Azure Monitor Log Analytics log tables organized by category
Applications
- AEWExperimentAssignmentSummary
- AEWExperimentScorecardMetricPairs
- AEWExperimentScorecards
- AppAvailabilityResults
- AppBrowserTimings
- AppDependencies
- AppEvents
- AppExceptions
- AppMetrics
- AppPageViews
- AppPerformanceCounters
- AppRequests
- AppServiceConsoleLogs
- AppSystemEvents
- AppTraces
- ContainerLog
- FunctionAppLogs
Audit
- AACAudit
- AADB2CRequestLogs
- AADCustomSecurityAttributeAuditLogs
- AADManagedIdentitySignInLogs
- AADNonInteractiveUserSignInLogs
- AADProvisioningLogs
- AADRiskyServicePrincipals
- AADRiskyUsers
- AADServicePrincipalRiskEvents
- AADServicePrincipalSignInLogs
- AADUserRiskEvents
- ACICollaborationAudit
- ACRConnectedClientList
- ACREntraAuthenticationAuditLog
- ADFSSignInLogs
- AEWAssignmentBlobLogs
- AEWAuditLogs
- AEWComputePipelinesLogs
- AFSAuditLogs
- AGSGrafanaLoginEvents
- AGSGrafanaUsageInsightsEvents
- AGWAccessLogs
- AGWFirewallLogs
- AGWPerformanceLogs
- AHDSDeidAuditLogs
- AHDSDicomAuditLogs
- AKSAudit
- AKSAuditAdmin
- AMSKeyDeliveryRequests
- AMSLiveEventOperations
- AMSMediaAccountHealth
- AMSStreamingEndpointRequests
- AOIDatabaseQuery
- AOIStorage
- ASCAuditLogs
- ASCDeviceEvents
- ASRJobs
- ASRReplicatedItems
- AVNMConnectivityConfigurationChange
- AVNMIPAMPoolAllocationChange
- AVNMNetworkGroupMembershipChange
- AVNMRuleCollectionChange
- AZKVAuditLogs
- AZKVPolicyEvaluationDetailsLogs
- AZMSApplicationMetricLogs
- AZMSArchiveLogs
- AZMSAutoscaleLogs
- AZMSCustomerManagedKeyUserLogs
- AZMSDiagnosticErrorLogs
- AZMSHybridConnectionsEvents
- AZMSKafkaCoordinatorLogs
- AZMSKafkaUserErrorLogs
- AZMSOperationalLogs
- AZMSRunTimeAuditLogs
- AZMSVnetConnectionEvents
- AegDataPlaneRequests
- AgriFoodApplicationAuditLogs
- AmlComputeInstanceEvent
- AmlDataLabelEvent
- AmlDataSetEvent
- AmlDataStoreEvent
- AmlDeploymentEvent
- AmlEnvironmentEvent
- AmlInferencingEvent
- AmlModelsEvent
- AmlOnlineEndpointConsoleLog
- AmlOnlineEndpointEventLog
- AmlOnlineEndpointTrafficLog
- AmlPipelineEvent
- AmlRegistryReadEventsLog
- AmlRegistryWriteEventsLog
- AmlRunEvent
- AppEnvSpringAppConsoleLogs
- ArcK8sAudit
- ArcK8sAuditAdmin
- AzureActivity
- AzureBackupOperations
- AzureLoadTestingOperation
- CCFApplicationLogs
- CDBCassandraRequests
- CDBControlPlaneRequests
- CDBDataPlaneRequests
- CDBGremlinRequests
- CDBMongoRequests
- CDBPartitionKeyRUConsumption
- CDBPartitionKeyStatistics
- CDBQueryRuntimeStatistics
- CDBTableApiRequests
- CIEventsAudit
- CassandraAudit
- ChaosStudioExperimentEventLogs
- CloudHsmServiceOperationAuditLogs
- CommunicationComplianceActivity
- ContainerAppConsoleLogs
- ContainerAppSystemLogs
- ContainerEvent
- ContainerInstanceLog
- DatabricksApps
- DatabricksBrickStoreHttpGateway
- DatabricksBudgetPolicyCentral
- DatabricksCloudStorageMetadata
- DatabricksClusterPolicies
- DatabricksDashboards
