UCDeviceAlert

Update Compliance - These alerts are activated as a result of an issue that is device-specific, and is not specific to a specific update and a specific device. Like UpdateAlerts, the AlertType indicates where the Alert comes from (ServiceDeviceAlert, ClientDeviceAlert). For example, an EndOfService alert is a ClientDeviceAlert, as the fact it is on a build no longer being serviced (EOS) is a client-wide state. Meanwhile, DeviceRegistrationIssues in WUfB DS will be a ServiceDeviceAlert, as it is a device-wide state in the service to not be correctly registered.

Table attributes

Attribute Value
Resource types -
Categories -
Solutions LogManagement, WaaSUpdateInsights
Basic log No
Ingestion-time transformation Yes
Sample Queries -

Columns

Column Type Description
AlertClassification string Whether this Alert is an Error, a Warning, or Informational.
AlertData string An optional string formatted as a json payload containing metadata for the alert.
AlertId string The unique identifier of this Alert.
AlertRank int Integer ranking of Alert for prioritization during troubleshooting.
AlertStatus string Whether this Alert is Active, Resolved, or Deleted.
AlertSubtype string The Subtype of Alert.
AlertType string The type of Alert this is, ClientUpdateAlert, ServiceUpdateAlert. Indicates which fields will be present.
AzureADDeviceId string A GUID corresponding to the AAD Tenant to which the device belongs.
AzureADTenantId string A GUID corresponding to this device's AAD Device ID.
_BilledSize real The record size in bytes
Description string A localized string translated from a combination of other Alert fields + language preference that describes the issue in detail.
DeviceName string Device's given name.
ErrorCode string The Error Code, if any, that triggered this Alert. In the case of Client-based explicit alerts, error codes can have extended error codes, which are appended to the error code with a underscore separator.
ErrorSymName string The symbolic name that maps to the Error Code, if any. Otherwise empty.
GlobalDeviceId string Microsoft internal Global Device Identifier.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
Recommendation string A localized string translated from RecommendedAction, Message, and other fields (depending on source of Alert) that provides a recommended action.
ResolvedTime datetime The time this alert was resolved, else empty.
SCCMClientId string A GUID corresponding to the SCCM Client ID on the device.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
StartTime datetime The time this alert was activated.
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Time at which this event is generated and logged.
Type string The name of the table
URL string An optional URL to get more in-depth information related to this alert.