Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Reference for SecurityAlert table in Azure Monitor Logs.
| Attribute | Value |
|---|---|
| Category | Internal |
| Basic Logs Eligible | ✗ No (source) |
| Supports Transformations | ✓ Yes (source) |
| Ingestion API Supported | ✗ No |
| Azure Monitor Tables Reference | View Documentation |
Source: Azure Monitor documentation
| Column Name | Type | Description |
|---|---|---|
| _BilledSize | real | The record size in bytes |
| _IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account |
| AlertLink | string | |
| AlertName | string | |
| AlertSeverity | string | |
| AlertType | string | |
| CompromisedEntity | string | |
| ConfidenceLevel | string | |
| ConfidenceScore | real | |
| Description | string | |
| DisplayName | string | |
| EndTime | datetime | |
| Entities | string | |
| ExtendedLinks | string | |
| ExtendedProperties | string | |
| IsIncident | bool | |
| ProcessingEndTime | datetime | |
| ProductComponentName | string | |
| ProductName | string | |
| ProviderName | string | |
| RemediationSteps | string | |
| ResourceId | string | |
| SourceComputerId | string | |
| StartTime | datetime | |
| Status | string | |
| SubTechniques | string | |
| SystemAlertId | string | |
| Tactics | string | |
| Techniques | string | |
| TimeGenerated | datetime | |
| Type | string | The name of the table |
| VendorName | string | |
| VendorOriginalId | string | |
| WorkspaceResourceGroup | string | |
| WorkspaceSubscriptionId | string |
📖 Related Documentation: Security alert schema reference - Describes the SecurityAlert table schema and field definitions
This table is used by the following solutions:
This table is ingested by the following connectors:
In solution AzureDevOpsAuditing:
| Analytic Rule | Selection Criteria |
|---|---|
| Azure DevOps Pipeline modified by a new user |
In solution Dragos:
| Analytic Rule | Selection Criteria |
|---|---|
| Dragos Notifications |
In solution IoTOTThreatMonitoringwithDefenderforIoT:
In solution Microsoft Business Applications:
In solution Microsoft Defender XDR:
| Analytic Rule | Selection Criteria |
|---|---|
| AV detections related to SpringShell Vulnerability | |
| AV detections related to Tarrask malware | |
| AV detections related to Ukraine threats |
In solution Microsoft Defender for Cloud:
| Analytic Rule | Selection Criteria |
|---|---|
| Detect CoreBackUp Deletion Activity from related Security Alerts |
In solution Microsoft Defender for Cloud Apps:
| Analytic Rule | Selection Criteria |
|---|---|
| Linked Malicious Storage Artifacts |
In solution Microsoft Entra ID Protection:
| Analytic Rule | Selection Criteria |
|---|---|
| Correlate Unfamiliar sign-in properties & atypical travel alerts |
In solution MicrosoftDefenderForEndpoint:
| Analytic Rule | Selection Criteria |
|---|---|
| Aqua Blizzard AV hits - Feb 2022 |
In solution MicrosoftPurviewInsiderRiskManagement:
| Analytic Rule | Selection Criteria |
|---|---|
| Insider Risk_High User Security Alert Correlations | |
| Insider Risk_Microsoft Purview Insider Risk Management Alert Observed |
In solution Multi Cloud Attack Coverage Essentials - Resource Abuse:
In solution Threat Intelligence:
| Analytic Rule | Selection Criteria |
|---|---|
| TI Map URL Entity to SecurityAlert Data | |
| TI map Domain entity to SecurityAlert | |
| TI map Email entity to SecurityAlert |
In solution Threat Intelligence (NEW):
| Analytic Rule | Selection Criteria |
|---|---|
| TI Map URL Entity to SecurityAlert Data | |
| TI map Domain entity to SecurityAlert | |
| TI map Email entity to SecurityAlert |
In solution Web Shells Threat Protection:
| Analytic Rule | Selection Criteria |
|---|---|
| Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts |
In solution Zinc Open Source:
| Analytic Rule | Selection Criteria |
|---|---|
| AV detections related to Zinc actors |
Standalone Content:
GitHub Only:
| Analytic Rule | Selection Criteria |
|---|---|
| Suspicious VM Instance Creation Activity Detected |
In solution AzureDevOpsAuditing:
| Hunting Query | Selection Criteria |
|---|---|
| Azure DevOps - New Package Feed Created | |
| Azure DevOps - New Release Pipeline Created |
In solution Cloud Identity Threat Protection Essentials:
| Hunting Query | Selection Criteria |
|---|---|
| Application Granted EWS Permissions |
In solution Legacy IOC based Threat Protection:
In solution Microsoft Business Applications:
| Hunting Query | Selection Criteria |
|---|---|
| Dataverse - Activity after Microsoft Entra alerts |