- DatabricksDataMonitoring
- DatabricksDataRooms
- DatabricksFiles
- DatabricksFilesystem
- DatabricksGroups
- DatabricksIngestion
- DatabricksLakeviewConfig
- DatabricksLineageTracking
- DatabricksMarketplaceConsumer
- DatabricksMarketplaceProvider
- DatabricksOnlineTables
- DatabricksPredictiveOptimization
- DatabricksRBAC
- DatabricksRFA
- DatabricksVectorSearch
- DatabricksWebhookNotifications
- DatabricksWorkspaceFiles
- DataverseActivity
- DevCenterDiagnosticLogs
- EGNSuccessfulMqttConnections
- HDInsightGatewayAuditLogs
- HDInsightRangerAuditLogs
- LAQueryLogs
- MicrosoftGraphActivityLogs
- MicrosoftHealthcareApisAuditLogs
- MicrosoftPurviewInformationProtection
- NSPAccessLogs
- OEPAuditLogs
- PFTitleAuditLogs
- PowerAppsActivity
- PowerAutomateActivity
- PowerBIActivity
- PowerPlatformAdminActivity
- PowerPlatformConnectorActivity
- PowerPlatformDlpActivity
- REDConnectionEvents
- SentinelAudit
- VCoreMongoRequests
- VIAudit
- Windows365AuditLogs
Azure Monitor
- ALBHealthEvent
- AMWMetricsUsageDetails
- Alert
- AlertHistory
- AutoscaleEvaluationsLog
- AutoscaleScaleActionsLog
- AzureMetricsV2
- ComputerGroup
- Operation
- Usage
- WorkloadDiagnosticLogs
Azure Resources
- AACHttpRequest
- AADDomainServicesAccountLogon
- AADDomainServicesAccountManagement
- AADDomainServicesDirectoryServiceAccess
- AADDomainServicesLogonLogoff
- AADDomainServicesPolicyChange
- AADDomainServicesPrivilegeUse
- ABSBotRequests
- ACICollaborationAudit
- ACRConnectedClientList
- ACREntraAuthenticationAuditLog
- ACSAdvancedMessagingOperations
- ACSAuthIncomingOperations
- ACSBillingUsage
- ACSCallAutomationIncomingOperations
- ACSCallAutomationMediaSummary
- ACSCallClientMediaStatsTimeSeries
- ACSCallClientOperations
- ACSCallClosedCaptionsSummary
- ACSCallDiagnostics
- ACSCallDiagnosticsUpdates
- ACSCallRecordingIncomingOperations
- ACSCallRecordingSummary
- ACSCallSummary
- ACSCallSummaryUpdates
- ACSCallSurvey
- ACSChatIncomingOperations
- ACSEmailSendMailOperational
- ACSEmailStatusUpdateOperational
- ACSEmailUserEngagementOperational
- ACSJobRouterIncomingOperations
- ACSRoomsIncomingOperations
- ACSSMSIncomingOperations
- ADFActivityRun
- ADFPipelineRun
- ADFSandboxActivityRun
- ADFSandboxPipelineRun
- ADFTriggerRun
- ADTDataHistoryOperation
- ADTDigitalTwinsOperation
- ADTEventRoutesOperation
- ADTModelsOperation
- ADTQueryOperation
- ADXJournal
- ADXTableDetails
- AEWAssignmentBlobLogs
- AEWAuditLogs
- AEWComputePipelinesLogs
- AFSAuditLogs
- AGCAccessLogs
- AGSGrafanaLoginEvents
- AGSGrafanaUsageInsightsEvents
- AGWAccessLogs
- AGWFirewallLogs
- AGWPerformanceLogs
- AHDSDeidAuditLogs
- AHDSDicomAuditLogs
- AHDSDicomDiagnosticLogs
- AHDSMedTechDiagnosticLogs
- AKSAudit
- AKSAuditAdmin
- AKSControlPlane
- ALBHealthEvent
- AMSKeyDeliveryRequests
- AMSLiveEventOperations
- AMSMediaAccountHealth
- AMSStreamingEndpointRequests
- AMWMetricsUsageDetails
- AOIDatabaseQuery
