Merge pull request #232109 from guywi-ms/patch-49

Update activity-log-schema.md

Author: prmerger-automator[bot]

articles/azure-monitor/essentials/activity-log-schema.md

@@ -147,7 +147,7 @@ This category contains the record of all create, update, delete, and action oper
 | eventName | Friendly name of the Administrative event. |
 | category | Always "Administrative" |
 | httpRequest |Blob describing the Http Request. Usually includes the “clientRequestId”, “clientIpAddress” and “method” (HTTP method. For example, PUT). |
-| level |Level of the event. One of the following values: “Critical”, “Error”, “Warning”, and “Informational” |
+| level |[Severity level](#severity-level) of the event.  |
 | resourceGroupName |Name of the resource group for the impacted resource. |
 | resourceProviderName |Name of the resource provider for the impacted resource |
 | resourceType | The type of resource that was affected by an Administrative event. |
@@ -290,7 +290,7 @@ This category contains the record of any resource health events that have occurr
 | eventDataId |Unique identifier of the alert event. |
 | category | Always "ResourceHealth" |
 | eventTimestamp |Timestamp when the event was generated by the Azure service processing the request corresponding the event. |
-| level |Level of the event. One of the following values: “Critical”, or “Informational” (other levels are not supported) |
+| level |[Severity level](#severity-level) of the event. |
 | operationId |A GUID shared among the events that correspond to a single operation. |
 | operationName |Name of the operation. |
 | resourceGroupName |Name of the resource group that contains the resource. |
@@ -384,7 +384,7 @@ This category contains the record of all activations of classic Azure alerts. An
 | description |Static text description of the alert event. |
 | eventDataId |Unique identifier of the alert event. |
 | category | Always "Alert" |
-| level |Level of the event. One of the following values: “Critical”, “Error”, “Warning”, and “Informational” |
+| level |[Severity level](#severity-level) of the event. |
 | resourceGroupName |Name of the resource group for the impacted resource if it is a metric alert. For other alert types, it is the name of the resource group that contains the alert itself. |
 | resourceProviderName |Name of the resource provider for the impacted resource if it is a metric alert. For other alert types, it is the name of the resource provider for the alert itself. |
 | resourceId | Name of the resource ID for the impacted resource if it is a metric alert. For other alert types, it is the resource ID of the alert resource itself. |
@@ -493,7 +493,7 @@ This category contains the record of any events related to the operation of the
 | correlationId | A GUID in the string format. |
 | description |Static text description of the autoscale event. |
 | eventDataId |Unique identifier of the autoscale event. |
-| level |Level of the event. One of the following values: “Critical”, “Error”, “Warning”, and “Informational” |
+| level |[Severity level](#severity-level) of the event. |
 | resourceGroupName |Name of the resource group for the autoscale setting. |
 | resourceProviderName |Name of the resource provider for the autoscale setting. |
 | resourceId |Resource ID of the autoscale setting. |
@@ -584,7 +584,7 @@ This category contains the record any alerts generated by Microsoft Defender for
 | eventName |Friendly name of the security event. |
 | category | Always "Security" |
 | ID |Unique resource identifier of the security event. |
-| level |Level of the event. One of the following values: “Critical”, “Error”, “Warning”, or “Informational” |
+| level |[Severity level](#severity-level) of the event.|
 | resourceGroupName |Name of the resource group for the resource. |
 | resourceProviderName |Name of the resource provider for Microsoft Defender for Cloud. Always "Microsoft.Security". |
 | resourceType |The type of resource that generated the security event, such as "Microsoft.Security/locations/alerts" |
@@ -664,7 +664,7 @@ This category contains the record of any new recommendations that are generated
 | eventDataId | Unique identifier of the recommendation event. |
 | category | Always "Recommendation" |
 | ID |Unique resource identifier of the recommendation event. |
-| level |Level of the event. One of the following values: “Critical”, “Error”, “Warning”, or “Informational” |
+| level |[Severity level](#severity-level) of the event.|
 | operationName |Name of the operation.  Always "Microsoft.Advisor/generateRecommendations/action"|
 | resourceGroupName |Name of the resource group for the resource. |
 | resourceProviderName |Name of the resource provider for the resource that this recommendation applies to, such as "MICROSOFT.COMPUTE" |
@@ -779,7 +779,7 @@ This category contains records of all effect action operations performed by [Azu
 | category | Declares the activity log event as belonging to "Policy". |
 | eventTimestamp | Timestamp when the event was generated by the Azure service processing the request corresponding the event. |
 | ID | Unique identifier of the event on the specific resource. |
-| level | Level of the event. Audit uses "Warning" and Deny uses "Error". An auditIfNotExists or deployIfNotExists error can generate "Warning" or "Error" depending on severity. All other Policy events use "Informational". |
+| level | [Severity level](#severity-level) of the event. Audit uses "Warning" and Deny uses "Error". An auditIfNotExists or deployIfNotExists error can generate "Warning" or "Error" depending on severity. All other Policy events use "Informational". |
 | operationId | A GUID shared among the events that correspond to a single operation. |
 | operationName | Name of the operation and directly correlates to the Policy effect. |
 | resourceGroupName | Name of the resource group for the evaluated resource. |