ASimRegistryEventLogs_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Attribute	Value
Ingestion API Supported	✓ Yes

Schema (60 columns)

Source: KQL validation test schema

Column Name	Type
ActingProcessGuid	string
ActingProcessId	string
ActingProcessName	string
ActorScope	string
ActorScopeId	string
ActorSessionId	string
ActorUserId	string
ActorUserIdType	string
ActorUsername	string
ActorUsernameType	string
AdditionalFields	dynamic
DvcAction	string
DvcDescription	string
DvcDomain	string
DvcDomainType	string
DvcFQDN	string
DvcHostname	string
DvcId	string
DvcIdType	string
DvcInterface	string
DvcIpAddr	string
DvcMacAddr	string
DvcOriginalAction	string
DvcOs	string
DvcOsVersion	string
DvcScope	string
DvcScopeId	string
DvcZone	string
EventCount	int
EventEndTime	datetime
EventMessage	string
EventOriginalResultDetails	string
EventOriginalSeverity	string
EventOriginalSubType	string
EventOriginalType	string
EventOriginalUid	string
EventOwner	string
EventProduct	string
EventProductVersion	string
EventReportUrl	string
EventResult	string
EventResultDetails	string
EventSchemaVersion	string
EventSeverity	string
EventStartTime	datetime
EventSubType	string
EventType	string
EventVendor	string
ParentProcessGuid	string
ParentProcessId	string
ParentProcessName	string
RegistryKey	string
RegistryPreviousKey	string
RegistryPreviousValue	string
RegistryPreviousValueData	string
RegistryPreviousValueType	string
RegistryValue	string
RegistryValueData	string
RegistryValueType	string
TimeGenerated	datetime

This table is used by the following solutions:

This table is ingested by the following connectors:

Connector	Selection Criteria
[DEPRECATED] CrowdStrike Falcon Data Replicator (CrowdStrike Managed AWS-S3) (using Azure Function)

Parser	Solution	Selection Criteria
CrowdStrikeReplicatorV2	CrowdStrike Falcon Endpoint Protection

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