← Browse all tablesLoading table information…
Contribute structured examples for this table using the PowerShell tool. Submit a synthetic example.
ASimEmailEventLogs Schema
Table description
| TableSection |
TableType |
TableSectionName |
Description |
|
|
Other hunting tables |
|
Schema
| Name |
Description |
Type |
| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| _ResourceId |
|
String |
| _SubscriptionId |
|
String |
| AdditionalEntities |
|
Object |
| AdditionalFields |
Additional information about the entity or event |
Object |
| AttackRemediationSteps |
|
String |
| AttackTactics |
|
String |
| AttackTechniques |
MITRE ATT&CK techniques associated with the activity that triggered the alert |
String |
| Dst |
|
String |
| DstIpAddr |
|
String |
| Dvc |
|
String |
| DvcAction |
|
String |
| DvcDescription |
|
String |
| DvcDomain |
|
String |
| DvcDomainType |
|
String |
| DvcFQDN |
|
String |
| DvcHostname |
|
String |
| DvcId |
|
String |
| DvcIdType |
|
String |
| DvcInterface |
|
String |
| DvcIpAddr |
|
String |
| DvcMacAddr |
|
String |
| DvcOriginalAction |
|
String |
| DvcOs |
|
String |
| DvcOsVersion |
|
String |
| DvcScope |
|
String |
| DvcScopeId |
|
String |
| DvcZone |
|
String |
| EmailBCCRecipients |
|
Object |
| EmailCCRecipients |
|
Object |
| EmailDeliveryLocation |
|
String |
| EmailDirection |
Direction of the email relative to your network: Inbound, Outbound, Intra-org |
String |
| EmailDkimDomain |
|
String |
| EmailDkimOriginalResult |
|
String |
| EmailDkimResult |
|
String |
| EmailDkimSignature |
|
String |
| EmailDmarcOriginalResult |
|
String |
| EmailDmarcOverride |
|
String |
| EmailDmarcPolicy |
|
String |
| EmailDmarcResult |
|
String |
| EmailFileCount |
|
Int32 |
| EmailFiles |
|
Object |
| EmailFromAddress |
|
String |
| EmailFromDomain |
|
String |
| EmailLanguage |
Detected language of the email content |
String |
| EmailMailFromAddress |
|
String |
| EmailMailFromDomain |
|
String |
| EmailOriginalDeliveryLocation |
|
String |
| EmailProtocolName |
|
String |
| EmailReplyToAddress |
|
String |
| EmailReplyToDomain |
|
String |
| EmailSizeBytes |
|
Int64 |
| EmailSpfOriginalResult |
|
String |
| EmailSpfResult |
|
String |
| EmailSubject |
Subject of the email |
String |
| EmailToRecipients |
|
Object |
| EmailUrlCount |
|
Int32 |
| EmailUrls |
|
Object |
| EventCount |
|
Int32 |
| EventEndTime |
|
DateTime |
| EventMessage |
|
String |
| EventOriginalResultDetails |
|
String |
| EventOriginalSeverity |
|
String |
| EventOriginalType |
|
String |
| EventOriginalUid |
|
String |
| EventOwner |
|
String |
| EventProduct |
|
String |
| EventProductVersion |
|
String |
| EventReportUrl |
|
String |
| EventResult |
|
String |
| EventResultDetails |
|
String |
| EventSchema |
|
String |
| EventSchemaVersion |
|
String |
| EventSeverity |
|
String |
| EventStartTime |
|
DateTime |
| EventSubType |
|
String |
| EventType |
|
String |
| EventUid |
|
String |
| EventVendor |
|
String |
| IndicatorAssociation |
|
String |
| IndicatorType |
|
String |
| IpAddr |
|
String |
| Rule |
|
String |
| RuleDescription |
|
String |
| RuleName |
|
String |
| RuleNumber |
|
Int32 |
| SourceSystem |
|
String |
| Src |
|
String |
| SrcDescription |
|
String |
| SrcDeviceType |
|
String |
| SrcDomain |
|
String |
| SrcDomainType |
|
String |
| SrcDvcId |
|
String |
| SrcDvcIdType |
|
String |
| SrcDvcScope |
|
String |
| SrcDvcScopeId |
|
String |
| SrcFQDN |
|
String |
| SrcGeoCity |
|
String |
| SrcGeoCountry |
|
String |
| SrcGeoLatitude |
|
Double |
| SrcGeoLongitude |
|
Double |
| SrcGeoRegion |
|
String |
| SrcHostname |
|
String |
| SrcIpAddr |
|
String |
| SrcIsp |
|
String |
| SrcUserId |
|
String |
| SrcUserIdType |
|
String |
| SrcUserName |
|
String |
| SrcUsernameType |
|
String |
| SrcUserScope |
|
String |
| SrcUserScopeId |
|
String |
| SrcUserUpn |
|
String |
| TenantId |
Unique identifier of the tenant into which the data connector ingests data. |
String |
| ThreatCategory |
|
String |
| ThreatConfidence |
|
Int32 |
| ThreatField |
|
String |
| ThreatFirstReportedTime |
|
DateTime |
| ThreatId |
|
String |
| ThreatIpAddr |
|
String |
| ThreatIsActive |
|
Boolean |
| ThreatLastReportedTime |
|
DateTime |
| ThreatName |
Detection name for any malware or other threats found |
String |
| ThreatOriginalCategory |
|
String |
| ThreatOriginalConfidence |
|
String |
| ThreatOriginalRiskLevel |
|
String |
| ThreatRiskLevel |
|
Int32 |
| TimeGenerated |
|
DateTime |
| Type |
The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other |
String |
| User |
|
String |
Schema changes
| Date |
Action |
| 2026-10-14 |
Table added to tracking |