|
| 1 | +--- |
| 2 | +title: CloudStorageAggregatedEvents table in the advanced hunting schema |
| 3 | +description: Learn about the CloudStorageAggregatedEvents table in the advanced hunting schema, which contains information about storage activity and related events. |
| 4 | +search.appverid: met150 |
| 5 | +ms.service: defender-xdr |
| 6 | +ms.subservice: adv-hunting |
| 7 | +f1.keywords: |
| 8 | + - NOCSH |
| 9 | +ms.author: pauloliveria |
| 10 | +author: poliveria |
| 11 | +ms.localizationpriority: medium |
| 12 | +manager: orspodek |
| 13 | +audience: ITPro |
| 14 | +ms.collection: |
| 15 | +- m365-security |
| 16 | +- tier3 |
| 17 | +ms.custom: |
| 18 | +- cx-ti |
| 19 | +- cx-ah |
| 20 | +appliesto: |
| 21 | + - Microsoft Defender XDR |
| 22 | + - Microsoft Sentinel in the Microsoft Defender portal |
| 23 | +ms.topic: reference |
| 24 | +ms.date: 08/05/2025 |
| 25 | +--- |
| 26 | + |
| 27 | +# CloudStorageAggregatedEvents (Preview) |
| 28 | + |
| 29 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] |
| 30 | + |
| 31 | +The `CloudStorageAggregatedEvents` table in the [advanced hunting](advanced-hunting-overview.md) contains information about storage activity and related events. Use this reference to construct queries that return information from this table. |
| 32 | + |
| 33 | +> [!IMPORTANT] |
| 34 | +> Some information relates to prereleased product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. |
| 35 | +
|
| 36 | +This advanced hunting table is populated by records from [Microsoft Defender for Cloud](/azure/defender-for-cloud/concept-integration-365#advanced-hunting-in-xdr). If your organization doesn't have Microsoft Defender for Cloud, queries that use the table aren’t going to work or return any results. For more information about prerequisites in integrating Defender for Cloud with Defender XDR, read [Microsoft Defender XDR integration](/azure/defender-for-cloud/concept-integration-365). |
| 37 | + |
| 38 | + |
| 39 | +For information on other tables in the advanced hunting schema, see the [advanced hunting reference](advanced-hunting-schema-tables.md). |
| 40 | + |
| 41 | +| Column name | Data type | Description | |
| 42 | +|-------------|-----------|-------------| |
| 43 | +| `DataAggregationStartTime` | `datetime` | The start time during which the data was aggregated | |
| 44 | +| `DataAggregationEndTime` | `datetime` | The end time during which the data was aggregated | |
| 45 | +| `DataSource` | `string` | The source of the aggregated logs | |
| 46 | +| `SubscriptionId` | `string` | Unique identifier assigned to the Azure subscription | |
| 47 | +| `ResourceGroup` | `string` | Name of the resource group where the storage account resides | |
| 48 | +| `StorageAccount` | `string` | The identifier for the storage account | |
| 49 | +| `StorageContainer` | `string` | The identifier for the storage container | |
| 50 | +| `StorageFileShare` | `string` | The identifier for the storage file share | |
| 51 | +| `ServiceType` | `string` | Specifies the type of storage service (for example, Blob, ADLS Gen2, Files.REST, Files.SMB) | |
| 52 | +| `IpAddress` | `string` | The IP addresses from which the storage was accessed | |
| 53 | +| `UserAgentHeader` | `string` | Details of the user agent accessing the storage (for example, browser or application) | |
| 54 | +| `OperationNamesList` | `object` | A list of storage operations performed (for example, CreateContainer, DeleteContainer) | |
| 55 | +| `AuthenticationType` | `string` | The authentication method used to access the storage (for example, AccountKey, SAS, Oauth) | |
| 56 | +| `AccountObjectId` | `string` | The unique identifier of the object is making the storage access | |
| 57 | +| `AccountTenantId` | `long` | The unique identifier of the Azure tenant | |
| 58 | +| `AccountApplicationId` | `string` | The application ID associated with the storage access | |
| 59 | +| `AccountUpn` | `string` | The user principal name of the accessing user | |
| 60 | +| `AccountType` | `long` | The account type used | |
| 61 | +| `OperationsCount` | `int` | The total number of storage operations performed | |
| 62 | +| `SuccessfulOperationsCount` | `int` | The count of successful storage operations | |
| 63 | +| `FailedOperationsCount` | `int` | The count of failed storage operations | |
| 64 | +| `FirstEventTimestamp` | `datetime` | The timestamp of the first observed operation in the aggregation period | |
| 65 | +| `LastEventTimestamp` | `datetime` | The timestamp of the last observed operation in the aggregation period | |
| 66 | +| `TotalResponseLength` | `int` | The total response length of all GET operations during the aggregation period | |
| 67 | +| `SuccessfulReadOperations` | `int` | The count of successful read operations | |
| 68 | +| `DistinctGetOperations` | `int` | The count of distinct GET operations performed | |
| 69 | +| `AnonymousSuccessfulOperations` | `int` | The count of successful anonymous operations | |
