McasShadowItReporting

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

---

Reference for McasShadowItReporting table in Azure Monitor Logs.

Attribute	Value
Category	Security
Basic Logs Eligible	✗ No (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation

Contents

• Schema
• Solutions
• Connectors
• Content Items

Schema (27 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
AadTenantId	string
AppCategory	string
AppId	string
AppInstance	string
AppName	string
AppScore	int
AppTags	dynamic
BlockedEvents	int
Date	datetime
DownloadedBytes	int
EnrichedUserName	string
IpAddress	string
MachineId	string
MachineName	string
RawUserName	string
RichUserName	string
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
StreamName	string
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime
TotalBytes	int
TotalEvents	int
Type	string	The name of the table
UploadedBytes	int
UserName	string

Solutions (1)

This table is used by the following solutions:

• Microsoft Defender for Cloud Apps

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Microsoft Defender for Cloud Apps

---

Content Items Using This Table (3)

Workbooks (3)

In solution Microsoft Defender for Cloud Apps:

Workbook	Selection Criteria
MicrosoftCloudAppSecurity

GitHub Only:

Workbook	Selection Criteria
M365SecurityPosture
MicrosoftCloudAppSecurity

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index