Events
Mar 17, 9 PM - Mar 21, 10 AM
Join the meetup series to build scalable AI solutions based on real-world use cases with fellow developers and experts.
Register nowThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Windows events which are collected and sent by the agent.
Attribute | Value |
---|---|
Resource types | - |
Categories | Security |
Solutions | CustomizedWindowsEventsFiltering, InternalWindowsEvent, SecurityInsights, WEFInternalUat, WEF_10x, WEF_10xDSRE, WinLog, WindowsEventForwarding |
Basic log | No |
Ingestion-time transformation | Yes |
Sample Queries | Yes |
Column | Type | Description |
---|---|---|
_BilledSize | real | The record size in bytes |
Channel | string | The channel to which the event was logged. |
Computer | string | The name of the computer on which the event occurred. |
Correlation | string | The activity identifiers that consumers can use to group related events together. |
EventData | dynamic | Contains the event data parsed to dynamic type. If the parsing fails then this field will contain null and the RawEventData field will be populated. |
EventID | int | The identifier that the provider used to identify the event. |
EventLevel | int | Contains the severity level of the event. |
EventLevelName | string | The rendered message string of the level specified in the event. |
EventOriginId | string | VM ID obtained from the Azure Instance Metadata Service (IMDS). |
EventRecordId | string | The record number assigned to the event when it was logged. |
_IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
Keywords | string | A bitmask of the keywords defined in the event. |
ManagementGroupName | string | Additional information based on the resource type. |
Opcode | string | The opcode element is defined by the SystemPropertiesType complex type. |
Provider | string | System Properties Type - Identifies the provider that logged the event. |
RawEventData | string | The raw event XML when parsing fails. It's null when parsing successful. |
_ResourceId | string | A unique identifier for the resource that the record is associated with |
_SubscriptionId | string | A unique identifier for the subscription that the record is associated with |
SystemProcessId | int | Identifies the process that generated the event. |
SystemThreadId | int | Identifies the thread that generated the event. |
SystemUserId | string | The ID of the user who is responsible for the event. |
Task | int | The task defined in the event. |
TenantId | string | The Log Analytics workspace ID |
TimeGenerated | datetime | The time stamp when the event was generated on the computer. |
Type | string | The name of the table |
Version | int | Contains the version number of the event's definition. |
Events
Mar 17, 9 PM - Mar 21, 10 AM
Join the meetup series to build scalable AI solutions based on real-world use cases with fellow developers and experts.
Register nowTraining
Module
Manage and monitor Windows Server event logs - Training
Learn how Event Viewer provides a convenient and accessible location for you to observe events that occur. Access event information quickly and conveniently. Learn how to interpret the data in the event log.