DuoActivity_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Attribute Value
Ingestion API Supported ✓ Yes

Contents

Schema (29 columns)

Source: KQL validation test schema

Column Name Type
AccessDeviceBrowser string
AccessDeviceBrowserVersion string
AccessDeviceCity string
AccessDeviceCountry string
AccessDeviceEpkey string
AccessDeviceIp string
AccessDeviceOs string
AccessDeviceOsVersion string
AccessDeviceState string
AccountKey string
ActionDetails string
ActionName string
ActivityId string
ActorDetails string
ActorKey string
ActorName string
ActorType string
ApplicationKey string
ApplicationName string
ApplicationType string
EventCount int
OldTarget dynamic
OutcomeResult string
TargetDetails string
TargetKey string
TargetName string
TargetType string
TimeGenerated datetime
Ts datetime

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Cisco Duo Activity Logs

Content Items Using This Table (12)

Analytic Rules (6)

In solution CiscoDuoSecurity:

Analytic Rule Selection Criteria
Cisco Duo - AD sync failed
Cisco Duo - Admin password reset
Cisco Duo - Admin user created
Cisco Duo - Admin user deleted
Cisco Duo - Multiple admin 2FA failures
Cisco Duo - Multiple users deleted

Hunting Queries (5)

In solution CiscoDuoSecurity:

Hunting Query Selection Criteria
Cisco Duo - Admin failure authentications
Cisco Duo - Admin failure authentications
Cisco Duo - Delete actions
Cisco Duo - Deleted users
Cisco Duo - New users

Workbooks (1)

In solution CiscoDuoSecurity:

Workbook Selection Criteria
CiscoDuo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index