-4000-8000-000000000001"
}

Payload fields and types

Path	Type
`$`	object
`$["Pass-through authentication"]`	encoded-json
`$["Pass-through authentication"]`	string
`$["Pass-through authentication"]::<json>`	boolean
`$["Request ID"]`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonFailed

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "ActionTypeInner": "VALUE_2",
  "AttackTechniques": "VALUE_3",
  "Category": "VALUE_4",
  "Count": "1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_1",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_3",
  "EncryptionType": "VALUE_5",
  "ErrorText": "VALUE_6",
  "KdcOptions": "VALUE_7",
  "KerberosType": "VALUE_8",
  "SourceAccountName": "USERNAME_1",
  "SourceComputerId": "00000000-0000-4000-8000-000000000002",
  "SourceComputerObjectGuid": "00000000-0000-4000-8000-000000000002",
  "SourceComputerOperatingSystem": "COMPUTERNAME_4",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_5",
  "SourceComputerSid": "COMPUTERNAME_6",
  "Spns": "VALUE_9"
}

Payload fields and types

Path	Type
`$`	object
`$.ActionTypeInner`	string
`$.AttackTechniques`	string
`$.Category`	string
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.EncryptionType`	string
`$.ErrorText`	string
`$.KdcOptions`	string
`$.KerberosType`	string
`$.SourceAccountName`	string
`$.SourceComputerId`	string
`$.SourceComputerObjectGuid`	string
`$.SourceComputerOperatingSystem`	string
`$.SourceComputerOperatingSystemType`	string
`$.SourceComputerSid`	string
`$.Spns`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonFailed

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "ActionTypeInner": "VALUE_2",
  "CertificateIssuer": "USERNAME_1@example.invalid",
  "CertificateSubject": "USERNAME_1@example.invalid",
  "CertificateThumbprint": "VALUE_3",
  "Count": "1",
  "DestinationComputerObjectGuid": "00000000-0000-4000-8000-000000000001",
  "DestinationComputerOperatingSystem": "COMPUTERNAME_1",
  "DestinationComputerOperatingSystemType": "COMPUTERNAME_2",
  "DestinationComputerOperatingSystemVersion": "COMPUTERNAME_3",
  "Error": "VALUE_4",
  "ErrorText": "VALUE_5",
  "KdcOptions": "VALUE_6",
  "SourceAccountId": "00000000-0000-4000-8000-000000000002",
  "SourceAccountName": "USERNAME_1",
  "SourceAccountSid": "S-1-5-21-100-200-300-1001",
  "SourceComputerId": "COMPUTERNAME_4",
  "SourceComputerOperatingSystemType": "COMPUTERNAME_5"
}

Payload fields and types

Path	Type
`$`	object
`$.ActionTypeInner`	string
`$.CertificateIssuer`	string
`$.CertificateSubject`	string
`$.CertificateThumbprint`	string
`$.Count`	encoded-json
`$.Count`	string
`$.Count::<json>`	integer
`$.DestinationComputerObjectGuid`	string
`$.DestinationComputerOperatingSystem`	string
`$.DestinationComputerOperatingSystemType`	string
`$.DestinationComputerOperatingSystemVersion`	string
`$.Error`	string
`$.ErrorText`	string
`$.KdcOptions`	string
`$.SourceAccountId`	string
`$.SourceAccountName`	string
`$.SourceAccountSid`	string
`$.SourceComputerId`	string
`$.SourceComputerOperatingSystemType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

IdentityLogonEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Itp	Regular		Authentication events recorded by Active Directory and other Microsoft online services	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDisplayName	Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.	String
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	Object
Application	Application that performed the recorded action	String
DestinationDeviceName	Name of the device running the server application that processed the recorded action	String
DestinationIPAddress	IP address of the device running the server application that processed the recorded action	String
DestinationPort	Destination port of the activity	Int32
DeviceName	Fully qualified domain name (FQDN) of the device	String
DeviceType	Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer	String
FailureReason	Information explaining why the recorded action failed	String
IPAddress	IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts	String
ISP	Internet service provider associated with the IP address	String
LastSeenForUser	Number of days since each statistical feature for the user was last seen	Object
Location	City, country, or other geographic location associated with the event	String
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	String
OSPlatform	Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7	String
Port	TCP port used during communication	Int32
Protocol	Protocol used during the communication	String
ReportId	Unique identifier for the event	String
SourceSystem		String
TargetAccountDisplayName	Display name of the account that the recorded action was applied to	String
TargetDeviceName	Fully qualified domain name (FQDN) of the device that the recorded action was applied to	String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String
UncommonForUser	List of features observed to be statistically uncommon for the user that performed the activity	Object

Action types

Name	Description
LogonFailed	A user attempted to logon to the device but failed.
LogonSuccess	A user successfully logged on to the device.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column _IsBillable removed
2026-01-02	Column _BilledSize removed
2026-01-02	Column UncommonForUser added
2026-01-02	Column LastSeenForUser added
2024-10-18	Table added to tracking

IdentityLogonEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Itp	Regular		Authentication events recorded by Active Directory and other Microsoft online services	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDisplayName	Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.	String
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	Object
Application	Application that performed the recorded action	String
DestinationDeviceName	Name of the device running the server application that processed the recorded action	String
DestinationIPAddress	IP address of the device running the server application that processed the recorded action	String
DestinationPort	Destination port of the activity	Int32
DeviceName	Fully qualified domain name (FQDN) of the device	String
DeviceType	Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer	String
FailureReason	Information explaining why the recorded action failed	String
IPAddress	IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts	String
ISP	Internet service provider associated with the IP address	String
LastSeenForUser	Number of days since each statistical feature for the user was last seen	Object
Location	City, country, or other geographic location associated with the event	String
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	String
OSPlatform	Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7	String
Port	TCP port used during communication	Int32
Protocol	Protocol used during the communication	String
ReportId	Unique identifier for the event	String
SourceSystem		String
TargetAccountDisplayName	Display name of the account that the recorded action was applied to	String
TargetDeviceName	Fully qualified domain name (FQDN) of the device that the recorded action was applied to	String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String
UncommonForUser	List of features observed to be statistically uncommon for the user that performed the activity	Object

Action types

Name	Description
LogonFailed	A user attempted to logon to the device but failed.
LogonSuccess	A user successfully logged on to the device.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column _IsBillable removed
2026-01-02	Column _BilledSize removed
2026-01-02	Column UncommonForUser added
2026-01-02	Column LastSeenForUser added
2024-10-18	Table added to tracking