You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/logs-data-export.md
+79Lines changed: 79 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -710,9 +710,22 @@ If the data export rule includes an unsupported table, the configuration will su
710
710
| Alert | Partial support. Data ingestion for Zabbix alerts isn't supported. |
711
711
| AlertEvidence ||
712
712
| AlertInfo ||
713
+
| AmlComputeClusterEvent ||
714
+
| AmlComputeCpuGpuUtilization ||
715
+
| AmlComputeInstanceEvent ||
716
+
| AmlComputeJobEvent ||
717
+
| AmlDataSetEvent ||
718
+
| AmlDataStoreEvent ||
719
+
| AmlDeploymentEvent ||
720
+
| AmlEnvironmentEvent ||
721
+
| AmlInferencingEvent ||
722
+
| AmlModelsEvent ||
713
723
| AmlOnlineEndpointConsoleLog ||
714
724
| AmlOnlineEndpointEventLog ||
715
725
| AmlOnlineEndpointTrafficLog ||
726
+
| AmlPipelineEvent ||
727
+
| AmlRunEvent ||
728
+
| AmlRunStatusChangedEvent ||
716
729
| AMSKeyDeliveryRequests ||
717
730
| AMSLiveEventOperations ||
718
731
| AMSMediaAccountHealth ||
@@ -728,25 +741,38 @@ If the data export rule includes an unsupported table, the configuration will su
728
741
| AppMetrics ||
729
742
| AppPageViews ||
730
743
| AppPerformanceCounters ||
744
+
| AppPlatformIngressLogs ||
745
+
| AppPlatformLogsforSpring ||
731
746
| AppPlatformSystemLogs ||
732
747
| AppRequests ||
748
+
| AppServiceAntivirusScanAuditLogs ||
733
749
| AppServiceAppLogs ||
734
750
| AppServiceAuditLogs ||
735
751
| AppServiceConsoleLogs ||
752
+
| AppServiceEnvironmentPlatformLogs ||
736
753
| AppServiceFileAuditLogs ||
737
754
| AppServiceHTTPLogs ||
755
+
| AppServiceIPSecAuditLogs ||
738
756
| AppServicePlatformLogs ||
739
757
| AppServiceServerlessSecurityPluginData ||
740
758
| AppSystemEvents ||
741
759
| AppTraces ||
760
+
| ASCAuditLogs ||
761
+
| ASCDeviceEvents ||
742
762
| ASimDnsActivityLogs ||
743
763
| ASimNetworkSessionLogs ||
764
+
| ASimNetworkSessionLogs,ASimWebSessionLogs ||
765
+
| ASimWebSessionLogs ||
744
766
| ATCExpressRouteCircuitIpfix ||
745
767
| AuditLogs ||
768
+
| AUIEventsAudit ||
769
+
| AUIEventsOperational ||
746
770
| AutoscaleEvaluationsLog ||
747
771
| AutoscaleScaleActionsLog ||
772
+
| AVNMNetworkGroupMembershipChange ||
748
773
| AVSSyslog ||
749
774
| AWSCloudTrail ||
775
+
| AWSCloudWatch ||
750
776
| AWSGuardDuty ||
751
777
| AWSVPCFlow ||
752
778
| AZFWApplicationRule ||
@@ -791,27 +817,48 @@ If the data export rule includes an unsupported table, the configuration will su
791
817
| ContainerLog ||
792
818
| ContainerLogV2 ||
793
819
| ContainerNodeInventory ||
820
+
| ContainerRegistryLoginEvents ||
821
+
| ContainerRegistryRepositoryEvents ||
794
822
| ContainerServiceLog ||
795
823
| CoreAzureBackup ||
796
824
| DatabricksAccounts ||
797
825
| DatabricksClusters ||
798
826
| DatabricksDBFS ||
827
+
| DatabricksFeatureStore ||
828
+
| DatabricksGenie ||
829
+
| DatabricksGlobalInitScripts ||
799
830
| DatabricksInstancePools ||
800
831
| DatabricksJobs ||
832
+
| DatabricksMLflowAcledArtifact ||
833
+
| DatabricksMLflowExperiment ||
801
834
| DatabricksNotebook ||
835
+
| DatabricksRemoteHistoryService ||
802
836
| DatabricksSecrets ||
803
837
| DatabricksSQLPermissions ||
804
838
| DatabricksSSH ||
805
839
| DatabricksWorkspace ||
806
840
| DevCenterDiagnosticLogs ||
841
+
| DeviceEvents ||
842
+
| DeviceFileCertificateInfo ||
843
+
| DeviceFileEvents ||
844
+
| DeviceImageLoadEvents ||
845
+
| DeviceInfo ||
846
+
| DeviceLogonEvents ||
847
+
| DeviceNetworkEvents ||
848
+
| DeviceNetworkInfo ||
849
+
| DeviceProcessEvents ||
850
+
| DeviceRegistryEvents ||
807
851
| DeviceTvmSecureConfigurationAssessment ||
852
+
| DeviceTvmSecureConfigurationAssessmentKB ||
808
853
| DeviceTvmSoftwareInventory ||
809
854
| DeviceTvmSoftwareVulnerabilities ||
855
+
| DeviceTvmSoftwareVulnerabilitiesKB ||
810
856
| DnsEvents ||
811
857
| DnsInventory ||
812
858
| DSMAzureBlobStorageLogs ||
813
859
| DSMDataClassificationLogs ||
814
860
| DSMDataLabelingLogs ||
861
+
| DynamicEventCollection ||
815
862
| Dynamics365Activity ||
816
863
| DynamicSummary ||
817
864
| EmailAttachmentInfo ||
@@ -820,6 +867,7 @@ If the data export rule includes an unsupported table, the configuration will su
820
867
| EmailUrlInfo ||
821
868
| Event | Partial support. Data arriving from the Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
822
869
| ExchangeAssessmentRecommendation ||
870
+
| ExchangeOnlineAssessmentRecommendation ||
