Layer: Cloud
This documentation provides detailed information about all fields available for XDR for Cloud - Azure Activity Logs.
| Field Name | Type | Searchable | General Field | Description | Example | Products |
|---|---|---|---|---|---|---|
| actionStatus | string | true | - | The status of the event operation | MICROSOFT.KUSTO/CLUSTERS/READ | XDR for Cloud - Azure Activity Logs |
| actionSubStatus | string | true | - | The HTTP status or action status |
|
XDR for Cloud - Azure Activity Logs |
| authAction | string | true | - | The operation performed on a scope | Microsoft.Kusto/Clusters/write | XDR for Cloud - Azure Activity Logs |
| authPrincipalId | string | true | - | The entity ID | 123abc2a6c314b0ab03a891259123abc | XDR for Cloud - Azure Activity Logs |
| authPrincipalType | string | true | - | The entity type | Group | XDR for Cloud - Azure Activity Logs |
| authRole | string | true | - | The Azure RBAC role | Owner | XDR for Cloud - Azure Activity Logs |
| authRoleAssignmentScope | string | true | - | The role assignment scope | /subscriptions/11111111-1111-1111-1111-111111111111 | XDR for Cloud - Azure Activity Logs |
| authScope | string | true | - | The Azure resource or resource group | /subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/user-group/providers/Microsoft.Kusto/Clusters/user-test | XDR for Cloud - Azure Activity Logs |
| claimsAppId | string | true | - | The Azure Application ID | 11111111-1111-1111-1111-111111111111 | XDR for Cloud - Azure Activity Logs |
| claimsAppIdAcr | int | true | - | The Azure application authentication method | 2 | XDR for Cloud - Azure Activity Logs |
| claimsAud | string | true | - | The intended recipient of the authentication token | https://management.core.windows.net/ | XDR for Cloud - Azure Activity Logs |
| claimsAuthnClassRef | int | true | - | The user authentication class reference | 1 | XDR for Cloud - Azure Activity Logs |
| claimsAuthnMethodsRef | dynamic | true | - | The list of authentication methods for a user |
|
XDR for Cloud - Azure Activity Logs |
| claimsEmail | string | true | - | The email address of the authenticated user | sample_email@trendmicro.com | XDR for Cloud - Azure Activity Logs |
| claimsExp | long | true | - | The authentication token expiration time | 1736745944 | XDR for Cloud - Azure Activity Logs |
| claimsGroups | dynamic | true | - | The Microsoft Entra ID group claim |
|
XDR for Cloud - Azure Activity Logs |
| claimsIdentityProvider | string | true | - | The IdP that authenticated the user | https://sts.windows.net/11111111-1111-1111-1111-111111111111/ | XDR for Cloud - Azure Activity Logs |
| claimsIdType | string | true | - | The Microsoft Entra ID identity type | user | XDR for Cloud - Azure Activity Logs |
| claimsInitiatedBy | string | true | - | The user name or service principal | user_name | XDR for Cloud - Azure Activity Logs |
| claimsIpAddr | string | true | - | The Microsoft Entra ID user authentication request IP | 10.10.10.10 | XDR for Cloud - Azure Activity Logs |
| claimsIssuedAt | long | true | - | The authentication token timestamp (in Unix format) | 1736731195 | XDR for Cloud - Azure Activity Logs |
| claimsIssuer | string | true | - | The authentication token issuer | https://sts.windows.net/11111111-1111-1111-1111-111111111111/ | XDR for Cloud - Azure Activity Logs |
| claimsName | string | true | - | The user name | sample_email@trendmicro.com | XDR for Cloud - Azure Activity Logs |
| claimsNameId | string | true | - | The authenticated user Name ID | aaaaaaaaaaBBBBBBBBBB11111111112222222222333 | XDR for Cloud - Azure Activity Logs |
| claimsNbf | long | true | - | The time an authentication token becomes valid | 1736731195 | XDR for Cloud - Azure Activity Logs |
| claimsObjectId | string | true | - | The Microsoft authenticated user Object ID | 11111111-1111-1111-1111-111111111111 | XDR for Cloud - Azure Activity Logs |
| claimsScope | string | true | - | The granted access scope to the application | user_impersonation | XDR for Cloud - Azure Activity Logs |
| claimsTenantGuid | string | true | - | The Microsoft Entra ID Tenant ID | 11111111-1111-1111-1111-111111111111 | XDR for Cloud - Azure Activity Logs |
| cloudResourceId | string | true | - | The cloud resource ID | /SUBSCRIPTIONS/11111111-1111-1111-1111-111111111111/RESOURCEGROUPS/GROUP/PROVIDERS/MICROSOFT.KUSTO/CLUSTERS/TEST | XDR for Cloud - Azure Activity Logs |
| correlationId | string | true | - | The correlation ID | 11111111-1111-1111-1111-111111111111 | XDR for Cloud - Azure Activity Logs |
| eventCategory | string | true | - | The event category used in LookupEvents calls | Administrative | XDR for Cloud - Azure Activity Logs |
