category: Analytics & SIEM provider: Microsoft commonfields: id: Azure Log Analytics version: -1 configuration: - additionalinfo: When selecting the Custom option, the Server URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud display: Azure Cloud name: azure_cloud type: 15 required: false defaultvalue: Worldwide options: - Worldwide - US GCC - US GCC-High - DoD - Germany - China - Custom section: Connect advanced: true - name: server_url type: 0 required: false section: Connect display: Server URL advanced: true hidden: false additionalinfo: Use this option when required to customize the URL to the Azure management endpoint. More information can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud - additionalinfo: Received from the authorization process or from the self-deployed configuration process (find the tenant ID in your app overview page in the Azure portal) display: Token / Tenant ID name: refresh_token type: 4 required: false hidden: true section: Connect - name: credentials_refresh_token type: 9 required: false displaypassword: Token / Tenant ID hiddenusername: true section: Connect - displaypassword: ID / Client ID name: creds_client_id hiddenusername: true type: 9 section: Connect required: false additionalinfo: The Application (Client) ID of the Azure app registration. - displaypassword: Key / Client Secret name: credentials type: 9 additionalinfo: Received from the authorization process or from the self-deployed configuration process. required: false section: Connect hiddenusername: true - additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. display: Certificate Thumbprint name: certificate_thumbprint type: 4 required: false hidden: true section: Connect - additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. name: credentials_certificate_thumbprint type: 9 required: false section: Connect displaypassword: Certificate Thumbprint hiddenusername: true - additionalinfo: Used for certificate authentication. The private key of the registered certificate. display: Private Key name: private_key type: 14 required: false section: Connect - display: Use a self-deployed Azure application - Authorization Code flow name: self_deployed type: 8 required: false section: Connect additionalinfo: Check when authenticating using the Authorization Code flow. - additionalinfo: Check when authenticating using the Client Credentials flow. display: Use a self-deployed Azure application - Client Credentials Flow name: client_credentials type: 8 required: false section: Connect - name: redirect_uri type: 0 required: false section: Connect display: Application redirect URI (for self-deployed mode) - additionalinfo: Get the Authorization code from steps 3-5 in the self deployed authorization process. display: Authorization code name: auth_code type: 4 required: false hidden: true section: Connect - additionalinfo: Get the Authorization code from steps 3-5 in the self deployed authorization process. displaypassword: Authorization code name: credentials_auth_code hiddenusername: true type: 9 required: false section: Connect - display: Use Azure Managed Identities name: use_managed_identities required: false type: 8 additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. section: Connect advanced: true - name: managed_identities_client_id required: false type: 9 additionalinfo: The Managed Identities client id for authentication - relevant only if the integration is running on Azure VM. section: Connect displaypassword: Azure Managed Identities Client ID hiddenusername: true advanced: true - display: Default Subscription ID name: subscriptionID required: true type: 0 additionalinfo: The parameter can be saved as 000-000 and added as an argument to each command, but Test button will fail. section: Connect - display: Default Resource Group Name name: resourceGroupName required: true type: 0 additionalinfo: The parameter can be saved as 000-000 and added as an argument to each command, but Test button will fail. section: Connect - display: Default Workspace Name name: workspaceName type: 0 required: true section: Connect additionalinfo: The parameter can be saved as 000-000 and added as an argument to each command. - display: Default Workspace ID (the UUID of the workspace, e.g. 123e4567-e89b-12d3-a456-426614174000) name: workspaceID type: 0 required: true section: Connect additionalinfo: The parameter can be saved as 000-000 and added as an argument to each command, but Test button will fail. - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true description: Log Analytics is a service that helps you collect and analyze data generated by resources in your cloud and on-premises environments. display: Azure Log Analytics name: Azure Log Analytics script: commands: - arguments: - description: The query to execute. name: query required: true - description: The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any timespans specified in the query expression. name: timespan - defaultValue: '10' description: The amount of time (in seconds) that a request will wait for the query response before a timeout occurs. name: timeout - description: "The Workspace ID. Note: This argument will override the instance parameter 'Default Workspace ID'." name: workspace_id description: Executes an Analytics query for data. name: azure-log-analytics-execute-query outputs: - contextPath: AzureLogAnalytics.Query.Query description: The executed query. type: String - contextPath: AzureLogAnalytics.Query.TableName description: The name of the query table. type: String - description: Tests connectivity to Azure Log Analytics. name: azure-log-analytics-test - arguments: - defaultValue: '50' description: The maximum number of saved searches to return. Default is 50. name: limit - defaultValue: '0' description: The page number from which to start a search. name: page - description: "The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name - description: "The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'." name: workspace_name description: