ConfigurationChange

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for ConfigurationChange table in Azure Monitor Logs.

Attribute	Value
Category	IT & Management Tools
Basic Logs Eligible	✗ No (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation

Schema
Solutions
Content Items
Resource Types

Schema (57 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is `false` ingestion isn't billed to your Azure account
_ResourceId	string	A unique identifier for the resource that the record is associated with
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
Acls	string	The Access-Control List specifies which users or system processes are granted access to objects
Attributes	string
ChangeCategory	string	The type of change that occurred: Added Removed Modified
Computer	string
ConfigChangeType	string	Type of configuration item that changed: Files Software WindowsServices Registry Daemons
Current	string	Current value
DateCreated	datetime	Date that the item was created
DateModified	datetime	Date that the item was last modified
FieldsChanged	string	Fields that were changed as part of the change record
FileContentChecksum	string	Checksum of the file content
FileSystemPath	string	File system path for the changed file
Hive	string	Registry hive for the changed registry key
LastSnapshotAge	long	Age of the last snapshot
Location	string
ManagementGroupName	string	Name of a resource's assigned management group
Previous	string	Previous value
PreviousAcls	string	Previous Acl value
PreviousAttributes	string	Previous attributes value
PreviousDateCreated	datetime	Previous date created time
PreviousDateModified	datetime	Previous date modified time
PreviousFileContentChecksum	string	Previous file content checksum value
PreviousSize	long	Previous file size
PreviousValueData	string	Previous registry value data
PreviousValueType	string	Previous registry value type
Publisher	string	Software publisher name
RegistryKey	string	Registry key name
Size	long	Current size of the changed file
SoftwareDescription	string	Description of the software
SoftwareName	string	Name of the software
SoftwareType	string	Type of the software: Application Package Update
SourceComputerId	string
SourceSystem	string	The type of agent the event was collected by. For example, `OpsManager` for Windows agent, either direct connect or Operations Manager, `Linux` for all Linux agents, or `Azure` for Azure Diagnostics
SvcAccount	string	User account that is associated with the service executable explicitly to provide a security context for the service
SvcChangeType	string	Service property that was changed
SvcController	string	Parent process for the daemon
SvcDisplayName	string	Human-frinedly name for the service
SvcName	string	Name of the service
SvcPath	string	The file path to the executable for the service
SvcPreviousAccount	string	Previous user account that was associated with the sevice executable
SvcPreviousController	string	Previous parent process for the daemon
SvcPreviousPath	string	Previous file path to the executable for the service
SvcPreviousRunlevels	string	Previous modes used by the daemon for system operation
SvcPreviousStartupType	string	Previous startup behavior of the service
SvcPreviousState	string	Previous state of the service
SvcRunlevels	string	Modes used by the daemon for system operation
SvcStartupType	string	Startup behavior of the service
SvcState	string	Current state of the service
TimeGenerated	datetime	Date and time the record was created.
Type	string	The name of the table
ValueData	string	Data contained in the value and registry key being tracked
ValueName	string	Name of the value for the registry key being tracked
ValueType	string	Type of the value for the registry key being tracked
VMUUID	string

Solutions (4)

This table is used by the following solutions:

Content Items Using This Table (4)

Workbooks (4)

In solution CybersecurityMaturityModelCertification(CMMC)2.0:

Workbook	Selection Criteria
CybersecurityMaturityModelCertification_CMMCV2

In solution MaturityModelForEventLogManagementM2131: ConfigChangeType == "Registry"

Workbook
MaturityModelForEventLogManagement_M2131

In solution NISTSP80053:

Workbook	Selection Criteria
NISTSP80053

In solution SOX IT Compliance:

Workbook	Selection Criteria
SOXITCompliance

Resource Types

This table collects data from the following Azure resource types:

microsoft.compute/virtualmachines
microsoft.conenctedvmwarevsphere/virtualmachines
microsoft.azurestackhci/virtualmachines
microsoft.scvmm/virtualmachines
microsoft.compute/virtualmachinescalesets

Selection Criteria Summary (1 criteria, 1 total references)

References by type: 0 connectors, 1 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`ConfigChangeType == "Registry"`	-	1	-	-	1
Total	0	1	0	0	1

ConfigChangeType

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`Registry`	-	1	-	-	1