SecurityEvent

Security events collected from windows machines by Azure Security Center or Azure Sentinel.

Table attributes

Attribute	Value
Resource types	microsoft.securityinsights/securityinsights, microsoft.compute/virtualmachines, microsoft.conenctedvmwarevsphere/virtualmachines, microsoft.azurestackhci/virtualmachines, microsoft.scvmm/virtualmachines, microsoft.compute/virtualmachinescalesets
Categories	Security
Solutions	Security, SecurityInsights
Basic log	No
Ingestion-time transformation	Yes
Sample Queries	Yes

Columns

Column	Type	Description
AccessMask	string	Hexadecimal mask for the requested or performed operation.
Account	string	The Security context for services or users.
AccountDomain	string	Subject's domain or computer name.
AccountExpires	string	The date when the account expires.
AccountName	string	The name of the account that requested the "remove domain trust" operation.
AccountSessionIdentifier	string	A unique identifier that is generated by the machine when the session is created.
AccountType	string	Identifies whether the account is a computer account (machine) or a user's.
Activity	string	The descriptive title of the event occurred.
AdditionalInfo	string	Additional information that is provided by the source, which do not mapped to other fields, represented by list.
AdditionalInfo2	string	Additional information that is provided by the source, which do not mapped to other fields, represented by list.
AllowedToDelegateTo	string	The list of SPNs to which this account can present delegated credentials.
Attributes	string	Additional information about the event.
AuditPolicyChanges	string	Events that are generated when changes are made to the system audit policy or audit settings on a file or registry key.
AuditsDiscarded	int	Number of audit messages that were discarded.
AuthenticationLevel	int	Number of audit messages that were discarded.
AuthenticationPackageName	string	the name of loaded Authentication Package. The format is: DLL_PATH_AND_NAME: AUTHENTICATION_PACKAGE_NAME.
AuthenticationProvider	string	The identity of the provider responsible for the authentication process (can include a certificate authority, a username, a password authentication system, etc).
AuthenticationServer	string	The server in which located the authentication provider.
AuthenticationService	int	The service in which located the authentication provider.
AuthenticationType	string	the type of authentication that was used for the event (two-factor authentication, biometric authentication, etc).
AzureDeploymentID	string	Azure deployment ID of the cloud service the log belongs to.
_BilledSize	real	The record size in bytes
CACertificateHash	string	The hash value of the certificate authority's (CA) certificate that was used to authenticate the user who performed the event.
CalledStationID	string	Information about the ID of the station that initiated the action that led to the security event.
CallerProcessId	string	Hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process.
CallerProcessName	string	Full path and the name of the executable for the process.
CallingStationID	string	Information about the ID of the station that initiated the action that led to the security event.
CAPublicKeyHash	string	Hash value that identifies the public key of a certification authority (CA) that issued a certificate.
CategoryId	string	The category of the security event that occurred (login attempt, data breach, etc).
CertificateDatabaseHash	string	Hash value that identifies the database that issued a certificate.
Channel	string	The channel to which the event was logged.
ClassId	string	'Class Guid' attribute of device.
ClassName	string	'Class' attribute of device.
ClientAddress	string	IP address of the computer from which the TGT request was received.
ClientIPAddress	string	IP address of the computer that initiated the action that led to the event.
ClientName	string	computer name from which the user was reconnected. Has 'Unknown' value for console session.
CommandLine	string	The command line arguments that were passed to an application or process that was involved in the event.
CompatibleIds	string	'Compatible Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':
Computer	string	The name of the computer on which the event occurred.
Correlation	string	The activity identifiers that consumers can use to group related events together.
DCDNSName	string	The DNS name of the domain controller that was involved in the event.
DeviceDescription	string	the description of the device that was involved in the event.
DeviceId	string	The unique identifier of the device that was involved in the event.
DisplayName	string	It is a name, displayed in the address book for a particular account. This is usually the combination of the user's first name, middle initial, and last name.
Disposition	string	The event outcome/ resolution, such as whether the event was resolved or whether any action was taken in response to the event.
DomainBehaviorVersion	string	msDS-Behavior-Version domain attribute was modified. Numeric value.
DomainName	string	The name of removed trusted domain.
DomainPolicyChanged	string	Indicates whether any domain policies have been changed as part of the event (password policies, security policies, etc).
DomainSid	string	SID of the trust partner. This parameter might not be captured in the event, and in that case appears as 'NULL SID'.
EAPType	string	The type of Extensible Authentication Protocol (EAP) that was used for the event authentication process.
ElevatedToken	string	A 'Yes' or 'No' flag. If 'Yes', then the session this event represents is elevated and has administrator privileges.
