OCI_LogsV2_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Attribute	Value
Custom Log V1	Yes 🔶 — uses type-suffixed column names
Supports Transformations	✓ Yes
Ingestion API Supported	✓ Yes
Lake-Only Ingestion	✓ Yes (source)

Schema
Schema References
Solutions
Connectors
Content Items
Parsers

Schema (86 columns)

Source: Connector definition

Column Name	Type	Description
data_action_s	string	Data action s
data_additionalDetails_imageId_s	string	Data additionaldetails imageid s
data_additionalDetails_shape_s	string	Data additionaldetails shape s
data_additionalDetails_userId_s	string	Data additionaldetails userid s
data_additionalDetails_volumeId_s	string	Data additionaldetails volumeid s
data_availabilityDomain_s	string	Data availabilitydomain s
data_compartmentId_s	string	Data compartmentid s
data_compartmentName_s	string	Data compartmentname s
data_definedTags_Oracle_Tags_CreatedBy_s	string	Data definedtags oracle tags createdby s
data_definedTags_Oracle_Tags_CreatedOn_t	datetime	Data definedtags oracle tags createdon t
data_endTime_d	int	Data endtime d
data_eventGroupingId_s	string	Data eventgroupingid s
data_eventName_s	string	Data eventname s
data_flowid_s	string	Data flowid s
data_identity_authType_s	string	Data identity authtype s
data_identity_callerId_s	string	Data identity callerid s
data_identity_callerName_s	string	Data identity callername s
data_identity_consoleSessionId_s	string	Data identity consolesessionid s
data_identity_credentials_s	string	Data identity credentials s
data_identity_principalId_s	string	Data identity principalid s
data_identity_principalName_s	string	Data identity principalname s
data_identity_tenantId_s	string	Data identity tenantid s
data_packets_d	int	Data packets d
data_request_headers_oci_original_url_s	string	Data request headers oci original url s
data_request_headers_X_Forwarded_For_s	string	Data request headers x forwarded for s
data_request_headers_X_Real_IP_s	string	Data request headers x real ip s
data_request_id_s	string	Data request id s
data_request_parameters_compartmentId_s	string	Data request parameters compartmentid s
data_request_parameters_id_s	string	Data request parameters id s
data_request_parameters_imageId_s	string	Data request parameters imageid s
data_request_parameters_instanceId_s	string	Data request parameters instanceid s
data_request_parameters_lifecycleState_s	string	Data request parameters lifecyclestate s
data_request_parameters_name_s	string	Data request parameters name s
data_request_parameters_serviceName_s	string	Data request parameters servicename s
data_request_parameters_subnetId_s	string	Data request parameters subnetid s
data_request_parameters_userId_s	string	Data request parameters userid s
data_request_parameters_vcnId_s	string	Data request parameters vcnid s
data_request_path_s	string	Data request path s
data_resourceId_s	string	Data resourceid s
data_response_payload_id_s	string	Data response payload id s
data_response_payload_resourceName_s	string	Data response payload resourcename s
data_startTime_d	int	Data starttime d
data_stateChange_current_compartmentId_s	string	Data statechange current compartmentid s
data_stateChange_current_displayName_s	string	Data statechange current displayname s
data_stateChange_current_fingerprint_s	string	Data statechange current fingerprint s
data_stateChange_current_id_s	string	Data statechange current id s
data_stateChange_current_Instance_availabilityDomain_s	string	Data statechange current instance availabilitydomain s
data_stateChange_current_Instance_compartmentId_s	string	Data statechange current instance compartmentid s
data_stateChange_current_Instance_displayName_s	string	Data statechange current instance displayname s
data_stateChange_current_instanceId_s	string	Data statechange current instanceid s
data_stateChange_current_isEnabled_b	bool	Data statechange current isenabled b
data_stateChange_current_keyId_s	string	Data statechange current keyid s
data_stateChange_current_lifecycleState_s	string	Data statechange current lifecyclestate s
data_stateChange_current_logGroupId_s	string	Data statechange current loggroupid s
data_stateChange_current_logType_s	string	Data statechange current logtype s
data_stateChange_current_retentionDuration_d	real	Data statechange current retentionduration d
data_stateChange_current_timeCreated_t	datetime	Data statechange current timecreated t
data_stateChange_current_timeUpdated_t	datetime	Data statechange current timeupdated t
data_stateChange_current_userDisplayName_s	string	Data statechange current userdisplayname s
data_stateChange_current_userId_s	string	Data statechange current userid s
data_stateChange_current_userName_s	string	Data statechange current username s
data_status_s	string	Data status s
DstBytes	int	Dstbytes
DstIpAddr	string	Dstipaddr
DstPortNumber	int	Dstportnumber
EventMessage	string	Eventmessage
EventProduct	string	Eventproduct
EventType	string	Eventtype
EventVendor	string	Eventvendor
HttpRequestMethod	string	Httprequestmethod
HttpStatusCode	string	Httpstatuscode
HttpUserAgentOriginal	string	Httpuseragentoriginal
id	string	Id
NetworkProtocol	string	Networkprotocol
oracle_compartmentid_s	string	Oracle compartmentid s
oracle_loggroupid_s	string	Oracle loggroupid s
oracle_logid_s	string	Oracle logid s
oracle_tenantid_s	string	Oracle tenantid s
oracle_vniccompartmentocid_s	string	Oracle vniccompartmentocid s
oracle_vnicocid_s	string	Oracle vnicocid s
oracle_vnicsubnetocid_s	string	Oracle vnicsubnetocid s
source_s	string	Source s
SrcIpAddr	string	Srcipaddr
SrcPortNumber	int	Srcportnumber
StreamName	string	Streamname
TimeGenerated	datetime	The time when the log entry was generated

Schema References

Official Microsoft Learn documentation for field/column information:

Data Source Schema Reference

Solutions (1)

This table is used by the following solutions:

Oracle Cloud Infrastructure

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Oracle Cloud Infrastructure (via Codeless Connector Framework)

Content Items Using This Table (21)

Analytic Rules (10)

In solution Oracle Cloud Infrastructure:

Analytic Rule	Selection Criteria
OCI - Discovery activity
OCI - Event rule deleted
OCI - Inbound SSH connection
OCI - Insecure metadata endpoint
OCI - Instance metadata access
OCI - Multiple instances launched
OCI - Multiple instances terminated
OCI - Multiple rejects on rare ports
OCI - SSH scanner
OCI - Unexpected user agent

Hunting Queries (10)

In solution Oracle Cloud Infrastructure:

Hunting Query	Selection Criteria
OCI - Delete operations
OCI - Deleted users
OCI - Destination ports (inbound traffic)
OCI - Destination ports (outbound traffic)
OCI - Launched instances
OCI - New users
OCI - Terminated instances
OCI - Update activities
OCI - Updated instances
OCI - User source IP addresses