You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/logs-data-export.md
+70-2Lines changed: 70 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -649,6 +649,7 @@ If the data export rule includes an unsupported table, the configuration will su
649
649
| AACAudit ||
650
650
| AACHttpRequest ||
651
651
| AADB2CRequestLogs ||
652
+
| AADCustomSecurityAttributeAuditLogs ||
652
653
| AADDomainServicesAccountLogon ||
653
654
| AADDomainServicesAccountManagement ||
654
655
| AADDomainServicesDirectoryServiceAccess ||
@@ -672,6 +673,9 @@ If the data export rule includes an unsupported table, the configuration will su
672
673
| ACSBillingUsage ||
673
674
| ACSCallAutomationIncomingOperations ||
674
675
| ACSCallAutomationMediaSummary ||
676
+
| ACSCallClientMediaStatsTimeSeries ||
677
+
| ACSCallClientOperations ||
678
+
| ACSCallClosedCaptionsSummary ||
675
679
| ACSCallDiagnostics ||
676
680
| ACSCallRecordingIncomingOperations ||
677
681
| ACSCallRecordingSummary ||
@@ -681,6 +685,7 @@ If the data export rule includes an unsupported table, the configuration will su
681
685
| ACSEmailSendMailOperational ||
682
686
| ACSEmailStatusUpdateOperational ||
683
687
| ACSEmailUserEngagementOperational ||
688
+
| ACSJobRouterIncomingOperations ||
684
689
| ACSNetworkTraversalDiagnostics ||
685
690
| ACSNetworkTraversalIncomingOperations ||
686
691
| ACSRoomsIncomingOperations ||
@@ -725,8 +730,11 @@ If the data export rule includes an unsupported table, the configuration will su
725
730
| AegDataPlaneRequests ||
726
731
| AegDeliveryFailureLogs ||
727
732
| AegPublishFailureLogs ||
733
+
| AEWAssignmentBlobLogs ||
728
734
| AEWAuditLogs ||
729
735
| AEWComputePipelinesLogs ||
736
+
| AFSAuditLogs ||
737
+
| AGCAccessLogs ||
730
738
| AgriFoodApplicationAuditLogs ||
731
739
| AgriFoodFarmManagementLogs ||
732
740
| AgriFoodFarmOperationLogs ||
@@ -738,6 +746,9 @@ If the data export rule includes an unsupported table, the configuration will su
738
746
| AgriFoodSensorManagementLogs ||
739
747
| AgriFoodWeatherLogs ||
740
748
| AGSGrafanaLoginEvents ||
749
+
| AGWAccessLogs ||
750
+
| AGWFirewallLogs ||
751
+
| AGWPerformanceLogs ||
741
752
| AHDSDicomAuditLogs ||
742
753
| AHDSDicomDiagnosticLogs ||
743
754
| AHDSMedTechDiagnosticLogs ||
@@ -772,6 +783,9 @@ If the data export rule includes an unsupported table, the configuration will su
772
783
| AMSStreamingEndpointRequests ||
773
784
| ANFFileAccess ||
774
785
| Anomalies ||
786
+
| AOIDatabaseQuery ||
787
+
| AOIDigestion ||
788
+
| AOIStorage ||
775
789
| ApiManagementGatewayLogs ||
776
790
| AppAvailabilityResults ||
777
791
| AppBrowserTimings ||
@@ -790,6 +804,7 @@ If the data export rule includes an unsupported table, the configuration will su
790
804
| AppServiceAntivirusScanAuditLogs ||
791
805
| AppServiceAppLogs ||
792
806
| AppServiceAuditLogs ||
807
+
| AppServiceAuthenticationLogs ||
793
808
| AppServiceConsoleLogs ||
794
809
| AppServiceEnvironmentPlatformLogs ||
795
810
| AppServiceFileAuditLogs ||
@@ -799,22 +814,31 @@ If the data export rule includes an unsupported table, the configuration will su
799
814
| AppServiceServerlessSecurityPluginData ||
800
815
| AppSystemEvents ||
801
816
| AppTraces ||
817
+
| ArcK8sAudit ||
818
+
| ArcK8sAuditAdmin ||
819
+
| ArcK8sControlPlane ||
802
820
| ASCAuditLogs ||
803
821
| ASCDeviceEvents ||
804
822
| ASimAuditEventLogs ||
805
823
| ASimAuthenticationEventLogs ||
824
+
| ASimDhcpEventLogs ||
806
825
| ASimDnsActivityLogs ||
807
-
|ASimNetworkSessionLogs||
826
+
|ASimFileEventLogs||
808
827
| ASimNetworkSessionLogs ||
809
828
