Details
| ID | MicrosoftEntraID_ModelingRule |
|---|---|
| From Version | 8.15.0 |
| Tags | Microsoft Entra ID |
Schema
msft_azure_raw
| Field | Type | Array? |
|---|---|---|
ALERT_NAME |
string | — |
CategoryValue |
string | — |
HTTPRequest |
string | — |
Level |
string | — |
SEVERITY |
string | — |
SubscriptionId |
string | — |
Type |
string | — |
_raw_log |
string | — |
activitystatusvalue |
string | — |
activitysubstatusvalue |
string | — |
caller |
string | — |
callerIpAddress |
string | — |
category |
string | — |
correlationId |
string | — |
description |
string | — |
durationMs |
string | — |
eventDataId |
string | — |
identity |
string | — |
level |
string | — |
location |
string | — |
operationName |
string | — |
operationnamevalue |
string | — |
properties |
string | — |
resourceId |
string | — |
resourceprovidervalue |
string | — |
resultDescription |
string | — |
resultSignature |
string | — |
resultType |
string | — |
ruleName |
string | — |
tenantId |
string | — |
time |
string | — |
msft_azure_ad_raw
| Field | Type | Array? |
|---|---|---|
ProcessingTimeInMilliseconds |
string | — |
appDisplayName |
string | — |
appliedConditionalAccessPolicies |
string | — |
authenticationDetails |
string | — |
authenticationMethodsUsed |
string | — |
authenticationProcessingDetails |
string | — |
authenticationProtocol |
string | — |
authenticationRequirement |
string | — |
autonomousSystemNumber |
int | — |
clientAppUsed |
string | — |
clientCredentialType |
string | — |
conditionalAccessStatus |
string | — |
correlationId |
string | — |
deviceDetail |
string | — |
homeTenantId |
string | — |
homeTenantName |
string | — |
id |
string | — |
ipAddress |
string | — |
ipAddressFromResourceProvider |
string | — |
isInteractive |
boolean | — |
location |
string | — |
networkLocationDetails |
string | — |
operatingSystem |
string | — |
originalRequestId |
string | — |
resourceDisplayName |
string | — |
resourceId |
string | — |
resourceTenantId |
string | — |
riskDetail |
string | — |
riskEventTypes_v2 |
string | — |
riskLevelAggregated |
string | — |
riskLevelDuringSignIn |
string | — |
riskState |
string | — |
servicePrincipalName |
string | — |
signInEventTypes |
string | — |
status |
string | — |
tokenIssuerType |
string | — |
userAgent |
string | — |
userDisplayName |
string | — |
userId |
string | — |
userPrincipalName |
string | — |
userType |
string | — |
msft_azure_ad_audit_raw
| Field | Type | Array? |
|---|---|---|
activityDisplayName |
string | — |
additionalDetails |
string | — |
category |
string | — |
correlationId |
string | — |
id |
string | — |
initiatedBy |
string | — |
loggedByService |
string | — |
operationType |
string | — |
parsed_fields |
string | — |
result |
string | — |
resultReason |
string | — |
targetResources |
string | — |