- AOIStorage
- ASCAuditLogs
- ASCDeviceEvents
- ATCExpressRouteCircuitIpfix
- ATCPrivatePeeringMetadata
- AVNMConnectivityConfigurationChange
- AVNMIPAMPoolAllocationChange
- AVNMNetworkGroupMembershipChange
- AVNMRuleCollectionChange
- AZFWFlowTrace
- AZKVAuditLogs
- AZKVPolicyEvaluationDetailsLogs
- AZMSApplicationMetricLogs
- AZMSArchiveLogs
- AZMSAutoscaleLogs
- AZMSCustomerManagedKeyUserLogs
- AZMSHybridConnectionsEvents
- AZMSKafkaCoordinatorLogs
- AZMSKafkaUserErrorLogs
- AZMSOperationalLogs
- AZMSVnetConnectionEvents
- AddonAzureBackupAlerts
- AddonAzureBackupJobs
- AddonAzureBackupPolicy
- AddonAzureBackupProtectedInstance
- AddonAzureBackupStorage
- AegDataPlaneRequests
- AegDeliveryFailureLogs
- AegPublishFailureLogs
- AgriFoodApplicationAuditLogs
- AgriFoodFarmManagementLogs
- AgriFoodFarmOperationLogs
- AgriFoodInsightLogs
- AgriFoodJobProcessedLogs
- AgriFoodModelInferenceLogs
- AgriFoodProviderAuthLogs
- AgriFoodSatelliteLogs
- AgriFoodSensorManagementLogs
- AgriFoodWeatherLogs
- AmlComputeClusterEvent
- AmlComputeClusterNodeEvent
- AmlComputeCpuGpuUtilization
- AmlComputeInstanceEvent
- AmlComputeJobEvent
- AmlDataLabelEvent
- AmlDataSetEvent
- AmlDataStoreEvent
- AmlDeploymentEvent
- AmlEnvironmentEvent
- AmlInferencingEvent
- AmlModelsEvent
- AmlOnlineEndpointConsoleLog
- AmlOnlineEndpointEventLog
- AmlOnlineEndpointTrafficLog
- AmlPipelineEvent
- AmlRegistryReadEventsLog
- AmlRegistryWriteEventsLog
- AmlRunEvent
- AmlRunStatusChangedEvent
- ApiManagementGatewayLogs
- ApiManagementWebSocketConnectionLogs
- AppEnvSpringAppConsoleLogs
- AppPlatformContainerEventLogs
- AppPlatformIngressLogs
- AppPlatformLogsforSpring
- AppPlatformSystemLogs
- AppServiceAppLogs
- AppServiceAuditLogs
- AppServiceAuthenticationLogs
- AppServiceConsoleLogs
- AppServiceFileAuditLogs
- AppServiceHTTPLogs
- AppServicePlatformLogs
- ArcK8sAudit
- ArcK8sAuditAdmin
- ArcK8sControlPlane
- AuditLogs
- AutoscaleEvaluationsLog
- AutoscaleScaleActionsLog
- AzureActivity
- AzureAttestationDiagnostics
- AzureDiagnostics
- AzureLoadTestingOperation
- AzureMetrics
- AzureMetricsV2
- BlockchainApplicationLog
- BlockchainProxyLog
- CCFApplicationLogs
- CDBCassandraRequests
- CDBControlPlaneRequests
- CDBDataPlaneRequests
- CDBGremlinRequests
- CDBMongoRequests
- CDBPartitionKeyRUConsumption
- CDBPartitionKeyStatistics
- CDBQueryRuntimeStatistics
- CDBTableApiRequests
- CIEventsAudit
- CIEventsOperational
- ChaosStudioExperimentEventLogs
- CloudHsmServiceOperationAuditLogs
- ContainerAppConsoleLogs
- ContainerAppSystemLogs
- ContainerEvent
- ContainerInstanceLog
- CoreAzureBackup
- DCRLogErrors
- DNSQueryLogs
- DSMDataClassificationLogs
- DSMDataLabelingLogs
- DataTransferOperations
- DatabricksAccounts
- DatabricksApps
- DatabricksBrickStoreHttpGateway
- DatabricksBudgetPolicyCentral
- DatabricksCloudStorageMetadata
- DatabricksClusterPolicies
- DatabricksClusters