Gets the saved searches of the Log Analytics workspace. name: azure-log-analytics-list-saved-searches outputs: - contextPath: AzureLogAnalytics.SavedSearch.id description: The ID of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.etag description: The ETag of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.category description: The category of the saved search. This helps users quickly find a saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.displayName description: Display name of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.functionAlias description: The function alias if the query serves as a function. type: String - contextPath: AzureLogAnalytics.SavedSearch.functionParameters description: 'The optional function parameters if the query serves as a function. Value should be in the following format: ''param-name1:type1 = default_value1, param-name2:type2 = default_value2''. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions' type: String - contextPath: AzureLogAnalytics.SavedSearch.query description: The query expression for the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.tags description: The tags attached to the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.version description: The version number of the query language. The current version and default is 2. type: Number - contextPath: AzureLogAnalytics.SavedSearch.type description: The resource type, e.g., Microsoft.Compute/virtualMachines or Microsoft.Storage/storageAccounts. type: String - arguments: - description: The ID of the saved search. name: saved_search_id required: true - description: "The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name - description: "The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'." name: workspace_name description: Gets a specified saved search from the Log Analytics workspace. name: azure-log-analytics-get-saved-search-by-id outputs: - contextPath: AzureLogAnalytics.SavedSearch.id description: The ID of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.etag description: The ETag of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.category description: The category of the saved search. This helps users quickly find a saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.displayName description: The display name of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.functionAlias description: The function alias if the query serves as a function. type: String - contextPath: AzureLogAnalytics.SavedSearch.functionParameters description: 'The optional function parameters if the query serves as a function. Value should be in the following format: ''param-name1:type1 = default_value1, param-name2:type2 = default_value2''. For more examples and proper syntax see the Microsoft documentation, https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.' type: String - contextPath: AzureLogAnalytics.SavedSearch.query description: The query expression for the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.tags description: The tags attached to the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.version description: The version number of the query language. The current version and default is 2. type: Number - contextPath: AzureLogAnalytics.SavedSearch.type description: The resource type, e.g., Microsoft.Compute/virtualMachines or Microsoft.Storage/storageAccounts. type: String - arguments: - description: The ID of the saved search. name: saved_search_id required: true - description: The ETag of the saved search. This argument is required for updating an existing saved search. name: etag - description: The category of the saved search. This helps users quickly find a saved search. name: category required: true - description: The display name of the saved search. name: display_name required: true - description: The function alias if the query serves as a function. name: function_alias - description: 'The optional function parameters if the query serves as a function. Value should be in the following format: ''param-name1:type1 = default_value1, param-name2:type2 = default_value2''. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions.' name: function_parameters - description: The query expression for the saved search. name: query required: true - description: 'The tags attached to the saved search. Value should be in the following format: ''name=value;name=value''.' name: tags - description: "The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name - description: "The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'." name: workspace_name description: Creates or updates a saved search from the Log Analytics workspace. name: azure-log-analytics-create-or-update-saved-search outputs: - contextPath: AzureLogAnalytics.SavedSearch.id description: The ID of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.etag description: The ETag of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.category description: The category of the saved search. This helps users quickly find a saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.displayName description: The display name of the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.functionAlias description: The function alias if the query serves as a function. type: String - contextPath: AzureLogAnalytics.SavedSearch.functionParameters description: 'The optional function parameters if the query serves as a function. Value should be in the following format: ''param-name1:type1 = default_value1, param-name2:type2 = default_value2''. For more examples and proper syntax please refer to https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions' type: String - contextPath: AzureLogAnalytics.SavedSearch.query description: The query expression for the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.tags description: The tags attached to the saved search. type: String - contextPath: AzureLogAnalytics.SavedSearch.version description: The version number of the query language. The current version and default is 