ErrorCode	int	Contains error code for Failure events. For Success events this parameter has '0x0' value.
EventData	string	Event specific data associated with the event.
EventID	int	The identifier that the provider used to identify the event.
EventLevelName	string	The rendered message string of the level specified in the event.
EventRecordId	string	The record number assigned to the event when it was logged.
EventSourceName	string	The name of the software that logs the event (applicationor a succomponent).
ExtendedQuarantineState	string	The state of the network quarantine process, if applicable. Network quarantine is a process by which unauthorized devices are prevented from accessing a network until they meet certain security requirements or have been checked for malware.
FailureReason	string	textual explanation of Status field value. For this event, it typically has 'Account locked out' value.
FileHash	string	The hash value for any files that are were accessed or modified as part of the event, or any files that were used in the authentication or authorization process.
FilePath	string	Full path and filename of the key file on which the operation was performed.
FilePathNoUser	string	The path of any files that are related to the event, excluding the username or other user-specific information.
Filter	string	Filters that are used in the performed event.
ForceLogoff	string	'\Security Settings\Local Policies\Security Options\Network security: Force logoff when logon hours expire' group policy.
Fqbn	string	The fully qualified binary name (FQBN) for any files that are related to the event.
FullyQualifiedSubjectMachineName	string	The fully qualified domain name (FQDN) of the machine that initiated the event.
FullyQualifiedSubjectUserName	string	The username of the user or service that initiated the event in FQDN format.
GroupMembership	string	The list of group SIDs which logged account belongs to (member of). Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
HandleId	string	Hexadecimal value of a handle to Object Name. This field can be used for correlation with other events.
HardwareIds	string	'Hardware Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':
HomeDirectory	string	User's home directory. If homeDrive attribute is set and specifies a drive letter, homeDirectory should be a UNC path. The path must be a network UNC of the form \Server\Share\Directory.
HomePath	string	User's home path. The path must be a network UNC of the form \Server\Share\Directory.
InterfaceUuid	string	The unique identifier (UUID) for the network interface that was used for the event.
IpAddress	string	the network address (usually IPv4 or IPv6) associated with the event.
IpPort	string	The network port number associated with the event.
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
KeyLength	int	The length of NTLM Session Security key. Typically it has 128 bit or 56 bit length.
Keywords	string	A bitmask of the keywords defined in the event.
Level	string	Windows categorizes every event with a severity level. The levels in order of severity are information, verbose, warning, error and critical expressed in numbers.
LmPackageName	string	The name of the package or software component that is currently using the Local Security Authority (LSA) on the machine where the event is being generated.
LocationInformation	string	'Location information' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':
LockoutDuration	string	'\Security Settings\Account Policies\Account Lockout Policy\Account lockout duration' group policy. Numeric value.
LockoutObservationWindow	string	'\Security Settings\Account Policies\Account Lockout Policy\Reset account lockout counter after' group policy. Numeric value.
LockoutThreshold	string	'\Security Settings\Account Policies\Account Lockout Policy\Account lockout threshold' group policy. Numeric value.
LoggingResult	string	The result of the logon process.
LogonGuid	string	A GUID that can help you correlate this event with another event that can contain the same Logon GUID.
LogonHours	string	Hours that the account is allowed to logon to the domain.
LogonID	string	Hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID.
LogonProcessName	string	The name of registered logon process.
LogonType	int	The type of logon which was performed.
LogonTypeName	string	The type of logon or authentication event that is being captured by the event log (common values:Interactive, Network, RemoteInteractive, Unlock).
MachineAccountQuota	string	ms-DS-MachineAccountQuota domain attribute was modified. Numeric value.
MachineInventory	string	Information about the hardware configuration and software environment of the computer where the event is being generated. It can include different data points, for instance: the make and model of the computer, the amount of RAM or storage space available, the version numbers of various software applications, etc).
MachineLogon	string	Information about a successful logon event in the machine.
ManagementGroupName	string	Additional information based on the resource type.
MandatoryLabel	string	ID of integrity label which was assigned to the new process.
MaxPasswordAge	string	The period of time (in days) that a password can be used before the system requires the user to change it.
MemberName	string	The user account that was involved in the event.
MemberSid	string	The security identifier (SID) associated with the user account that was involved in the event.
MinPasswordAge	string	The period of time (in days) that a password must be used before the system requires the user to change it.
MinPasswordLength	string	The least number of characters that can make up a password for a user account.
MixedDomainMode	string	The domain mode of a system or domain controller.
NASIdentifier	string	The identifier of the network access server (NAS) that was involved in the event.
NASIPv4Address	string	The IPv4Address of the network access server (NAS) that was involved in the event, if applicable.
NASIPv6Address	string	The IPv6Address of the network access server (NAS) that was involved in the event, if applicable.
NASPort	string	the port on the network access server that was used in the event.
NASPortType	string	the type of network access server (NAS) used in the event.
NetworkPolicyName	string	The name of the network policy associated with the event.
NewDate	string	New date in UTC time zone. The format is YYYY-MM-DD.
NewMaxUsers	string	The new maximum number of users allowed for a resource in the event.
NewProcessId	string	Hexadecimal Process ID of the new process. Process ID (PID) is a number used by the operating system to uniquely identify an active process.
NewProcessName	string	Full path and the name of the executable for the new process.
NewRemark	string	The new value of network share 'Comments:' field. Has 'N/A' value if it isn't set.
NewShareFlags	string	The share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.
NewTime	string	New time that was set in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ
NewUacValue	string	Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account.
NewValue	string	New value for changed registry key value.
NewValueType	string	New type of changed registry key value.
ObjectName	string	Name and other identifying information for the object for which access was requested. For example, for a file, the path would be included.
ObjectServer	string	Contains the name of the Windows subsystem calling the routine.
ObjectType	string	The type of an object that was accessed during the operation.
ObjectValueName	string	The name of modified registry key value.
OemInformation	string	The original equipment manufacturer (OEM) associated with a device or system in the event.
OldMaxUsers	string	The previous maximum number of users allowed for a resource in the event.
OldRemark	string	the old value of network share 'Comments:' field. Has 'N/A' value if it isn't set.
OldShareFlags	string	The previous share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.
OldUacValue	string	Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the previous value of userAccountControl attribute of user object.
OldValue	string	Old value for changed registry key value.
OldValueType	string	Old type of changed registry key value.
Opcode	string	The opcode element is defined by the SystemPropertiesType complex type.
OperationType	string	The type of operation which was performed on an object
PackageName	string	The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon.
ParentProcessName	string	The name of the parent process associated with the event.
PasswordHistoryLength	string	\Security Settings\Account Policies\Password Policy\Enforce password history" group policy. Numeric value.
PasswordLastSet	string	Last time the account's password was modified.
PasswordProperties	string	The password policies or properties associated with the event, for example: password length, complexity and expiration date.
PreviousDate	string	The previous date associated with the event.
PreviousTime	string	Previous time in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ.
PrimaryGroupId	string	Relative Identifier (RID) of user's object primary group.
PrivateKeyUsageCount	string	The number of times a private key has been used.
PrivilegeList	string	The privileges, including user, group, or system privileges associated with the event.
Process	string	The name of the process that generates the event.
ProcessId	string	Identifies the process that generated the event.
ProcessName	string	Full path and the name of the executable for the process.
ProfilePath	string	Specifies a path to the account's profile. This value can be a null string, a local absolute path, or a UNC path.
Properties	string	Depends on Object Type. This field can be empty or contain the list of the object properties that were accessed.
ProtocolSequence	string	Information about the protocol used for an authentication attempt.
ProxyPolicyName	string	Name of the policy that was used to configure the proxy server for connecting to the network.
QuarantineHelpURL	string	URL that provides help with troubleshooting a network quarantine issue.
QuarantineSessionID	string	Identifier of the session where the file was assessed for quarantine.
QuarantineSessionIdentifier	string	Identifier of the session where the file was assessed for quarantine.
QuarantineState	string	It shows whether the file is quarantined.
QuarantineSystemHealthResult	string	Report that shows the status of the files that have been quarantined.
RelativeTargetName	string	Relative name of the accessed target file or folder. This file-path is relative to the network share. If access was requested for the share itself, then this field appears as "".
RemoteIpAddress	string	The IP address of the computer that initiated a remote connection.
RemotePort	string	The port number of the remote computer that initiated a connection.
Requester	string	The event requester identifier.
RequestId	string	A unique identifier that's associated with particular requests, such as those made over HTTP.
_ResourceId	string	A unique identifier for the resource that the record is associated with
RestrictedAdminMode	string	Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.
RowsDeleted	string	The number of rows that were deleted as a part of a particular operation.
SamAccountName	string	logon name for account used to support clients and servers from previous versions of Windows (pre-Windows 2000 logon name).
ScriptPath	string	Specifies the path of the account's logon script.
SecurityDescriptor	string	Information about the security settings and permissions of a particular object or resource.
ServiceAccount	string	The security context that the service will run as when started.
ServiceFileName	string	Indicates the type of service that was registered with the Service Control Manager.
ServiceName	string	The name of installed service.
ServiceStartType	int	Contains information about how a particular service should be started, whether it should be started automatically or manually.
ServiceType	string	Indicates the type of service that was registered with the Service Control Manager.