| ASimProcessEventLogs ||
829
+
| ASimRegistryEventLogs ||
830
+
| ASimUserManagementActivityLogs ||
810
831
| ASimWebSessionLogs ||
811
832
| ASRJobs ||
812
833
| ASRReplicatedItems ||
813
834
| ATCExpressRouteCircuitIpfix ||
814
835
| AuditLogs ||
815
836
| AutoscaleEvaluationsLog ||
816
837
| AutoscaleScaleActionsLog ||
838
+
| AVNMConnectivityConfigurationChange ||
839
+
| AVNMIPAMPoolAllocationChange ||
817
840
| AVNMNetworkGroupMembershipChange ||
841
+
| AVNMRuleCollectionChange ||
818
842
| AVSSyslog ||
819
843
| AWSCloudTrail ||
820
844
| AWSCloudWatch ||
@@ -844,10 +868,14 @@ If the data export rule includes an unsupported table, the configuration will su
844
868
| AZMSOperationalLogs ||
845
869
| AZMSRunTimeAuditLogs ||
846
870
| AZMSVnetConnectionEvents ||
871
+
| AzureActivity | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
847
872
| AzureAssessmentRecommendation ||
848
873
| AzureAttestationDiagnostics ||
874
+
| AzureBackupOperations ||
849
875
| AzureDevOpsAuditing ||
876
+
| AzureDiagnostics ||
850
877
| AzureLoadTestingOperation ||
878
+
| AzureMetricsV2 ||
851
879
| BehaviorAnalytics ||
852
880
| CassandraAudit ||
853
881
| CassandraLogs ||
@@ -871,7 +899,9 @@ If the data export rule includes an unsupported table, the configuration will su
871
899
| ConfigurationData | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
872
900
| ContainerAppConsoleLogs ||
873
901
| ContainerAppSystemLogs ||
902
+
| ContainerEvent ||
874
903
| ContainerImageInventory ||
904
+
| ContainerInstanceLog ||
875
905
| ContainerInventory ||
876
906
| ContainerLog ||
877
907
| ContainerLogV2 ||
@@ -908,8 +938,14 @@ If the data export rule includes an unsupported table, the configuration will su
908
938
| DatabricksUnityCatalog ||
909
939
| DatabricksWebTerminal ||
910
940
| DatabricksWorkspace ||
941
+
| DatabricksWorkspaceLogs ||
911
942
| DataTransferOperations ||
943
+
| DataverseActivity ||
944
+
| DCRLogErrors ||
945
+
| DCRLogTroubleshooting ||
946
+
| DevCenterBillingEventLogs ||
912
947
| DevCenterDiagnosticLogs ||
948
+
| DevCenterResourceOperationLogs ||
913
949
| DeviceEvents ||
914
950
| DeviceFileCertificateInfo ||
915
951
| DeviceFileEvents ||
@@ -927,23 +963,30 @@ If the data export rule includes an unsupported table, the configuration will su
927
963
| DeviceTvmSoftwareVulnerabilitiesKB ||
928
964
| DnsEvents ||
929
965
| DnsInventory ||
966
+
| DNSQueryLogs ||
930
967
| DSMAzureBlobStorageLogs ||
931
968
| DSMDataClassificationLogs ||
932
969
| DSMDataLabelingLogs ||
933
-
| DynamicEventCollection ||
934
970
| Dynamics365Activity ||
935
971
| DynamicSummary ||
972
+
| EGNFailedMqttConnections ||
973
+
| EGNFailedMqttPublishedMessages ||
974
+
| EGNFailedMqttSubscriptions ||
975
+
| EGNMqttDisconnections ||
976
+
| EGNSuccessfulMqttConnections ||
936
977
| EmailAttachmentInfo ||
937
978
| EmailEvents ||
938
979
| EmailPostDeliveryEvents ||
939
980
| EmailUrlInfo ||
940
981
| EnrichedMicrosoft365AuditLogs ||
982
+
| ETWEvent | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
941
983
| Event | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
942
984
| ExchangeAssessmentRecommendation ||
943
985
| ExchangeOnlineAssessmentRecommendation ||
944
986
| FailedIngestion ||
945
987
| FunctionAppLogs ||
946
988
| GCPAuditLogs ||
989
+
| GoogleCloudSCC ||
947
990
| HDInsightAmbariClusterAlerts ||
948
991
| HDInsightAmbariSystemMetrics ||
949
992
| HDInsightGatewayAuditLogs ||
@@ -994,6 +1037,8 @@ If the data export rule includes an unsupported table, the configuration will su
994
1037
| KubePVInventory ||
995
1038
| KubeServices ||
996
