Edit

Share via

Data source schema reference

  • Article

This article lists supported Azure and third-party data source schemas, with links to their reference documentation.

Azure data sources

Type Data source Log Analytics tablename Schema reference
Azure Microsoft Entra ID SigninEvents Microsoft Entra activity reports sign-in properties
Azure Microsoft Entra ID AuditLogs Azure Monitor AuditLogs reference
Azure Microsoft Entra ID AzureActivity Azure Monitor AzureActivity reference
Azure Office OfficeActivity Office 365 Management Activity API schemas:
- Common schema
- Exchange Admin schema
- Exchange Mailbox schema
- SharePoint Base schema
- SharePoint file operations
Azure Azure Key Vault AzureDiagnostics Azure Monitor AzureDiagnostics reference
Host Linux Syslog Azure Monitor Syslog reference
Network IIS Logs W3CIISLog Azure Monitor W3CIISLog reference
Network VMinsights VMConnection Azure Monitor VMConnection reference
Network Wire Data Solution WireData Azure Monitor WireData reference
Network NSG Flow Logs AzureNetworkAnalytics Schema and data aggregation in Traffic Analytics

Note

For more information, see the entire Azure Monitor data reference.

3rd-party vendor data sources

The following table lists supported third-party vendors and their Syslog or Common Event Format (CEF)-mapping documentation for various supported log types, which contain CEF field mappings and sample logs for each category type.

Type Vendor Product Log Analytics tablename CEF field-mapping reference
Network Palo Alto PAN OS CommonSecurityLog PAN-OS 9.0 Common Event Format Integration Guide (search for CEF- style Log Formats)
Network Check Point ALL CommonSecurityLog Log Fields Description
Network Fortigate ALL CommonSecurityLog Log Schema Structure
Network Barracuda Web Application Firewall CommonSecurityLog How to Configure Syslog and Other Logs
Network Cisco ASA CommonSecurityLog Cisco ASA Series Syslog Messages
Network Cisco Firepower CommonSecurityLog Cisco Firepower Threat Defense Syslog Messages
Network Cisco Umbrella Custom Logs Table Log Formats and Versioning
Network Cisco Meraki CommonSecurityLog Syslog Event Types and Log Samples
Network Zscaler Nano Streaming Service (NSS) CommonSecurityLog Formatting NSS Feeds (Web, Firewall, DNS, and Tunnel logs only)
Network F5 BigIP LTM CommonSecurityLog Event Messages and Attack Types
Network F5 BigIP ASM CommonSecurityLog Logging Application Security Events
Network Citrix Web App Firewall CommonSecurityLog Common Event Format (CEF) Logging Support in the Application Firewall
Host Symantec Symantec Endpoint Protection Manager (SEPM) CommonSecurityLog External Logging settings and log event severity levels for Endpoint Protection Manager
Host Trend Micro All CommonSecurityLog Syslog Content Mapping - CEF

Note

For more information, see also CEF and CommonSecurityLog field mapping.

Next steps

Learn more supported Microsoft Sentinel connectors, such as CEF, Syslog, direct, agent, and custom connectors: