ABNORMAL_SECURITY_AUDIT_LOG_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Attribute	Value
Custom Log V1	Yes 🔶 — uses type-suffixed column names
Ingestion API Supported	✓ Yes

Schema (20 columns)

Source: Connector definition

Column Name	Type	Description
abx_body	string	Audit log event payload
abx_body_abx_body_action_s	string	Audit action performed
abx_body_abx_body_audit_subtype_s	string	Audit event sub-type
abx_body_abx_body_audit_type_s	string	Audit event type
abx_body_abx_body_category_s	string	Audit event category
abx_body_abx_body_details_s	string	Audit event details (JSON object)
abx_body_abx_body_source_ip_s	string	Source IP address of the actor
abx_body_abx_body_status_s	string	Status of the audited action
abx_body_abx_body_tenant_name_s	string	Tenant name
abx_body_abx_body_timestamp_t	datetime	Timestamp of the audit event
abx_body_abx_body_user_email_s	string	Email address of the user who performed the action
abx_body_abx_metadata_event_type_s	string	From abx_body.abx_metadata
abx_body_abx_metadata_timestamp_s	string	From abx_body.abx_metadata
abx_body_abx_metadata_trace_id_g	string	From abx_body.abx_metadata
abx_metadata	string	Full event metadata object containing event_type, timestamp, and trace_id
abx_metadata_event_type_s	string	Event type identifier from top-level abx_metadata
abx_metadata_timestamp_s	string	Event timestamp from top-level abx_metadata
abx_metadata_trace_id_g	string	Trace ID (GUID) from top-level abx_metadata
Time	string	Event timestamp in RFC3339 format
TimeGenerated	datetime	Timestamp when the event was ingested into Microsoft Sentinel

This table is used by the following solutions:

This table is ingested by the following connectors:

Connector	Selection Criteria
Abnormal Security (Push)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