In solution MicrosoftPurviewInsiderRiskManagement:
| Hunting Query | Selection Criteria |
|---|---|
| Insider Risk_Entity Anomaly Followed by IRM Alert | |
| Insider Risk_ISP Anomaly to Exfil | |
| Insider Risk_Possible Sabotage |
Standalone Content:
GitHub Only:
In solution Apache Log4j Vulnerability Detection:
| Workbook | Selection Criteria |
|---|---|
| Log4jImpactAssessment |
In solution Azure Key Vault:
| Workbook | Selection Criteria |
|---|---|
| AzureKeyVaultWorkbook |
In solution Azure SQL Database solution for sentinel:
| Workbook | Selection Criteria |
|---|---|
| Workbook-AzureSQLSecurity |
In solution Azure kubernetes Service:
| Workbook | Selection Criteria |
|---|---|
| AksSecurity |
In solution AzureSecurityBenchmark:
| Workbook | Selection Criteria |
|---|---|
| AzureSecurityBenchmark |
In solution Censys:
| Workbook | Selection Criteria |
|---|---|
| Censys |
In solution ContinuousDiagnostics&Mitigation:
| Workbook | Selection Criteria |
|---|---|
| ContinuousDiagnostics&Mitigation |
In solution CybersecurityMaturityModelCertification(CMMC)2.0:
| Workbook | Selection Criteria |
|---|---|
| CybersecurityMaturityModelCertification_CMMCV2 |
In solution DNS Essentials:
| Workbook | Selection Criteria |
|---|---|
| DNSSolutionWorkbook |
In solution DORA Compliance:
| Workbook | Selection Criteria |
|---|---|
| DORACompliance |
In solution DPDP Compliance:
| Workbook | Selection Criteria |
|---|---|
| DPDPCompliance |
In solution ExtraHop:
| Workbook | Selection Criteria |
|---|---|
| ExtraHopDetectionsOverview |
In solution GDPR Compliance & Data Security:
| Workbook | Selection Criteria |
|---|---|
| GDPRComplianceAndDataSecurity |
In solution GreyNoiseThreatIntelligence:
| Workbook | Selection Criteria |
|---|---|
| GreyNoiseOverview |
In solution HIPAA Compliance:
| Workbook | Selection Criteria |
|---|---|
| HIPAACompliance |
In solution Infoblox:
| Workbook | Selection Criteria |
|---|---|
| Infoblox_Lookup_Workbook | |
| Infoblox_Workbook |
In solution Infoblox SOC Insights:
| Workbook | Selection Criteria |
|---|---|
| InfobloxSOCInsightsWorkbook |
In solution Lumen Defender Threat Feed:
| Workbook | Selection Criteria |
|---|---|
| Lumen-Threat-Feed-Overview |
In solution MaturityModelForEventLogManagementM2131:
| Workbook | Selection Criteria |
|---|---|
| MaturityModelForEventLogManagement_M2131 |
In solution Microsoft Defender Threat Intelligence:
| Workbook | Selection Criteria |
|---|---|
| MicrosoftThreatIntelligence |
In solution Microsoft Defender XDR:
| Workbook | Selection Criteria |
|---|---|
| MicrosoftDefenderForIdentity | |
| MicrosoftDefenderForOffice365detectionsandinsights |
In solution Microsoft Defender for Cloud Apps:
| Workbook | Selection Criteria |
|---|---|
| MicrosoftCloudAppSecurity |
In solution MicrosoftPurviewInsiderRiskManagement:
| Workbook | Selection Criteria |
|---|---|
| InsiderRiskManagement |
In solution NISTSP80053:
| Workbook | Selection Criteria |
|---|---|
| NISTSP80053 |
In solution Network Session Essentials:
| Workbook | Selection Criteria |
|---|---|
| NetworkSessionEssentials | |
| NetworkSessionEssentialsV2 |
In solution ReversingLabs:
| Workbook | Selection Criteria |
|---|---|
| ReversingLabs-CapabilitiesOverview |
In solution SAP BTP:
| Workbook | Selection Criteria |
|---|---|
| SAPBTPActivity |
In solution SOC Handbook:
| Workbook | Selection Criteria |
|---|---|
| AnalyticsEfficiency | |
| AnomalyData | |
| AzureSentinelSecurityAlerts | |
| IncidentOverview | |
| IntsightsIOCWorkbook | |
| InvestigationInsights | |
| MITREAttack | |
| SentinelCentral |
In solution Threat Intelligence:
| Workbook | Selection Criteria |
|---|---|
| ThreatIntelligence |
In solution Threat Intelligence (NEW):
| Workbook | Selection Criteria |
|---|---|
| ThreatIntelligenceNew |
In solution ThreatAnalysis&Response:
| Workbook | Selection Criteria |
|---|---|
| DynamicThreatModeling&Response | |
| ThreatAnalysis&Response |
In solution ThreatConnect:
| Workbook | Selection Criteria |
|---|---|
| ThreatConnectOverview |
In solution Web Session Essentials:
| Workbook | Selection Criteria |
|---|---|
| WebSessionEssentials |
In solution ZeroTrust(TIC3.0):
| Workbook | Selection Criteria |
|---|---|
| ZeroTrustTIC3 |
GitHub Only:
| Parser | Solution | Selection Criteria |
|---|---|---|
| DragosNotificationsToSentinel | Dragos | |
| DragosPullNotificationsToSentinel | Dragos |
This table collects data from the following Azure resource types:
microsoft.securityinsights/securityinsightsBrowse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