1039
| LAQueryLogs ||
1040
+
| LASummaryLogs ||
1041
+
| LinuxAuditLog ||
997
1042
| LogicAppWorkflowRuntime ||
998
1043
| McasShadowItReporting ||
999
1044
| MCCEventLogs ||
@@ -1002,10 +1047,23 @@ If the data export rule includes an unsupported table, the configuration will su
1002
1047
| MicrosoftAzureBastionAuditLogs ||
1003
1048
| MicrosoftDataShareReceivedSnapshotLog ||
1004
1049
| MicrosoftDataShareSentSnapshotLog ||
1050
+
| MicrosoftDataShareShareLog ||
1005
1051
| MicrosoftGraphActivityLogs ||
1006
1052
| MicrosoftHealthcareApisAuditLogs ||
1007
1053
| MicrosoftPurviewInformationProtection ||
1054
+
| MNFDeviceUpdates ||
1055
+
| MNFSystemStateMessageUpdates ||
1056
+
| NCBMBreakGlassAuditLogs ||
1057
+
| NCBMSecurityDefenderLogs ||
1058
+
| NCBMSecurityLogs ||
1059
+
| NCBMSystemLogs ||
1060
+
| NCCKubernetesLogs ||
1061
+
| NCCVMOrchestrationLogs ||
1062
+
| NCSStorageAlerts ||
1063
+
| NCSStorageLogs ||
1008
1064
| NetworkAccessTraffic ||
1065
+
| NetworkMonitoring ||
1066
+
| NGXOperationLogs ||
1009
1067
| NSPAccessLogs ||
1010
1068
| NTAIpDetails ||
1011
1069
| NTANetAnalytics ||
@@ -1031,19 +1089,22 @@ If the data export rule includes an unsupported table, the configuration will su
1031
1089
| PowerBIDatasetsTenant ||
1032
1090
| PowerBIDatasetsWorkspace ||
1033
1091
| PowerBIReportUsageWorkspace ||
1092
+
| PowerPlatformAdminActivity ||
1034
1093
| PowerPlatformConnectorActivity ||
1035
1094
| PowerPlatformDlpActivity ||
1036
1095
| ProjectActivity ||
1037
1096
| PurviewDataSensitivityLogs ||
1038
1097
| PurviewScanStatusLogs ||
1039
1098
| PurviewSecurityLogs ||
1040
1099
| REDConnectionEvents ||
1100
+
| RemoteNetworkHealthLogs ||
1041
1101
| ResourceManagementPublicAccessLogs ||
1042
1102
| SCCMAssessmentRecommendation ||
1043
1103
| SCOMAssessmentRecommendation ||
1044
1104
| SecureScoreControls ||
1045
1105
| SecureScores ||
1046
1106
| SecurityAlert ||
1107
+
| SecurityAttackPathData ||
1047
1108
| SecurityBaseline ||
1048
1109
| SecurityBaselineSummary ||
1049
1110
| SecurityDetection ||
@@ -1055,6 +1116,10 @@ If the data export rule includes an unsupported table, the configuration will su
1055
1116
| SecurityRegulatoryCompliance ||
1056
1117
| SentinelAudit ||
1057
1118
| SentinelHealth ||
1119
+
| ServiceFabricOperationalEvent | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
1120
+
| ServiceFabricReliableActorEvent | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
1121
+
| ServiceFabricReliableServiceEvent | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
1122
+
| SfBAssessmentRecommendation ||
1058
1123
| SharePointOnlineAssessmentRecommendation ||
1059
1124
| SignalRServiceDiagnosticLogs ||
1060
1125
| SigninLogs ||
@@ -1109,8 +1174,10 @@ If the data export rule includes an unsupported table, the configuration will su
1109
1174
| Usage ||
1110
1175
| UserAccessAnalytics ||
1111
1176
| UserPeerAnalytics ||
1177
+
| VCoreMongoRequests ||
1112
1178
| VIAudit ||
1113
1179
| VIIndexing ||
1180
+
| VMConnection | Partial support. Some of the data is ingested through internal services that aren't supported in export. Currently, this portion is missing in export. |
1114
1181
| W3CIISLog | Partial support. Data arriving from the Log Analytics agent or Azure Monitor Agent is fully supported in export. Data arriving via the Diagnostics extension agent is collected through storage. This path isn't supported in export. |
1115
1182
| WaaSDeploymentStatus ||
1116
1183
| WaaSInsiderStatus ||
@@ -1119,6 +1186,7 @@ If the data export rule includes an unsupported table, the configuration will su
0 commit comments