2. type: Number - contextPath: AzureLogAnalytics.SavedSearch.type description: The resource type, e.g., Microsoft.Compute/virtualMachines or Microsoft.Storage/storageAccounts. type: String - arguments: - description: The ID of the saved search. name: saved_search_id required: true - description: "The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name - description: "The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'." name: workspace_name description: Deletes a specified saved search in the Log Analytics workspace. name: azure-log-analytics-delete-saved-search - description: Generate the login url used for Authorization code flow. name: azure-log-analytics-generate-login-url arguments: [] - description: List all subscriptions for a tenant. name: azure-log-analytics-subscriptions-list outputs: - contextPath: AzureLogAnalytics.Subscription.authorizationSource description: The authorization source of the request. type: String - contextPath: AzureLogAnalytics.Subscription.displayName description: The subscription display name. type: String - contextPath: AzureLogAnalytics.Subscription.id description: The fully qualified ID for the subscription. For example, /subscriptions/8d65815f-a5b6-402f-9298-045155da7d74. type: String - contextPath: AzureLogAnalytics.Subscription.managedByTenants description: An array containing the tenants managing the subscription. type: Unknown - contextPath: AzureLogAnalytics.Subscription.state description: The subscription state. Possible values are Enabled, Warned, PastDue, Disabled, and Deleted. type: Unknown - contextPath: AzureLogAnalytics.Subscription.subscriptionId description: The subscription ID. type: String - contextPath: AzureLogAnalytics.Subscription.subscriptionPolicies description: The subscription policies. type: Unknown - contextPath: AzureLogAnalytics.Subscription.tags description: The tags attached to the subscription. type: Object - contextPath: AzureLogAnalytics.Subscription.tenantId description: The subscription tenant ID. type: String - name: azure-log-analytics-workspace-list description: Gets workspaces in a resource group. arguments: - description: "The subscription ID. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name outputs: - contextPath: AzureLogAnalytics.workspace.etag description: The etag of the workspace. type: String - contextPath: AzureLogAnalytics.workspace.id description: Fully qualified resource ID for the resource. type: String - contextPath: AzureLogAnalytics.workspace.identity.principalId description: The principal ID of resource identity. type: String - contextPath: AzureLogAnalytics.workspace.identity.tenantId description: The tenant ID of resource. type: String - contextPath: AzureLogAnalytics.workspace.identity.type description: Type of managed service identity. type: String - contextPath: AzureLogAnalytics.workspace.identity.userAssignedIdentities.clientId description: The client id of user assigned identity. type: String - contextPath: AzureLogAnalytics.workspace.identity.userAssignedIdentities.principalId description: The principal id of user assigned identity. type: String - contextPath: AzureLogAnalytics.workspace.location description: The geo-location where the resource lives. type: String - contextPath: AzureLogAnalytics.workspace.name description: The name of the resource. type: String - contextPath: AzureLogAnalytics.workspace.properties.createdDate description: Workspace creation date. type: String - contextPath: AzureLogAnalytics.workspace.properties.customerId description: This is a read-only property. Represents the ID associated with the workspace. type: String - contextPath: AzureLogAnalytics.workspace.properties.defaultDataCollectionRuleResourceId description: The resource ID of the default Data Collection Rule to use for this workspace. type: String - contextPath: AzureLogAnalytics.workspace.properties.features.clusterResourceId description: Dedicated LA cluster resourceId that is linked to the workspaces. type: String - contextPath: AzureLogAnalytics.workspace.properties.features.disableLocalAuth description: Disable Non-AAD based Auth. type: Boolean - contextPath: AzureLogAnalytics.workspace.properties.features.enableDataExport description: Flag that indicate if data should be exported. type: Boolean - contextPath: AzureLogAnalytics.workspace.properties.features.enableLogAccessUsingOnlyResourcePermissions description: Flag that indicate which permission to use - resource or workspace or both. type: Boolean - contextPath: AzureLogAnalytics.workspace.properties.features.immediatePurgeDataOn30Days description: Flag that describes if we want to remove the data after 30 days. type: Boolean - contextPath: AzureLogAnalytics.workspace.properties.forceCmkForQuery description: Indicates whether customer managed storage is mandatory for query management. type: Boolean - contextPath: AzureLogAnalytics.workspace.properties.modifiedDate description: Workspace modification date. type: String - contextPath: AzureLogAnalytics.workspace.properties.privateLinkScopedResources.resourceId description: The full resource Id of the private link scope resource. type: String - contextPath: AzureLogAnalytics.workspace.properties.privateLinkScopedResources.scopeId description: The private link scope unique Identifier. type: String - contextPath: AzureLogAnalytics.workspace.properties.provisioningState description: The provisioning state of the workspace. type: String - contextPath: AzureLogAnalytics.workspace.properties.publicNetworkAccessForIngestion description: The network access type for accessing Log Analytics ingestion. type: String - contextPath: AzureLogAnalytics.workspace.properties.publicNetworkAccessForQuery description: The network access type for accessing Log Analytics query. type: String - contextPath: AzureLogAnalytics.workspace.properties.retentionInDays description: The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details. type: Number - contextPath: AzureLogAnalytics.workspace.properties.sku.capacityReservationLevel description: The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. type: Number - contextPath: AzureLogAnalytics.workspace.properties.sku.lastSkuUpdate description: The last time when the sku was updated. type: String - contextPath: AzureLogAnalytics.workspace.properties.sku.name description: The name of the SKU. type: String - contextPath: AzureLogAnalytics.workspace.properties.workspaceCapping.dailyQuotaGb description: The workspace daily quota for ingestion. type: Number - contextPath: AzureLogAnalytics.workspace.properties.workspaceCapping.dataIngestionStatus description: The status of data ingestion for this workspace. type: String - contextPath: AzureLogAnalytics.workspace.properties.workspaceCapping.quotaNextResetTime description: The time when the quota will be rest. type: String - contextPath: AzureLogAnalytics.workspace.systemData.createdAt description: The timestamp of resource creation (UTC). type: String - contextPath: AzureLogAnalytics.workspace.systemData.createdBy description: The identity that created the resource. type: String - contextPath: AzureLogAnalytics.workspace.systemData.createdByType description: The type of identity that created the resource. type: String - contextPath: AzureLogAnalytics.workspace.systemData.lastModifiedAt description: The timestamp of resource last modification (UTC). type: String - contextPath: AzureLogAnalytics.workspace.systemData.lastModifiedBy description: The identity that last modified the resource. type: String - contextPath: AzureLogAnalytics.workspace.systemData.lastModifiedByType description: lastModifiedByType. type: String - contextPath: AzureLogAnalytics.workspace.tags description: Resource tags. type: Object - contextPath: AzureLogAnalytics.workspace.type description: The type of the resource. type: String - name: azure-log-analytics-resource-group-list description: List all resource groups for a subscription. arguments: - name: subscription_id description: "The subscription ID. Note: This argument will override the instance parameter 'Default Subscription ID'." - name: limit description: Limit on the number of resource groups to return. defaultValue: 50 - name: tag description: A single tag in the form of '{"Tag Name":"Tag Value"}' to filter the list by. outputs: - contextPath: AzureLogAnalytics.ResourceGroup.id description: The ID of the resource group. type: String - contextPath: AzureLogAnalytics.ResourceGroup.location description: The location of the resource group. type: String - contextPath: AzureLogAnalytics.ResourceGroup.managedBy description: The ID of the resource that manages this resource group. type: String - contextPath: AzureLogAnalytics.ResourceGroup.name description: The name of the resource group. type: String - contextPath: AzureLogAnalytics.ResourceGroup.properties.provisioningState description: The provisioning state. type: String - contextPath: AzureLogAnalytics.ResourceGroup.tags description: The tags attached to the resource group. type: Object - contextPath: AzureLogAnalytics.ResourceGroup.type description: The type of the resource group. type: String - description: Run this command if for some reason you need to rerun the authentication process. execution: false name: azure-log-analytics-auth-reset arguments: [] - arguments: - description: "The name of the table to add. Must contain '_SRCH' suffix. Example value: AuditLogs_SRCH." name: table_name required: true - description: Maximum number of records in the result set, up to one million records. name: limit defaultValue: 50 - description: Log query written in KQL format to retrieve data. Search job queries must always start with a table name. For the proper syntax, see https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/whereoperator. name: query required: true - description: Start of the time range to search. The value can either be in minutes, days, weeks, or a simple ISO 8601 format such as "2023-10-31T00:00:00Z". name: start_search_time defaultValue: 1 day - description: End of the time range to search. The value can either be in minutes, days, weeks, or a simple ISO 8601 format such as "2023-10-31T00:00:00Z". name: end_search_time defaultValue: now - description: The timeout in seconds until polling ends. name: timeout defaultValue: '600' - description: The interval in seconds between each poll. name: interval defaultValue: '60' - description: This argument is used to determine whether the current execution of the command is the initial run. After the command is executed, the argument is updated to 'false.' During polling, the code checks the status only for the first execution. This argument is for a developer, not for a user. name: first_run defaultValue: true hidden: true - description: Hide the polling message and only print the final status at the end. This argument is for a developer not for a user. name: hide_polling_output hidden: true - description: "The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name - description: "The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'." name: workspace_name polling: true description: Run a search job to fetch records from large datasets into a new search results table in your workspace. Tables use the retention value set for the workspace, but this value can be modified after the table is created. name: azure-log-analytics-run-search-job outputs: - contextPath: AzureLogAnalytics.RunSearchJob.TableName description: Table name. type: String - contextPath: AzureLogAnalytics.RunSearchJob.Query description: The query that was used to create the table. type: String - arguments: - description: "The name of the table. Example value: AuditLogs_SRCH." name: table_name - description: "The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name - description: "The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'." name: workspace_name description: Gets a Log Analytics workspace table. name: azure-log-analytics-get-search-job outputs: - contextPath: AzureLogAnalytics.SearchJob.systemData.createdBy description: The identity that created the resource. type: String - contextPath: AzureLogAnalytics.SearchJob.systemData.createdAt description: The timestamp of resource creation (UTC). type: Date - contextPath: AzureLogAnalytics.SearchJob.properties.resultStatistics.progress description: Search job completion percentage. type: Number - contextPath: AzureLogAnalytics.SearchJob.properties.resultStatistics.ingestedRecords description: The number of rows that were returned by the search job. type: Number - contextPath: AzureLogAnalytics.SearchJob.properties.resultStatistics.scannedGb description: Amount of scanned data in the search job. type: Number - contextPath: AzureLogAnalytics.SearchJob.properties.searchResults.query description: Search job query. