SecurityEvent

Eventi di sicurezza raccolti dai computer Windows dal Centro sicurezza di Azure o Da Azure Sentinel.

Categorie

  • Sicurezza

Soluzioni

  • Security and Audit
  • Microsoft Sentinel

Tipi di risorsa

  • Macchine virtuali
  • VMware
  • Azure Stack HCI
  • System Center Virtual Machine Manager
  • Set di scalabilità di macchine virtuali

Colonne

Colonna Tipo Descrizione
Accessmask string
Account string
AccountDomain string
AccountExpires string
AccountName string
AccountSessionIdentifier string
AccountType string
Attività string
AdditionalInfo string
AdditionalInfo2 string
AllowedToDelegateTo string
Attributi string
AuditPolicyChanges string
AuditsDiscarded INT
AuthenticationLevel INT
AuthenticationPackageName string
AuthenticationProvider string
AuthenticationServer string
Authenticationservice INT
AuthenticationType string
AzureDeploymentID string
CACertificateHash string
ChiamataStationID string
CallerProcessId string
CallerProcessName string
CallingStationID string
CAPublicKeyHash string
CategoryId string
CertificateDatabaseHash string
Channel string
Classid string
ClassName string
ClientAddress string
ClientIPAddress string
ClientName string
CommandLine string
CompatibleIds string
Computer string
DCDNSName string
DeviceDescription string
DeviceId string
DisplayName string
Disposition string
DomainBehaviorVersion string
DomainName string
DomainPolicyChanged string
DomainSid string
EAPType string
ElevatedToken string
ErrorCode INT
EventData string
EventID INT
EventSourceName string
ExtendedQuarantineState string
FailureReason string
FileHash string
FilePath string
FilePathNoUser string
Filtra string
ForceLogoff string
Fqbn string
FullyQualifiedSubjectMachineName string
FullyQualifiedSubjectUserName string
GroupMembership string
HandleId string
HardwareIds string
HomeDirectory string
Homepath string
InterfaceUuid string
IpAddress string
IpPort string
KeyLength INT
Level string
LmPackageName string
LocationInformation string
LockoutDuration string
LockoutObservationWindow string
LockoutThreshold string
LoggingResult string
LogonGuid string
LogonHours string
LOGONID string
LogonProcessName string
LogonType INT
LogonTypeName string
MachineAccountQuota string
MachineInventory string
MachineLogon string
ManagementGroupName string
MandatoryLabel string
MaxPasswordAge string
MemberName string
MemberSid string
MinPasswordAge string
MinPasswordLength string
MixedDomainMode string
NASIdentifier string
NASIPv4Address string
NASIPv6Address string
NASPort string
NASPortType string
NetworkPolicyName string
NewDate string
NewMaxUsers string
NewProcessId string
NewProcessName string
NewRemark string
NewShareFlags string
NewTime string
NewUacValue string
Newvalue string
NewValueType string
ObjectName string
ObjectServer string
ObjectType string
ObjectValueName string
OemInformation string
OldMaxUsers string
OldRemark string
OldShareFlags string
OldUacValue string
Oldvalue string
OldValueType string
Tipo operazione string
PackageName string
ParentProcessName string
PasswordHistoryLength string
PasswordLastSet string
PasswordProperties string
PreviousDate string
PreviousTime string
PrimaryGroupId string
PrivateKeyUsageCount string
PrivilegeList string
Processo string
ProcessId string
ProcessName string
ProfilePath string
Proprietà string
ProtocolSequence string
ProxyPolicyName string
QuarantineHelpURL string
QuarantineSessionID string
QuarantineSessionIdentifier string
QuarantenaState string
QuarantineSystemHealthResult string
RelativeTargetName string
RemoteIpAddress string
Porta remota string
Richiedente string
RequestId string
_ResourceId string Identificatore univoco per la risorsa associata al record
RestrictedAdminMode string
RowsDeleted string
SamAccountName string
ScriptPath string
SecurityDescriptor string
ServiceAccount string
ServiceFileName string
ServiceName string
ServiceStartType INT
ServiceType string
SessionName string
ShareLocalPath string
ShareName string
Sidhistory string
SourceComputerId string
SourceSystem string
Stato string
StorageAccount string
SottocategoryGuid string
SottocategoryId string
Oggetto string
SubjectAccount string
SubjectDomainName string
SubjectKeyIdentifier string
SubjectLogonId string
SubjectMachineName string
SubjectMachineSID string
SubjectUserName string
SubjectUserSid string
_SubscriptionId string Identificatore univoco per la sottoscrizione associata al record
SubStatus string
TableId string
TargetAccount string
Targetdomainname string
TargetInfo string
TargetLinkedLogonId string
TargetLogonGuid string
TargetLogonId string
TargetOutboundDomainName string
TargetOutboundUserName string
TargetServerName string
TargetSid string
TargetUser string
TargetUserName string
TargetUserSid string
Attività INT
TemplateContent string
TemplateDSObjectFQDN string
TemplateInternalName string
TemplateOID string
TemplateSchemaVersion string
TemplateVersion string
TimeGenerated Datetime
TokenElevationType string
TransmittedServices string
Type string Nome della tabella
Useraccountcontrol string
Userparameters string
UserPrincipalName string
UserWorkstations string
VendorIds string
VirtualAccount string
Workstation string
WorkstationName string