Security events collected from windows machines by Azure Security Center or Azure Sentinel.

Table attributes

Attribute Value
Resource types microsoft.securityinsights/securityinsights,
Categories Security
Solutions Security, SecurityInsights
Basic log No
Ingestion-time transformation Yes
Sample Queries Yes


Column Type Description
AccessMask string
Account string
AccountDomain string
AccountExpires string
AccountName string
AccountSessionIdentifier string
AccountType string
Activity string
AdditionalInfo string
AdditionalInfo2 string
AllowedToDelegateTo string
Attributes string
AuditPolicyChanges string
AuditsDiscarded int
AuthenticationLevel int
AuthenticationPackageName string
AuthenticationProvider string
AuthenticationServer string
AuthenticationService int
AuthenticationType string
AzureDeploymentID string
_BilledSize real The record size in bytes
CACertificateHash string
CalledStationID string
CallerProcessId string
CallerProcessName string
CallingStationID string
CAPublicKeyHash string
CategoryId string
CertificateDatabaseHash string
Channel string
ClassId string
ClassName string
ClientAddress string
ClientIPAddress string
ClientName string
CommandLine string
CompatibleIds string
Computer string
DCDNSName string
DeviceDescription string
DeviceId string
DisplayName string
Disposition string
DomainBehaviorVersion string
DomainName string
DomainPolicyChanged string
DomainSid string
EAPType string
ElevatedToken string
ErrorCode int
EventData string
EventID int
EventSourceName string
ExtendedQuarantineState string
FailureReason string
FileHash string
FilePath string
FilePathNoUser string
Filter string
ForceLogoff string
Fqbn string
FullyQualifiedSubjectMachineName string
FullyQualifiedSubjectUserName string
GroupMembership string
HandleId string
HardwareIds string
HomeDirectory string
HomePath string
InterfaceUuid string
IpAddress string
IpPort string
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
KeyLength int
Level string
LmPackageName string
LocationInformation string
LockoutDuration string
LockoutObservationWindow string
LockoutThreshold string
LoggingResult string
LogonGuid string
LogonHours string
LogonID string
LogonProcessName string
LogonType int
LogonTypeName string
MachineAccountQuota string
MachineInventory string
MachineLogon string
ManagementGroupName string
MandatoryLabel string
MaxPasswordAge string
MemberName string
MemberSid string
MinPasswordAge string
MinPasswordLength string
MixedDomainMode string
NASIdentifier string
NASIPv4Address string
NASIPv6Address string
NASPort string
NASPortType string
NetworkPolicyName string
NewDate string
NewMaxUsers string
NewProcessId string
NewProcessName string
NewRemark string
NewShareFlags string
NewTime string
NewUacValue string
NewValue string
NewValueType string
ObjectName string
ObjectServer string
ObjectType string
ObjectValueName string
OemInformation string
OldMaxUsers string
OldRemark string
OldShareFlags string
OldUacValue string
OldValue string
OldValueType string
OperationType string
PackageName string
ParentProcessName string
PasswordHistoryLength string
PasswordLastSet string
PasswordProperties string
PreviousDate string
PreviousTime string
PrimaryGroupId string
PrivateKeyUsageCount string
PrivilegeList string
Process string
ProcessId string
ProcessName string
ProfilePath string
Properties string
ProtocolSequence string
ProxyPolicyName string
QuarantineHelpURL string
QuarantineSessionID string
QuarantineSessionIdentifier string
QuarantineState string
QuarantineSystemHealthResult string
RelativeTargetName string
RemoteIpAddress string
RemotePort string
Requester string
RequestId string
_ResourceId string A unique identifier for the resource that the record is associated with
RestrictedAdminMode string
RowsDeleted string
SamAccountName string
ScriptPath string
SecurityDescriptor string
ServiceAccount string
ServiceFileName string
ServiceName string
ServiceStartType int
ServiceType string
SessionName string
ShareLocalPath string
ShareName string
SidHistory string
SourceComputerId string
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Status string
StorageAccount string
SubcategoryGuid string
SubcategoryId string
Subject string
SubjectAccount string
SubjectDomainName string
SubjectKeyIdentifier string
SubjectLogonId string
SubjectMachineName string
SubjectMachineSID string
SubjectUserName string
SubjectUserSid string
_SubscriptionId string A unique identifier for the subscription that the record is associated with
SubStatus string
TableId string
TargetAccount string
TargetDomainName string
TargetInfo string
TargetLinkedLogonId string
TargetLogonGuid string
TargetLogonId string
TargetOutboundDomainName string
TargetOutboundUserName string
TargetServerName string
TargetSid string
TargetUser string
TargetUserName string
TargetUserSid string
Task int
TemplateContent string
TemplateDSObjectFQDN string
TemplateInternalName string
TemplateOID string
TemplateSchemaVersion string
TemplateVersion string
TimeGenerated datetime
TokenElevationType string
TransmittedServices string
Type string The name of the table
UserAccountControl string
UserParameters string
UserPrincipalName string
UserWorkstations string
VendorIds string
VirtualAccount string
Workstation string
WorkstationName string