| 70 | +| `HasAnonymousResourceNotFoundFailures` | `bool` | Indicates whether anonymous resource not found failures occurred | |
| 71 | +| `CountryName` | `string` | The name of the country from where the storage was accessed | |
| 72 | +| `CityName` | `string` | The name of the city from where the storage was accessed | |
| 73 | +| `ProvinceName` | `string` | The name of the province or state from where the storage was accessed | |
| 74 | +| `ClientSystemServiceName` | `string` | The name of the system service is in the data center | |
| 75 | +| `ClientCloudPlatformName` | `string` | The name of the cloud platform where the data center is located | |
| 76 | +| `IsTorExitNode` | `bool` | Indicates whether the IP address is a Tor exit node | |
| 77 | +| `IsKnownSuspiciousIp` | `bool` | Indicates whether the IP address is known to be suspicious | |
| 78 | +| `IsPrivateIp` | `bool` | Indicates whether the IP address is private | |
| 79 | +| `SuspiciousUserAgentName` | `string` | The name of the suspicious user agent accessing the storage | |
| 80 | +| `HashReputationMd5List` | `object` | A list of MD5 hash reputations for the accessed resources | |
| 81 | +| `AzureResourceId` | `string` | The Azure Resource ID of the storage account | |
| 82 | +| `Location` | `string` | The location of the storage account (region) | |
| 83 | +| `Timestamp` | `datetime` | Indicate the time when the record was generated | |
| 84 | +| `ReportId` | `string` | GUID to identify the record in the specific table | |
| 85 | +| `ActionType` | `string` | Type of action (aggregated logs) | |
| 86 | +| `AdditionalFields` | `dynamic` | Additional information about the event in JSON array format | |
| 87 | + |
| 88 | + |
| 89 | +## Sample queries |
| 90 | + |
| 91 | +To detect failed anonymous authentication attempts: |
| 92 | + |
| 93 | +```kusto |
| 94 | +CloudStorageAggregatedEvents |
| 95 | +| where FailedOperationsCount > 0 |
| 96 | +| where AuthenticationType == "Anonymous" |
| 97 | +| project StorageAccount, FailedOperationsCount, OperationNamesList, AdditionalFields |
| 98 | +``` |
| 99 | + |
| 100 | +To list unusual authentication methods used: |
| 101 | + |
| 102 | +```kusto |
| 103 | +// Define a list of expected authentication types |
| 104 | +let ExpectedAuthTypes = dynamic(["AccountKey", "SAS", "Oauth"]); |
| 105 | +CloudStorageAggregatedEvents |
| 106 | +| where DataAggregationEndTime >= ago(7d) |
| 107 | +| where not(AuthenticationType in (ExpectedAuthTypes)) |
| 108 | +| summarize TotalOperations = sum(OperationsCount) by StorageAccount, AuthenticationType |
| 109 | +``` |
| 110 | +To find storage accounts with a high number of failed operations: |
| 111 | + |
| 112 | +```kusto |
| 113 | +CloudStorageAggregatedEvents |
| 114 | +| where DataAggregationEndTime >= ago(7d) |
| 115 | +| summarize TotalFailedOperations = sum(FailedOperationsCount) by StorageAccount |
| 116 | +| where TotalFailedOperations > 100 |
| 117 | +| order by TotalFailedOperations desc |
| 118 | +``` |
| 119 | + |
| 120 | +To monitor anonymous successful operations: |
| 121 | + |
| 122 | +```kusto |
| 123 | +CloudStorageAggregatedEvents |
| 124 | +| where DataAggregationEndTime >= ago(7d) |
| 125 | +| where AuthenticationType == "Anonymous" and SuccessfulOperationsCount > 0 |
| 126 | +| project StorageAccount, SuccessfulOperationsCount, OperationNamesList, AdditionalFields |
| 127 | +``` |
| 128 | + |
| 129 | +To detect access to sensitive containers or file shares: |
| 130 | + |
| 131 | +```kusto |
| 132 | +CloudStorageAggregatedEvents |
| 133 | +| where DataAggregationEndTime >= ago(7d) |
| 134 | +| where AuthenticationType == "Anonymous" and SuccessfulOperationsCount > 0 |
| 135 | +| project StorageAccount, SuccessfulOperationsCount, OperationNamesList, AdditionalFields |
| 136 | +``` |
| 137 | + |
| 138 | +To detect suspicious file uploads with known malicious hashes: |
| 139 | + |
| 140 | +```kusto |
| 141 | +CloudStorageAggregatedEvents |
| 142 | +| where DataAggregationEndTime >= ago(7d) |
| 143 | +| where isnotempty(Md5Hashes) |
| 144 | +| mv-expand HashReputation = Md5Hashes |
| 145 | +| extend HashDetails = parse_json(HashReputation) |
| 146 | +| project StorageAccount, AccountUpn, OperationNamesList, HashMd5 = HashDetails.md5Hash, ResourcePath = HashDetails.resourcePath, OperationType = HashDetails.operationType, ETag = HashDetails.etag |
| 147 | +``` |
| 148 | + |
| 149 | +## Related topics |
| 150 | + |
| 151 | +- [Advanced hunting overview](advanced-hunting-overview.md) |
| 152 | +- [Learn the query language](advanced-hunting-query-language.md) |
| 153 | +- [Use shared queries](advanced-hunting-shared-queries.md) |
| 154 | +- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md) |
| 155 | +- [Understand the schema](advanced-hunting-schema-tables.md) |
| 156 | +- [Apply query best practices](advanced-hunting-best-practices.md) |
| 157 | + |
0 commit comments