| AdditionalEventData |
string |
Additional data about the event that was not part of the request or response. |
| APIVersion |
string |
Identifies the API version associated with the AwsApiCall eventType value. |
| AwsEventId |
string |
GUID generated by CloudTrail to uniquely identify each event. You can use this value to identify a single event. |
| AWSRegion |
string |
The AWS region that the request was made to. |
| AwsRequestId |
string |
deprecated, please use AwsRequestId_ instead. |
| AwsRequestId_ |
string |
The value that identifies the request. The service being called generates this value. |
| _BilledSize |
real |
The record size in bytes |
| Category |
string |
Shows the event category that is used in LookupEvents calls. |
| CidrIp |
string |
The CIDR IP is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The IPv4 CIDR range. |
| CipherSuite |
string |
Optional. Part of tlsDetails. The cipher suite (combination of security algorithms used) of a request. |
| ClientProvidedHostHeader |
string |
Optional. Part of tlsDetails. The client-provided host name used in the service API call, which is typically the FQDN of the service endpoint. |
| DestinationPort |
string |
The DestinationPort is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The end of port range for the TCP and UDP protocols, or an ICMP code. |
| EC2RoleDelivery |
string |
The friendly name of the user or role that issued the session. |
| ErrorCode |
string |
The AWS service error if the request returns an error. |
| ErrorMessage |
string |
The error description when available. This message includes messages for authorization failures. CloudTrail captures the message logged by the service in its exception handling. |
| EventName |
string |
The requested action, which is one of the actions in the API for that service. |
| EventSource |
string |
The service that the request was made to. This name is typically a short form of the service name without spaces plus .amazonaws.com. |
| EventTypeName |
string |
Identifies the type of event that generated the event record. This can be the one of the following values: AwsApiCall, AwsServiceEvent, AwsConsoleAction , AwsConsoleSignIn. |
| EventVersion |
string |
The version of the log event format. |
| IpProtocol |
string |
The IP protocol is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The IP protocol name or number. The valid values are tcp, udp, icmp, or a protocol number. |
| _IsBillable |
string |
Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
| ManagementEvent |
bool |
A Boolean value that identifies whether the event is a management event. |
| OperationName |
string |
Constant value: CloudTrail. |
| ReadOnly |
bool |
Identifies whether this operation is a read-only operation. |
| RecipientAccountId |
string |
Represents the account ID that received this event. The recipientAccountID may be different from the CloudTrail userIdentity Element accountId. This can occur in cross-account resource access. |
| RequestParameters |
string |
The parameters, if any, that were sent with the request. These parameters are documented in the API reference documentation for the appropriate AWS service. |
| Resources |
string |
A list of resources accessed in the event. |
| ResponseElements |
string |
The response element for actions that make changes (create, update, or delete actions). If an action does not change state (for example, a request to get or list objects), this element is omitted. |
| ServiceEventDetails |
string |
Identifies the service event, including what triggered the event and the result. |
| SessionCreationDate |
datetime |
The date and time when the temporary security credentials were issued. |
| SessionIssuerAccountId |
string |
The account that owns the entity that was used to get credentials. |
| SessionIssuerArn |
string |
The ARN of the source (account, IAM user, or role) that was used to get temporary security credentials. |
| SessionIssuerPrincipalId |
string |
The internal ID of the entity that was used to get credentials. |
| SessionIssuerType |
string |
The source of the temporary security credentials, such as Root, IAMUser, or Role. |
| SessionIssuerUserName |
string |
The friendly name of the user or role that issued the session. |
| SessionMfaAuthenticated |
bool |
The value is true if the root user or IAM user whose credentials were used for the request also was authenticated with an MFA device; otherwise, false. |
| SharedEventId |
string |
GUID generated by CloudTrail to uniquely identify CloudTrail events from the same AWS action that is sent to different AWS accounts. |
| SourceIpAddress |
string |
The IP address that the request was made from. For actions that originate from the service console, the address reported is for the underlying customer resource, not the console web server. For services in AWS, only the DNS name is displayed. |
| SourcePort |
string |
The SourcePort is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The start of port range for the TCP and UDP protocols, or an ICMP type number. |
| SourceSystem |
string |
The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics |
| TenantId |
string |
The Log Analytics workspace ID |
| TimeGenerated |
datetime |
The timestamp (UTC). An event's time stamp comes from the local host that provides the service API endpoint on which the API call was made. |
| TlsVersion |
string |
Optional. Part of tlsDetails. The TLS version of a request. |
| Type |
string |
The name of the table |
| UserAgent |
string |
The agent through which the request was made, such as the AWS Management Console, an AWS service, the AWS SDKs or the AWS CLI. |
| UserIdentityAccessKeyId |
string |
The access key ID that was used to sign the request. |
| UserIdentityAccountId |
string |
The account that owns the entity that granted permissions for the request. |
| UserIdentityArn |
string |
The Amazon Resource Name (ARN) of the principal that made the call. |
| UserIdentityInvokedBy |
string |
The name of the AWS service that made the request. |
| UserIdentityPrincipalid |
string |
A unique identifier for the entity that made the call. |
| UserIdentityType |
string |
The type of the identity. The following values are possible: Root, IAMUser, AssumedRole, FederatedUser, Directory, AWSAccount, AWSService, Unknown. |
| UserIdentityUserName |
string |
The name of the identity that made the call. |
| VpcEndpointId |
string |
Identifies the VPC endpoint in which requests were made from a VPC to another AWS service. |