HuntingBookmark

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for HuntingBookmark table in Azure Monitor Logs.

Attribute Value
Category Security
Basic Logs Eligible ✗ No (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Azure Monitor Tables Reference View Documentation

Contents

Schema (24 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
_ResourceId string A unique identifier for the resource that the record is associated with
_SubscriptionId string A unique identifier for the subscription that the record is associated with
BookmarkId string Guid - the bookmark ARM resource name
BookmarkName string Bookmark name given by the user
BookmarkType string Can be used to mark bookmark origin - currently not used
CreatedBy string JSON object with the user who created the bookmark, including: ObjectID, email and name
CreatedTime datetime The timestamp of bookmark first creation time
Entities string A serialized JSON of entities mapped by this bookmark
EventTime datetime The timestamp of the original event that is bookmarked
LastUpdatedTime datetime The timestamp of bookmark last update time
Notes string Notes provided by user
QueryEndTime datetime Query time range end time
QueryResultRow string JSON object with a single result row of the query
QueryStartTime datetime Query time range start time
QueryText string Original log analytics query text
SoftDeleted bool Was the bookmark deleted by user
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Tags string Comma seperated list of tags provided by user
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The timestamp (UTC) of the log
Type string
UpdatedBy string JSON object with the user who last updated the bookmark, including: ObjectID, email and name

Solutions (1)

This table is used by the following solutions:

Content Items Using This Table (2)

Workbooks (2)

In solution SOC Handbook:

Workbook Selection Criteria
AnomalyData
InvestigationInsights

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index