| eventId | string | true | - | The event ID | 1500001 | XDR for Cloud - Azure Activity Logs |
| eventTime | long | true | - | The time the agent or product detected the event | 1656324260000 |
|
| eventVersion | string | true | - | The log event format version | 6.2024.42.16+5d1e2c2.release_2024w42 | XDR for Cloud - Azure Activity Logs |
| logLevel | string | true | - | The event severity level | Information | XDR for Cloud - Azure Activity Logs |
| operationType | string | true | - | The operation performed in the event | MICROSOFT.KUSTO/CLUSTERS/READ | XDR for Cloud - Azure Activity Logs |
| pname | string | true | - | The product name | Azure Activity Log | XDR for Cloud - Azure Activity Logs |
| productCode | string | true | - | The internal product code | aml |
|
| regionId | string | true | - | The cloud asset region | Japan East | XDR for Cloud - Azure Activity Logs |
| requestAccess | string | true | - | The access action of the request | Allow | XDR for Cloud - Azure Activity Logs |
| requestAllowBlobPublicAccess | bool | true | - | Whether public access is allowed for blobs in response to a request | False | XDR for Cloud - Azure Activity Logs |
| requestAllowSharedKeyAccess | bool | true | - | Whether shared key access is allowed in response to a request | False | XDR for Cloud - Azure Activity Logs |
| requestCrossTenantReplication | bool | true | - | Whether cross-tenant data replication is allowed in response to a request | False | XDR for Cloud - Azure Activity Logs |
| requestDirection | string | true | - | The traffic direction of the request | Inbound | XDR for Cloud - Azure Activity Logs |
| requestEnabled | bool | true | - | Whether the request is enabled | True | XDR for Cloud - Azure Activity Logs |
| requestPermissionsActions | dynamic | true | - | The list of request permissions actions | ['*'] | XDR for Cloud - Azure Activity Logs |
| requestPrincipalId | string | true | - | The request principal GUID | 11111111-1111-1111-1111-111111111111 | XDR for Cloud - Azure Activity Logs |
| requestPrincipalType | string | true | - | The request principal type | User | XDR for Cloud - Azure Activity Logs |
| requestPublicNetworkAccess | string | true | - | The resource public network access setting of the request | Enabled | XDR for Cloud - Azure Activity Logs |
| requestRoleDefinitionId | string | true | - | The cloud resource ID of the request | /SUBSCRIPTIONS/11111111-1111-1111-1111-111111111111/RESOURCEGROUPS/GROUP/PROVIDERS/MICROSOFT.KUSTO/CLUSTERS/TEST | XDR for Cloud - Azure Activity Logs |
| requestSourceAddressPrefix | string | true | - | The source IP prefix of the request | 10.10.10.10/16 | XDR for Cloud - Azure Activity Logs |
| responseAccess | string | true | - | The access action of the response |
|
XDR for Cloud - Azure Activity Logs |
| responseAllowBlobPublicAccess | bool | true | - | Whether public access is allowed for blobs in response to a request | True | XDR for Cloud - Azure Activity Logs |
| responseAllowSharedKeyAccess | bool | true | - | Whether shared key access is allowed in response to a request | True | XDR for Cloud - Azure Activity Logs |
| responseDirection | string | true | - | The traffic direction of the response | Inbound | XDR for Cloud - Azure Activity Logs |
| responsePublicNetworkAccess | string | true | - | The resource public network access setting in response to a request | Disabled | XDR for Cloud - Azure Activity Logs |
| responseSourceAddressPrefix | string | true | - | The source IP prefix of the response | 10.10.10.10/16 | XDR for Cloud - Azure Activity Logs |
| src | dynamic | true |
|
The source IP address | ['10.10.10.10'] | XDR for Cloud - Azure Activity Logs |
| tenantId | string | true | - | The Microsoft Entra ID Tenant ID | 11111111-1111-1111-1111-111111111111 | XDR for Cloud - Azure Activity Logs |
| uuid | guid | true | - | The unique key of the log entry | 11111111-1111-1111-1111-111111111111 |
|
| vendor | string | true | - | The device vendor | Microsoft | XDR for Cloud - Azure Activity Logs |
| vendorParsed | dynamic | true | - | The normalized event log (JSON format) | {"RoleLocation": "Japan East", "Stamp": "FDWorker", "ReleaseVersion": "6.2024.42.16+5d1e2c2.release_2024w42", "time": "2025-01-13T01:27:41.8080097Z"} | XDR for Cloud - Azure Activity Logs |
| vendorRaw | string | true | - | The original event log string | {"RoleLocation": "Japan East", "Stamp": "FDWorker", "ReleaseVersion": "6.2024.42.16+5d1e2c2.release_2024w42", "time": "2025-01-13T01:27:41.8080097Z"} | XDR for Cloud - Azure Activity Logs |
Generated by XDR Common Schema Public Doc Generator V2