- DatabricksDBFS
- DatabricksDashboards
- DatabricksDataMonitoring
- DatabricksDataRooms
- DatabricksDatabricksSQL
- DatabricksFeatureStore
- DatabricksFiles
- DatabricksFilesystem
- DatabricksGenie
- DatabricksGitCredentials
- DatabricksGlobalInitScripts
- DatabricksGroups
- DatabricksIAMRole
- DatabricksIngestion
- DatabricksInstancePools
- DatabricksJobs
- DatabricksLakeviewConfig
- DatabricksLineageTracking
- DatabricksMLflowAcledArtifact
- DatabricksMLflowExperiment
- DatabricksMarketplaceConsumer
- DatabricksMarketplaceProvider
- DatabricksNotebook
- DatabricksOnlineTables
- DatabricksPredictiveOptimization
- DatabricksRBAC
- DatabricksRFA
- DatabricksRemoteHistoryService
- DatabricksSQLPermissions
- DatabricksSSH
- DatabricksSecrets
- DatabricksVectorSearch
- DatabricksWebTerminal
- DatabricksWebhookNotifications
- DatabricksWorkspace
- DatabricksWorkspaceFiles
- DevCenterBillingEventLogs
- DevCenterDiagnosticLogs
- DevCenterResourceOperationLogs
- EGNFailedHttpDataPlaneOperations
- EGNFailedMqttConnections
- EGNFailedMqttPublishedMessages
- EGNFailedMqttSubscriptions
- EGNMqttDisconnections
- EGNSuccessfulHttpDataPlaneOperations
- EGNSuccessfulMqttConnections
- FailedIngestion
- FunctionAppLogs
- HDInsightAmbariClusterAlerts
- HDInsightAmbariSystemMetrics
- HDInsightGatewayAuditLogs
- HDInsightHBaseLogs
- HDInsightHBaseMetrics
- HDInsightHadoopAndYarnLogs
- HDInsightHadoopAndYarnMetrics
- HDInsightHiveAndLLAPLogs
- HDInsightHiveAndLLAPMetrics
- HDInsightHiveQueryAppStats
- HDInsightHiveTezAppStats
- HDInsightJupyterNotebookEvents
- HDInsightKafkaLogs
- HDInsightKafkaMetrics
- HDInsightOozieLogs
- HDInsightRangerAuditLogs
- HDInsightSecurityLogs
- HDInsightSparkApplicationEvents
- HDInsightSparkBlockManagerEvents
- HDInsightSparkEnvironmentEvents
- HDInsightSparkExecutorEvents
- HDInsightSparkExtraEvents
- HDInsightSparkJobEvents
- HDInsightSparkLogs
- HDInsightSparkSQLExecutionEvents
- HDInsightSparkStageEvents
- HDInsightSparkStageTaskAccumulables
- HDInsightSparkTaskEvents
- HDInsightStormLogs
- HDInsightStormMetrics
- HDInsightStormTopologyMetrics
- InsightsMetrics
- IoTHubDistributedTracing
- LASummaryLogs
- LogicAppWorkflowRuntime
- MCCEventLogs
- MCVPAuditLogs
- MCVPOperationLogs
- MicrosoftAzureBastionAuditLogs
- MicrosoftDataShareReceivedSnapshotLog
- MicrosoftDataShareSentSnapshotLog
- MicrosoftHealthcareApisAuditLogs
- NCBMBreakGlassAuditLogs
- NCBMSecurityDefenderLogs
- NCBMSecurityLogs
- NCBMSystemLogs
- NCCKubernetesLogs
- NCCPlatformOperationsLogs
- NCCVMOrchestrationLogs
- NCMClusterOperationsLogs
- NCSStorageAlerts
- NCSStorageAudits
- NCSStorageLogs
- NGXOperationLogs
- NGXSecurityLogs
- NSPAccessLogs
- OEPAirFlowTask
- OEPAuditLogs
- OEPDataplaneLogs
- OEPElasticOperator
- OEPElasticsearch
- OLPSupplyChainEntityOperations
- OLPSupplyChainEvents
- PFTitleAuditLogs
- PowerBIDatasetsTenant
- PowerBIDatasetsWorkspace
