SecurityIncident

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for SecurityIncident table in Azure Monitor Logs.

Attribute	Value
Category	Internal
Basic Logs Eligible	✗ No (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes (source)
Azure Monitor Tables Reference	View Documentation

Schema
Schema References
Solutions
Content Items

Schema (33 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is `false` ingestion isn't billed to your Azure account
AdditionalData	dynamic	Additional data on the incident
AlertIds	dynamic	The IDs of the alerts related to the incident
BookmarkIds	dynamic	The IDs of the bookmarks related to the incident
Classification	string	The classification the incident was given when closed
ClassificationComment	string	Description of the reason the incident was closed
ClassificationReason	string	The classification reason the incident was given when closed
ClosedTime	datetime	Timestamp (UTC) of when the incident was last closed
Comments	dynamic	The comments added to the incident
CreatedTime	datetime	Timestamp (UTC) of when the incident was created
Description	string	The description of the incident
FirstActivityTime	datetime	Timestamp (UTC) of when the first activity in the incident occurred
FirstModifiedTime	datetime	Timestamp (UTC) of when the incident was first modified
IncidentName	string	The resource name of the incident
IncidentNumber	int	The sequential number of the incident
IncidentUrl	string	The URI to open the incident in Azure Sentinel portal
Labels	dynamic	The labels added to the incident
LastActivityTime	datetime	Timestamp (UTC) of when the last activity in the incident occurred
LastModifiedTime	datetime	Timestamp (UTC) of when the incident was last modified
ModifiedBy	string	The source of the change in the incident
Owner	dynamic	The user the incident is assigned to
ProviderIncidentId	string	The incident ID assigned by the incident provider
ProviderName	string	The name of the source provider that generated the incident
RelatedAnalyticRuleIds	dynamic	The IDs of the Analytic rules associated with the incident
Severity	string	The severity of the incident
SourceSystem	string	The type of agent the event was collected by. For example, `OpsManager` for Windows agent, either direct connect or Operations Manager, `Linux` for all Linux agents, or `Azure` for Azure Diagnostics
Status	string	The status of the incident
Tasks	dynamic	The tasks added to the incident
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	Timestamp (UTC) of when the incident was ingested
Title	string	The title of the incident
Type	string	The name of the table

Schema References

Official Microsoft Learn documentation for field/column information:

SecurityIncident Schema Reference (Azure Monitor)

Solutions (35)

This table is used by the following solutions:

Content Items Using This Table (52)

Analytic Rules (3)

In solution MicrosoftPurviewInsiderRiskManagement:

Analytic Rule	Selection Criteria
Insider Risk_High User Security Alert Correlations
Insider Risk_High User Security Incidents Correlation

In solution SOCRadar: Labels has "SOCRadar"
Labels has "Synced"

Analytic Rule
SOCRadar Unsynced Closed Incident

Hunting Queries (1)

In solution SOCRadar: Labels has "SOCRadar"

Hunting Query
SOCRadar Incident Correlation

Workbooks (40)

In solution Apache Log4j Vulnerability Detection:

Workbook	Selection Criteria
Log4jImpactAssessment

In solution Azure Key Vault:

Workbook	Selection Criteria
AzureKeyVaultWorkbook

In solution Azure SQL Database solution for sentinel:

Workbook	Selection Criteria
Workbook-AzureSQLSecurity

In solution AzureSecurityBenchmark: Severity == "High"
Title !contains "URL"
Title !contains "net"
Title !contains "normalization"
Title !contains "web"
Title contains "AAD"
Title contains "Account"
Title contains "Identity"
Title contains "Login"
Title contains "Sign"
Title contains "User"
Title contains "WAF"
Title contains "access"
Title contains "anti"
Title contains "app"
Title contains "auth"
Title contains "cert"
Title contains "certificate"
Title contains "cred"
Title contains "data"
Title contains "dns"
Title contains "dos"
Title contains "exploit"
Title contains "impersonate"
Title contains "inject"
Title contains "intrusion"
Title contains "key"
Title contains "mal"
Title contains "mining"
Title contains "password"
Title contains "program"
Title contains "secret"
Title contains "sensitive"
Title contains "service principal"
Title contains "tool"
Title contains "travel"
Title contains "virus"
Title contains "ware"
Title contains "worm"

Workbook
AzureSecurityBenchmark

In solution Censys: ModifiedBy contains "playbook - censys"

Workbook
Censys

In solution ContinuousDiagnostics&Mitigation:

Workbook	Selection Criteria
ContinuousDiagnostics&Mitigation

In solution CybersecurityMaturityModelCertification(CMMC)2.0: Classification in "BenignPositive,FalsePositive,TruePositive,Undetermined"
Severity == "High"
Title contains "PII"
Title contains "USB"
Title contains "access"
Title contains "account"
Title contains "backdoor"
Title contains "beacon"
Title contains "brute"
Title contains "c2"
Title contains "confidential"
Title contains "cred"
Title contains "data"
Title contains "deny"
Title contains "drive"
Title contains "execution"
Title contains "exfil"
Title contains "exploit"
Title contains "file"
Title contains "intellectual"
Title contains "leak"
Title contains "logon"
Title contains "loss"
Title contains "media"
Title contains "removable"
Title contains "restricted"
Title contains "sensitive"
Title contains "shared"
Title contains "sign"
Title contains "software"
Title contains "spill"
Title contains "storage"
Title contains "test"
Title contains "tool"
Title contains "trojan"
Title contains "usb"
Title contains "virus"
Title contains "ware"

