CoreAzureBackup

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for CoreAzureBackup table in Azure Monitor Logs.

Attribute	Value
Category	Azure Resources, IT & Management Tools
Basic Logs Eligible	✗ No (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation

Schema
Solutions
Content Items
Resource Types

Schema (73 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is `false` ingestion isn't billed to your Azure account
_ResourceId	string	A unique identifier for the resource that the record is associated with
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
AgentVersion	string
ArchiveTierLatestRecoveryPointLocation	string
ArchiveTierLatestRecoveryPointTime	datetime
ArchiveTierOldestRecoveryPointLocation	string
ArchiveTierOldestRecoveryPointTime	datetime
ArchiveTierStorageConsumedInMBs	real
ArchiveTierStorageReplicationType	string
AzureBackupAgentVersion	string
AzureDataCenter	string
BackupItemAppVersion	string
BackupItemFriendlyName	string
BackupItemFrontEndSize	real
BackupItemId	string
BackupItemName	string
BackupItemProtectionState	string
BackupItemType	string
BackupItemUniqueId	string
BackupManagementServerName	string
BackupManagementServerOSVersion	string
BackupManagementServerType	string
BackupManagementServerUniqueId	string
BackupManagementServerVersion	string
BackupManagementType	string
BillingGroupFriendlyName	string
BillingGroupUniqueId	string
Category	string
DatasourceFriendlyName	string
DatasourceResourceGroupName	string
DatasourceResourceId	string
DatasourceSetFriendlyName	string
DatasourceSetResourceId	string
DatasourceSetType	string
DatasourceSubscriptionId	string
DatasourceType	string
ExtendedProperties	dynamic
IsArchiveEnabled	bool
LatestRecoveryPointLocation	string
LatestRecoveryPointTime	datetime
OldestRecoveryPointLocation	string
OldestRecoveryPointTime	datetime
OperationName	string
PolicyId	string
PolicyName	string
PolicyUniqueId	string
ProtectedContainerFriendlyName	string
ProtectedContainerLocation	string
ProtectedContainerName	string
ProtectedContainerOSType	string
ProtectedContainerOSVersion	string
ProtectedContainerProtectionState	string
ProtectedContainerType	string
ProtectedContainerUniqueId	string
ProtectedContainerWorkloadType	string
ProtectionGroupName	string
ResourceGroupName	string
ResourceId	string
SchemaVersion	string
SecondaryBackupProtectionState	string
SourceSystem	string	The type of agent the event was collected by. For example, `OpsManager` for Windows agent, either direct connect or Operations Manager, `Linux` for all Linux agents, or `Azure` for Azure Diagnostics
State	string
StorageConsumedInMBs	real
StorageReplicationType	string
SubscriptionId	string
TimeGenerated	datetime
Type	string	The name of the table
VaultName	string
VaultTags	string
VaultType	string
VaultUniqueId	string

Solutions (1)

This table is used by the following solutions:

Microsoft Defender for Cloud

Content Items Using This Table (1)

Analytic Rules (1)

In solution Microsoft Defender for Cloud: State == "Deleted"

Analytic Rule
Detect CoreBackUp Deletion Activity from related Security Alerts

Resource Types

This table collects data from the following Azure resource types:

microsoft.recoveryservices/vaults

Selection Criteria Summary (1 criteria, 1 total references)

References by type: 0 connectors, 1 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`State == "Deleted"`	-	1	-	-	1
Total	0	1	0	0	1

State

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`Deleted`	-	1	-	-	1