- PurviewDataSensitivityLogs
- PurviewScanStatusLogs
- PurviewSecurityLogs
- REDConnectionEvents
- ResourceManagementPublicAccessLogs
- SQLSecurityAuditEvents
- ServiceFabricOperationalEvent
- ServiceFabricReliableActorEvent
- ServiceFabricReliableServiceEvent
- SignalRServiceDiagnosticLogs
- SigninLogs
- StorageBlobLogs
- StorageCacheOperationEvents
- StorageCacheUpgradeEvents
- StorageCacheWarningEvents
- StorageFileLogs
- StorageMalwareScanningResults
- StorageMoverCopyLogsFailed
- StorageMoverCopyLogsTransferred
- StorageMoverJobRunLogs
- StorageQueueLogs
- StorageTableLogs
- SucceededIngestion
- SynapseBigDataPoolApplicationsEnded
- SynapseBuiltinSqlPoolRequestsEnded
- SynapseDXCommand
- SynapseDXFailedIngestion
- SynapseDXIngestionBatching
- SynapseDXQuery
- SynapseDXSucceededIngestion
- SynapseDXTableDetails
- SynapseDXTableUsageStatistics
- SynapseGatewayApiRequests
- SynapseIntegrationActivityRuns
- SynapseIntegrationPipelineRuns
- SynapseIntegrationTriggerRuns
- SynapseLinkEvent
- SynapseRbacOperations
- SynapseScopePoolScopeJobsEnded
- SynapseScopePoolScopeJobsStateChange
- SynapseSqlPoolDmsWorkers
- SynapseSqlPoolExecRequests
- SynapseSqlPoolRequestSteps
- SynapseSqlPoolSqlRequests
- SynapseSqlPoolWaits
- TSIIngress
- VIIndexing
- WebPubSubConnectivity
- WebPubSubHttpRequest
- WebPubSubMessaging
Azure Virtual Desktop
- WVDAutoscaleEvaluationPooled
- WVDCheckpoints
- WVDConnectionGraphicsDataPreview
- WVDConnectionNetworkData
- WVDConnections
- WVDErrors
- WVDFeeds
- WVDHostRegistrations
- WVDManagement
- WVDSessionHostManagement
Containers
- AKSAudit
- AKSAuditAdmin
- AKSControlPlane
- ArcK8sAudit
- ArcK8sAuditAdmin
- ArcK8sControlPlane
- ContainerImageInventory
- ContainerInventory
- ContainerLog
- ContainerLogV2
- ContainerNodeInventory
- ContainerRegistryLoginEvents
- ContainerRegistryRepositoryEvents
- ContainerServiceLog
- Heartbeat
- InsightsMetrics
- KubeEvents
- KubeMonAgentEvents
- KubeNodeInventory
- KubePVInventory
- KubePodInventory
- KubeServices
- Perf
Desktop Analytics
- DHAppReliability
- DHDriverReliability
- DHLogonFailures
- DHLogonMetrics
- DHOSCrashData
- DHOSReliability
- DHWipAppLearning
- MAApplication
- MAApplicationHealth
- MAApplicationHealthAlternativeVersions
- MAApplicationHealthIssues
- MAApplicationInstance
- MAApplicationInstanceReadiness
- MAApplicationReadiness
- MADeploymentPlan
- MADevice
- MADeviceNRT
- MADeviceNotEnrolled
- MADeviceReadiness
- MADriverInstanceReadiness
- MADriverReadiness
- MAOfficeAddin
- MAOfficeAddinInstance
- MAOfficeAddinReadiness
- MAOfficeAppInstance
- MAOfficeAppReadiness
- MAOfficeBuildInfo
- MAOfficeCurrencyAssessment
- MAOfficeSuiteInstance
- MAProposedPilotDevices
- MAWindowsBuildInfo
- MAWindowsCurrencyAssessment
- MAWindowsCurrencyAssessmentDailyCounts
- MAWindowsDeploymentStatus
- MAWindowsDeploymentStatusNRT
- UAApp
- UAComputer
- UAComputerRank
- UADriver
