| AccountDisplayName |
string |
Name of the account user displayed in the address book |
| AccountDomain |
string |
Domain of the account |
| AccountName |
string |
User name of the account |
| AccountObjectId |
string |
Unique identifier for the account in Azure AD |
| AccountSid |
string |
Security Identifier (SID) of the account |
| AccountUpn |
string |
User principal name (UPN) of the account |
| ActionType |
string |
Type of activity that triggered the event |
| AdditionalFields |
dynamic |
Additional information about the entity or event |
| Application |
string |
Application that performed the recorded action |
| _BilledSize |
real |
The record size in bytes |
| DestinationDeviceName |
string |
Name of the device running the server application that processed the recorded action |
| DestinationIPAddress |
string |
IP address of the device running the server application that processed the recorded action |
| DestinationPort |
string |
Destination port of related network communications |
| DeviceName |
string |
Fully qualified domain name (FQDN) of the device |
| DeviceType |
string |
Type of device |
| FailureReason |
string |
Information explaining why the recorded action failed |
| IPAddress |
string |
IP address assigned to the endpoint and used during related network communications |
| _IsBillable |
string |
Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
| ISP |
string |
Internet service provider (ISP) associated with the endpoint IP address |
| Location |
string |
City, country, or other geographic location associated with the event |
| LogonType |
string |
Type of logon session |
| OSPlatform |
string |
Platform of the operating system running on the machine |
| Port |
string |
TCP port used during communication |
| Protocol |
string |
Network protocol used |
| ReportId |
string |
Unique identifier for the event |
| SourceSystem |
string |
The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics |
| TargetAccountDisplayName |
string |
Display name of the account that the recorded action was applied to |
| TargetDeviceName |
string |
Fully qualified domain name (FQDN) of the device that the recorded action was applied to |
| TenantId |
string |
The Log Analytics workspace ID |
| TimeGenerated |
datetime |
Date and time (UTC) when the record was generated |
| Type |
string |
The name of the table |