823
871
| FailedIngestion ||
824
872
| FunctionAppLogs ||
825
873
| GCPAuditLogs ||
@@ -854,6 +902,7 @@ If the data export rule includes an unsupported table, the configuration will su
854
902
| HDInsightStormLogs ||
855
903
| HDInsightStormMetrics ||
856
904
| HDInsightStormTopologyMetrics ||
905
+
| HealthStateChangeEvent ||
857
906
| Heartbeat ||
858
907
| HuntingBookmark ||
859
908
| IdentityDirectoryEvents ||
@@ -870,17 +919,23 @@ If the data export rule includes an unsupported table, the configuration will su
870
919
| KubePodInventory ||
871
920
| KubeServices ||
872
921
| LAQueryLogs ||
922
+
| LogicAppWorkflowRuntime ||
873
923
| McasShadowItReporting ||
874
924
| MCCEventLogs ||
875
925
| MCVPAuditLogs ||
876
926
| MCVPOperationLogs ||
877
927
| MicrosoftAzureBastionAuditLogs ||
878
928
| MicrosoftDataShareReceivedSnapshotLog ||
879
929
| MicrosoftDataShareSentSnapshotLog ||
930
+
| MicrosoftGraphActivityLogs ||
880
931
| MicrosoftHealthcareApisAuditLogs ||
881
932
| MicrosoftPurviewInformationProtection ||
882
933
| NetworkAccessTraffic ||
883
934
| NSPAccessLogs ||
935
+
| NTAIpDetails ||
936
+
| NTANetAnalytics ||
937
+
| NTATopologyDetails ||
938
+
| NWConnectionMonitorDestinationListenerResult ||
884
939
| NWConnectionMonitorPathResult ||
885
940
| NWConnectionMonitorTestResult ||
886
941
| OEPAirFlowTask ||
@@ -901,9 +956,12 @@ If the data export rule includes an unsupported table, the configuration will su
901
956
| PurviewDataSensitivityLogs ||
902
957
| PurviewScanStatusLogs ||
903
958
| PurviewSecurityLogs ||
959
+
| REDConnectionEvents ||
904
960
| ResourceManagementPublicAccessLogs ||
905
961
| SCCMAssessmentRecommendation ||
906
962
| SCOMAssessmentRecommendation ||
963
+
| SecureScoreControls ||
964
+
| SecureScores ||
907
965
| SecurityAlert ||
908
966
| SecurityBaseline ||
909
967
| SecurityBaselineSummary ||
@@ -913,6 +971,7 @@ If the data export rule includes an unsupported table, the configuration will su
913
971
| SecurityIoTRawEvent ||
914
972
| SecurityNestedRecommendation ||
915
973
| SecurityRecommendation ||
974
+
| SecurityRegulatoryCompliance ||
916
975
| SentinelAudit ||
917
976
| SentinelHealth ||
918
977
| SfBAssessmentRecommendation ||
@@ -923,13 +982,20 @@ If the data export rule includes an unsupported table, the configuration will su
923
982
| SPAssessmentRecommendation ||
924
983
| SQLAssessmentRecommendation ||
925
984
| SQLSecurityAuditEvents ||
985
+
| SqlVulnerabilityAssessmentScanStatus ||
926
986
| StorageAntimalwareScanResults ||
927
987
| StorageCacheOperationEvents ||
928
988
| StorageCacheUpgradeEvents ||
929
989
| StorageCacheWarningEvents ||
990
+
| StorageMalwareScanningResults ||
991
+
| StorageMoverCopyLogsFailed ||
992
+
| StorageMoverCopyLogsTransferred ||
993
+
| StorageMoverJobRunLogs ||
930
994
| SucceededIngestion ||
931
995
| SynapseBigDataPoolApplicationsEnded ||
932
996
| SynapseBuiltinSqlPoolRequestsEnded ||
997
+
| SynapseDXFailedIngestion ||
998
+
| SynapseDXSucceededIngestion ||
933
999
| SynapseGatewayApiRequests ||
934
1000
| SynapseIntegrationActivityRuns ||
935
1001
| SynapseIntegrationPipelineRuns ||
@@ -945,6 +1011,7 @@ If the data export rule includes an unsupported table, the configuration will su
945
1011
| SynapseSqlPoolWaits ||
946
1012
| Syslog | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
947
1013
| ThreatIntelligenceIndicator ||
1014
+
| TSIIngress ||
948
1015
| UCClient ||
949
1016
| UCDOAggregatedStatus ||
950
1017
| UCDOStatus ||
@@ -957,17 +1024,29 @@ If the data export rule includes an unsupported table, the configuration will su
957
1024
| UserPeerAnalytics ||
958
1025
| VIAudit ||
959
1026
| VIIndexing ||
1027
+
| WaaSDeploymentStatus ||
1028
+
| WaaSInsiderStatus ||
1029
+
| WaaSUpdateStatus ||
960
1030
| W3CIISLog | Partial support. Data arriving from Log Analytics agent (MMA) or Azure Monitor Agent (AMA) is fully supported in export. Data arriving via Diagnostics extension agent is collected through storage while this path isn’t supported in export. |
961
1031
| Watchlist ||
1032
+
| WebPubSubConnectivity ||
1033
+
| WebPubSubHttpRequest ||
1034
+
| WebPubSubMessaging ||
1035
+
| WindowsClientAssessmentRecommendation ||
962
1036
| WindowsEvent ||
963
1037
| WindowsFirewall ||
1038
+
| WindowsServerAssessmentRecommendation ||
964
1039
| WireData | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
0 commit comments