- UADriverProblemCodes
- UAFeedback
- UAIESiteDiscovery
- UAOfficeAddIn
- UAProposedActionPlan
- UASysReqIssue
- UAUpgradedComputer
- UCDOAggregatedStatus
- UCDOStatus
- WDAVStatus
- WDAVThreat
- WUDOAggregatedStatus
- WUDOStatus
- WaaSDeploymentStatus
- WaaSInsiderStatus
- WaaSUpdateStatus
IT & Management Tools
- AddonAzureBackupAlerts
- AddonAzureBackupJobs
- AddonAzureBackupPolicy
- AddonAzureBackupProtectedInstance
- AddonAzureBackupStorage
- ComputerGroup
- ConfigurationChange
- ConfigurationData
- CoreAzureBackup
- EnrichedMicrosoft365AuditLogs
- Heartbeat
- IntuneAuditLogs
- IntuneDeviceComplianceOrg
- IntuneDevices
- IntuneOperationalLogs
- NetworkAccessAlerts
- NetworkAccessTraffic
- RemoteNetworkHealthLogs
- Update
- UpdateRunProgress
- W3CIISLog
Network
- AGWAccessLogs
- AGWFirewallLogs
- AGWPerformanceLogs
- AVNMConnectivityConfigurationChange
- AVNMIPAMPoolAllocationChange
- AVNMNetworkGroupMembershipChange
- AVNMRuleCollectionChange
- AzureDiagnostics
- DnsEvents
- DnsInventory
- EnrichedMicrosoft365AuditLogs
- MNFDeviceUpdates
- MNFSystemSessionHistoryUpdates
- MNFSystemStateMessageUpdates
- NSPAccessLogs
- NTAInsights
- NTAIpDetails
- NTANetAnalytics
- NTATopologyDetails
- NWConnectionMonitorDNSResult
- NWConnectionMonitorPathResult
- NWConnectionMonitorTestResult
- NetworkAccessAlerts
- NetworkAccessTraffic
- NetworkMonitoring
- RemoteNetworkHealthLogs
Security
- AADB2CRequestLogs
- AADCustomSecurityAttributeAuditLogs
- AADDomainServicesAccountLogon
- AADDomainServicesAccountManagement
- AADDomainServicesDirectoryServiceAccess
- AADDomainServicesLogonLogoff
- AADDomainServicesPolicyChange
- AADDomainServicesPrivilegeUse
- AADManagedIdentitySignInLogs
- AADNonInteractiveUserSignInLogs
- AADProvisioningLogs
- AADRiskyServicePrincipals
- AADRiskyUsers
- AADServicePrincipalRiskEvents
- AADServicePrincipalSignInLogs
- AADUserRiskEvents
- ABAPAuditLog
- ADFSSignInLogs
- ASimAuditEventLogs
- ASimAuthenticationEventLogs
- ASimDhcpEventLogs
- ASimDnsActivityLogs
- ASimFileEventLogs
- ASimNetworkSessionLogs
- ASimProcessEventLogs
- ASimRegistryEventLogs
- ASimUserManagementActivityLogs
- ASimWebSessionLogs
- AWSCloudTrail
- AWSCloudWatch
- AWSGuardDuty
- AWSVPCFlow
- AWSWAF
- AZFWApplicationRule
- AZFWApplicationRuleAggregation
- AZFWDnsQuery
- AZFWFatFlow
- AZFWIdpsSignature
- AZFWInternalFqdnResolutionFailure
- AZFWNatRule
- AZFWNatRuleAggregation
- AZFWNetworkRule
- AZFWNetworkRuleAggregation
- AZFWThreatIntel
- AggregatedSecurityAlert
- AlertEvidence
- AlertInfo
- Anomalies
- AppServiceServerlessSecurityPluginData
- AuditLogs
- AzureActivity
- AzureDiagnostics
- BehaviorAnalytics
- CloudAppEvents
- CommonSecurityLog
- CommunicationComplianceActivity
- ConfidentialWatchlist
- DSMDataClassificationLogs
- DSMDataLabelingLogs
- DataverseActivity
- DeviceEvents
- DeviceFileCertificateInfo
- DeviceFileEvents
- DeviceImageLoadEvents
- DeviceInfo
