Skip to content

Commit 8313f28

Browse files
wwlpublishwwlpublish
authored
pull base content,head:MicrosoftDocs:main,into:wwlpublishsync
2 parents 767a99c + fb3aec6 commit 8313f28

File tree

2 files changed

+30
-32
lines changed

2 files changed

+30
-32
lines changed

‎learn-pr/wwl-sci/query-logs-azure-sentinel/includes/4-understand-common-tables.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@ When Sentinel ingests data from the Data Connectors, the following table lists t
22

33
| Table| Description|
44
| :--- | :--- |
5-
| AzureActivity| Entries from the Azure Activity log that provides insight into any subscription-level or management group level events that have occurred in Azure.|
6-
| AzureDiagnostics| Stores resource logs for Azure services that use Azure Diagnostics mode. Resource logs describe the internal operation of Azure resources.|
7-
| AuditLogs| Audit log for Microsoft Entra ID. Includes system activity information about user and group management, managed applications, and directory activities.|
8-
| CommonSecurityLog| Syslog messages using the Common Event Format (CEF).|
9-
| McasShadowItReporting| Microsoft Defender for Cloud Apps logs|
10-
| OfficeActivity| Audit logs for Office 365 tenants collected by Microsoft Sentinel. Including Exchange, SharePoint and Teams logs.|
11-
| SecurityEvent| Security events collected from windows machines by Azure Security Center or Microsoft Sentinel|
12-
| SigninLogs| Azure Activity Directory Sign-in logs|
13-
| Syslog| Syslog events on Linux computers using the Log Analytics agent.|
14-
| Event| Sysmon Events collected from a Windows host.|
15-
| WindowsFirewall| Windows Firewall Events|
5+
| `AzureActivity`| Entries from the Azure Activity log that provides insight into any subscription-level or management group level events that occurred in Azure.|
6+
| `AzureDiagnostics`| Stores resource logs for Azure services that use Azure Diagnostics mode. Resource logs describe the internal operation of Azure resources.|
7+
| `AuditLogs`| Audit log for Microsoft Entra ID. Includes system activity information about user and group management, managed applications, and directory activities.|
8+
| `CommonSecurityLog`| Syslog messages using the Common Event Format (CEF).|
9+
| `McasShadowItReporting`| Microsoft Defender for Cloud Apps logs|
10+
| `OfficeActivity`| Audit logs for Office 365 tenants collected by Microsoft Sentinel. Including Exchange, SharePoint and Teams logs.|
11+
| `SecurityEvent`| Security events collected from windows machines by Azure Security Center or Microsoft Sentinel|
12+
| `SigninLogs`| Azure Activity Directory Sign-in logs|
13+
| `Syslog`| Syslog events on Linux computers using the Log Analytics agent.|
14+
| `Event`| Sysmon Events collected from a Windows host.|
15+
| `WindowsFirewall`| Windows Firewall Events|

‎learn-pr/wwl-sci/query-logs-azure-sentinel/includes/5-understand-microsoft-365-defender-tables.md

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,22 @@ The Microsoft Defender XDR Sentinel Data Connector can populate tables with raw
33

44
| Table name| Description|
55
| :--- | :--- |
6-
| AlertEvidence| Files, IP addresses, URLs, users, or devices associated with alerts|
7-
| CloudAppEvents| Events involving accounts and objects in Office 365 and other cloud apps and services|
8-
| DeviceEvents| Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection|
9-
| DeviceFileCertificateInfo| Certificate information of signed files obtained from certificate verification events on endpoints|
10-
| DeviceFileEvents| File creation, modification, and other file system events|
11-
| DeviceImageLoadEvents| DLL loading events|
12-
| DeviceInfo| Machine information, including OS information|
13-
| DeviceLogonEvents| Sign-ins and other authentication events on devices|
14-
| DeviceNetworkEvents| Network connection and related events|
15-
| DeviceNetworkInfo| Network properties of devices, including physical adapters, IP and MAC addresses, as well as connected networks and domains|
16-
| DeviceProcessEvents| Process creation and related events|
17-
| DeviceRegistryEvents| Creation and modification of registry entries|
18-
| EmailEvents| Microsoft 365 email events, including email delivery and blocking events|
19-
| EmailPostDeliveryEvents| Security events that occur post-delivery, after Microsoft 365 has delivered the emails to the recipient mailbox|
20-
| EmailUrlInfo| Information about URLs on emails|
21-
|EmailAttachmentInfo| Information about files attached to Office 365 emails|
22-
| IdentityDirectoryEvents| Events involving an on-premises domain controller running Active Directory (AD). This table covers a range of identity-related events and system events on the domain controller.|
23-
| IdentityLogonEvents| Authentication events on Active Directory and Microsoft online services|
24-
| IdentityQueryEvents| Queries for Active Directory objects, such as users, groups, devices, and domains|
25-
26-
6+
| `AlertEvidence`| Files, IP addresses, URLs, users, or devices associated with alerts|
7+
| `CloudAppEvents`| Events involving accounts and objects in Office 365 and other cloud apps and services|
8+
| `DeviceEvents`| Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection|
9+
| `DeviceFileCertificateInfo`| Certificate information of signed files obtained from certificate verification events on endpoints|
10+
| `DeviceFileEvents`| File creation, modification, and other file system events|
11+
| `DeviceImageLoadEvents`| DLL loading events|
12+
| `DeviceInfo`| Machine information, including OS information|
13+
| `DeviceLogonEvents`| Sign-ins and other authentication events on devices|
14+
| `DeviceNetworkEvents`| Network connection and related events|
15+
| `DeviceNetworkInfo`| Network properties of devices, including physical adapters, IP and MAC addresses, as well as connected networks and domains|
16+
| `DeviceProcessEvents`| Process creation and related events|
17+
| `DeviceRegistryEvents`| Creation and modification of registry entries|
18+
| `EmailEvents`| Microsoft 365 email events, including email delivery and blocking events|
19+
| `EmailPostDeliveryEvents`| Security events that occur post-delivery, after Microsoft 365 has delivered the emails to the recipient mailbox|
20+
| `EmailUrlInfo`| Information about URLs on emails|
21+
|`EmailAttachmentInfo`| Information about files attached to Office 365 emails|
22+
| `IdentityDirectoryEvents`| Events involving an on-premises domain controller running Active Directory (AD). This table covers a range of identity-related events and system events on the domain controller.|
23+
| `IdentityLogonEvents`| Authentication events on Active Directory and Microsoft online services|
24+
| `IdentityQueryEvents`| Queries for Active Directory objects, such as users, groups, devices, and domains|

0 commit comments

Comments
 (0)