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.searchResults.description description: Search job description. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.searchResults.limit description: Limit the search job to return up to the specified number of rows. type: Number - contextPath: AzureLogAnalytics.SearchJob.properties.searchResults.startSearchTime description: The timestamp to start the search from (UTC). type: Date - contextPath: AzureLogAnalytics.SearchJob.properties.searchResults.endSearchTime description: The timestamp to end the search by (UTC). type: Date - contextPath: AzureLogAnalytics.SearchJob.properties.searchResults.sourceTable description: The table used in the search job. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.name description: Table name. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.tableSubType description: The subtype describes what APIs can be used to interact with the table, and what features are available against it (Any, Classic, DataCollectionRuleBased). type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.tableType description: Table's creator. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.displayName description: Table display name. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.description description: Table description. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.columns description: A list of table custom columns. type: List - contextPath: AzureLogAnalytics.SearchJob.properties.schema.standardColumns.isHidden description: Is column hidden. type: Boolean - contextPath: AzureLogAnalytics.SearchJob.properties.schema.standardColumns.name description: Column name. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.standardColumns.type description: Column data type (bool, datetime, dynamic, guid, int, long, real, string). type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.standardColumns.dataTypeHint description: Column data type logical hint (armPath, guid, ip, uri). type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.standardColumns.displayName description: Column display name. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.standardColumns.description description: Column description. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.standardColumns.isDefaultDisplay description: Is displayed by default. type: Boolean - contextPath: AzureLogAnalytics.SearchJob.properties.schema.categories description: Table category. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.labels description: Table labels. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.source description: Table's creator (customer, microsoft). type: String - contextPath: AzureLogAnalytics.SearchJob.properties.schema.solutions description: List of solutions the table is affiliated with. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.provisioningState description: Table's current provisioning state (Deleting, InProgress, Succeeded, Updating). If set to 'updating', indicates a resource lock due to an ongoing operation, forbidding any update to the table until the ongoing operation is concluded. type: String - contextPath: AzureLogAnalytics.SearchJob.properties.retentionInDays description: The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. type: Number - contextPath: AzureLogAnalytics.SearchJob.properties.totalRetentionInDays description: The table total retention in days, between 4 and 2556. Setting this property to -1 will default to table retention. type: Number - contextPath: AzureLogAnalytics.SearchJob.properties.archiveRetentionInDays description: The table data archive retention in days. Calculated as (totalRetentionInDays-retentionInDays). type: Number - contextPath: AzureLogAnalytics.SearchJob.properties.retentionInDaysAsDefault description: True - Value originates from workspace retention in days, False - Customer specific. type: Boolean - contextPath: AzureLogAnalytics.SearchJob.properties.totalRetentionInDaysAsDefault description: True - Value originates from retention in days, False - Customer specific. type: Boolean - contextPath: AzureLogAnalytics.SearchJob.properties.plan description: Instruct the system how to handle and charge the logs ingested to this table. type: String - contextPath: AzureLogAnalytics.SearchJob.id description: Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. type: String - contextPath: AzureLogAnalytics.SearchJob.name description: The name of the resource. type: String - arguments: - description: "The name of the table. Must contain '_SRCH' suffix. Example value: AuditLogs_SRCH." name: table_name - description: "The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'." name: subscription_id - description: "The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'." name: resource_group_name - description: "The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'." name: workspace_name description: Delete a Log Analytics workspace table. We recommend you delete the search job when you're done querying the table. This reduces workspace clutter and extra charges for data retention. name: azure-log-analytics-delete-search-job dockerimage: demisto/crypto:1.0.0.10120494 runonce: false script: '-' subtype: python3 type: python tests: - No test fromversion: 5.0.0 sectionorder: - Connect - Collect