- DeviceLogonEvents
- DeviceNetworkEvents
- DeviceNetworkInfo
- DeviceProcessEvents
- DeviceRegistryEvents
- DeviceTvmSecureConfigurationAssessment
- DeviceTvmSecureConfigurationAssessmentKB
- DeviceTvmSoftwareInventory
- DeviceTvmSoftwareVulnerabilities
- DeviceTvmSoftwareVulnerabilitiesKB
- DnsAuditEvents
- DynamicEventCollection
- EmailAttachmentInfo
- EmailEvents
- EmailPostDeliveryEvents
- EmailUrlInfo
- EnrichedMicrosoft365AuditLogs
- GCPAuditLogs
- GCPFirewallLogs
- GoogleCloudSCC
- HDInsightSecurityLogs
- HuntingBookmark
- IdentityDirectoryEvents
- IdentityLogonEvents
- IdentityQueryEvents
- LinuxAuditLog
- MDCDetectionDNSEvents
- MDCDetectionFimEvents
- MDCDetectionGatingValidationEvents
- MDCFileIntegrityMonitoringEvents
- MDECustomCollectionDeviceFileEvents
- McasShadowItReporting
- MicrosoftGraphActivityLogs
- MicrosoftPurviewInformationProtection
- NCBMBreakGlassAuditLogs
- NCBMSecurityDefenderLogs
- NCBMSecurityLogs
- NSPAccessLogs
- NetworkAccessAlerts
- NetworkAccessTraffic
- NetworkSessions
- OfficeActivity
- PowerAppsActivity
- PowerAutomateActivity
- PowerBIActivity
- PowerPlatformAdminActivity
- PowerPlatformConnectorActivity
- PowerPlatformDlpActivity
- ProjectActivity
- ProtectionStatus
- PurviewDataSensitivityLogs
- RemoteNetworkHealthLogs
- SecurityAlert
- SecurityAttackPathData
- SecurityBaseline
- SecurityBaselineSummary
- SecurityDetection
- SecurityEvent
- SecurityIoTRawEvent
- SecurityRecommendation
- SentinelAudit
- SentinelHealth
- SigninLogs
- StorageMalwareScanningResults
- Syslog
- ThreatIntelIndicators
- ThreatIntelObjects
- ThreatIntelligenceIndicator
- Update
- UrlClickEvents
- UserAccessAnalytics
- UserPeerAnalytics
- Watchlist
- WindowsEvent
- WindowsFirewall
- WireData
Virtual Machines
- AutoscaleEvaluationsLog
- AutoscaleScaleActionsLog
- ComputerGroup
- ETWEvent
- Event
- Heartbeat
- InsightsMetrics
- Perf
- Syslog
- UpdateSummary
- VMBoundPort
- VMComputer
- VMConnection
- VMProcess
- W3CIISLog
- WVDAgentHealthStatus
- WireData
Workloads
- ADAssessmentRecommendation
- ADReplicationResult
- ADSecurityAssessmentRecommendation
- AzureAssessmentRecommendation
- DeviceAppCrash
- DeviceAppLaunch
- DeviceCalendar
- DeviceCleanup
- DeviceConnectSession
- DeviceEtw
- DeviceHardwareHealth
- DeviceHealth
- DeviceHeartbeat
- DeviceSkypeHeartbeat
- DeviceSkypeSignIn
- ExchangeAssessmentRecommendation
- ExchangeOnlineAssessmentRecommendation
- MicrosoftDynamicsTelemetryPerformanceLogs
- MicrosoftDynamicsTelemetrySystemMetricsLogs
- SCCMAssessmentRecommendation
- SCOMAssessmentRecommendation
- SPAssessmentRecommendation
- SQLAssessmentRecommendation
- SfBAssessmentRecommendation
- SfBOnlineAssessmentRecommendation
- SharePointOnlineAssessmentRecommendation
- SqlVulnerabilityAssessmentResult
- WindowsClientAssessmentRecommendation
- WindowsServerAssessmentRecommendation
- WorkloadDiagnosticLogs
- WorkloadMonitoringPerf