SessionName	string	The name of the session to which the user was reconnected.
ShareLocalPath	string	The local path of accessed network share.
ShareName	string	The name of accessed network share. The format is: \*\SHARE_NAME.
SidHistory	string	Contains previous SIDs used for the object if the object was moved from another domain.
SourceComputerId	string	Unique identifier assigned to each computer in a Windows domain.
SourceSystem	string	The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Status	string	The reason why logon failed. For this event, it typically has '0xC0000234' value. The most common status codes are listed in Table 12. Windows logon status codes.
StorageAccount	string	Sets the storage account access key.
SubcategoryGuid	string	The unique GUID of changed subcategory.
SubcategoryId	string	A unique identifier for a specific type of the event.
Subject	string	Information about the security principal (for instance: user account) that initiated the event.
SubjectAccount	string	Information about the account that is initiating the event.
SubjectDomainName	string	Information about the domain or workgroup to which the subject account belongs.
SubjectKeyIdentifier	string	A unique identifier for a particular certificate subject.
SubjectLogonId	string	A unique identifier for the logon session associated with the subject account.
SubjectMachineName	string	Information about the machine or system from which the event was created.
SubjectMachineSID	string	The security identifier (SID) for the machine that generated the event.
SubjectUserName	string	The name of the user account that generated the event.
SubjectUserSid	string	The security identifier (SID) for the user account that generated the event.
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
SubStatus	string	Additional information about logon failure. The most common substatus codes listed in the 'Table 12. Windows logon status codes'.
SystemProcessId	int	Identifies the process that generated the event.
SystemThreadId	int	Identifies the thread that generated the event.
SystemUserId	string	The ID of the user who is responsible for the event.
TableId	string	The specific data table identifier the event data is stored in.
TargetAccount	string	The account targeted by the event (user name, computer name, etc).
TargetDomainName	string	The name of the domain that the target account belongs to.
TargetInfo	string	Additional information about the event target (for example: the path to a file or folder, the name of a registry key, etc).
TargetLinkedLogonId	string	Information that helps to link related events together by their logon attempt IDs. It can be useful in keeping all relevant events organized, tracking activity across multiple sessions, and identifying the attack source.
TargetLogonGuid	string	A globally unique identifier (GUID) associated with the logon session related to the event.
TargetLogonId	string	A unique identifier associated with the logon session related to the event.
TargetOutboundDomainName	string	The domain that the account specified in the TargetAccount field was authenticated against during an outbound authentication attempt.
TargetOutboundUserName	string	The name of the user account that was authenticated during an outbound authentication attempt.
TargetServerName	string	The name of the server on which the new process was run. Has "localhost" value if the process was run locally.
TargetSid	string	The security identifier (SID) of the server on which the new process was run.
TargetUser	string	The user account identifier that generated the new process.
TargetUserName	string	The name of the user account that generated the new process.
TargetUserSid	string	The security identifier (SID) associated with the user or resource involved in the event.
Task	int	The task defined in the event.
TemplateContent	string	The content of the event message or notification in a structured form.
TemplateDSObjectFQDN	string	FQDN of the DS object that represents the GPO template.
TemplateInternalName	string	The internal name of the GPO template.
TemplateOID	string	the unique identifier for the template that was used to create the event.
TemplateSchemaVersion	string	Version of the template schema that defines the data to include with an event.
TemplateVersion	string	Version of the template that defines the data to include with an event.
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The time stamp when the event was generated on the computer.
TokenElevationType	string	Type of token that was assigned to a new process in accordance with User Account Control Policy.
TransmittedServices	string	The list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user - most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see https://msdn.microsoft.com/library/cc246072.aspx.
Type	string	The name of the table
UserAccountControl	string	Shows the list of changes in userAccountControl attribute. You will see a line of text for each change.
UserParameters	string	If you change any setting using Active Directory Users and Computers management console in Dial-in tab of user's account properties, then you will see <value changed, but not displayed> in this field. For local accounts, this field is not applicable and always has <value not set> value.
UserPrincipalName	string	Internet-style login name for the account, based on the Internet standard RFC 822. By convention this should map to the account's email name.
UserWorkstations	string	Contains the list of NetBIOS or DNS names of the computers from which the user can logon. Each computer name is separated by a comma. The name of a computer is the sAMAccountName property of a computer object.
VendorIds	string	'Hardware Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details'.
Version	int	Contains the version number of the event's definition.
VirtualAccount	string	A 'Yes' or 'No' flag, which indicates if the account is a virtual account (e.g., 'Managed Service Account'), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using 'NetworkService'.
Workstation	string	The name of the machine that was used to perform the event.
WorkstationName	string	Machine name from which a logon attempt was performed.