Workbook
CybersecurityMaturityModelCertification_CMMCV2

In solution DORA Compliance:

Workbook	Selection Criteria
DORACompliance

In solution DPDP Compliance:

Workbook	Selection Criteria
DPDPCompliance

In solution GDPR Compliance & Data Security:

Workbook	Selection Criteria
GDPRComplianceAndDataSecurity

In solution GreyNoiseThreatIntelligence:

Workbook	Selection Criteria
GreyNoiseOverview

In solution HIPAA Compliance:

Workbook	Selection Criteria
HIPAACompliance

In solution Infoblox:

Workbook	Selection Criteria
Infoblox_Lookup_Workbook
Infoblox_Workbook

In solution Infoblox SOC Insights:

Workbook	Selection Criteria
InfobloxSOCInsightsWorkbook

In solution IoTOTThreatMonitoringwithDefenderforIoT: AdditionalData contains "T0801"
AdditionalData contains "T0803"
AdditionalData contains "T0806"
AdditionalData contains "T0807"
AdditionalData contains "T0809"
AdditionalData contains "T0811"
AdditionalData contains "T0814"
AdditionalData contains "T0816"
AdditionalData contains "T0817"
AdditionalData contains "T0821"
AdditionalData contains "T0822"
AdditionalData contains "T0826"
AdditionalData contains "T0828"
AdditionalData contains "T0831"
AdditionalData contains "T0836"
AdditionalData contains "T0838"
AdditionalData contains "T0839"
AdditionalData contains "T0842"
AdditionalData contains "T0843"
AdditionalData contains "T0845"
AdditionalData contains "T0846"
AdditionalData contains "T0847"
AdditionalData contains "T0848"
AdditionalData contains "T0849"
AdditionalData contains "T0851"
AdditionalData contains "T0855"
AdditionalData contains "T0857"
AdditionalData contains "T0858"
AdditionalData contains "T0859"
AdditionalData contains "T0861"
AdditionalData contains "T0863"
AdditionalData contains "T0865"
AdditionalData contains "T0866"
AdditionalData contains "T0867"
AdditionalData contains "T0869"
AdditionalData contains "T0871"
AdditionalData contains "T0874"
AdditionalData contains "T0874T0812"
AdditionalData contains "T0881"
AdditionalData contains "T0882"
AdditionalData contains "T0883"
AdditionalData contains "T0884"
AdditionalData contains "T0885"
AdditionalData contains "T0886"
AdditionalData contains "T0889"
Severity in "High,Low,Medium"
Title contains "(MDIoT)"

Workbook
IoTOTThreatMonitoringwithDefenderforIoT

In solution Lumen Defender Threat Feed:

Workbook	Selection Criteria
Lumen-Threat-Feed-Overview

In solution MaturityModelForEventLogManagementM2131:

Workbook	Selection Criteria
MaturityModelForEventLogManagement_M2131

In solution Microsoft Active Directory Tier Model: Severity in "High,Informational,Low,Medium"

Workbook
MicrosoftADTierModel

In solution Microsoft Defender Threat Intelligence:

Workbook	Selection Criteria
MicrosoftThreatIntelligence

In solution Microsoft Defender XDR: Classification == "TruePositive"

Workbook
MicrosoftDefenderForOffice365detectionsandinsights

In solution MicrosoftPurviewInsiderRiskManagement:

Workbook	Selection Criteria
InsiderRiskManagement

In solution NISTSP80053:

Workbook	Selection Criteria
NISTSP80053

In solution ReversingLabs: Comments !contains "Comment created from playbook"

Workbook
ReversingLabs-CapabilitiesOverview

In solution SOC Handbook:

Workbook	Selection Criteria
AnalyticsEfficiency
AnomaliesVisualization
AnomalyData
IncidentOverview	`ModifiedBy != "Incident created from alert"`
InvestigationInsights
SecurityOperationsEfficiency	`ModifiedBy !in "Alert Grouping,Fusion,Incident created from alert"`
SentinelCentral

In solution SOC-Process-Framework:

Workbook	Selection Criteria
SOCProcessFramework

In solution SentinelSOARessentials:

Workbook	Selection Criteria
IncidentTasksWorkbook	`Owner == "Unassigned"` `Owner != "Unassigned"` `Tasks != "[]"`
SecurityOperationsEfficiency	`ModifiedBy !in "Alert Grouping,Fusion,Incident created from alert"`

In solution Threat Intelligence:

Workbook	Selection Criteria
ThreatIntelligence

In solution Threat Intelligence (NEW):

Workbook	Selection Criteria
ThreatIntelligenceNew

In solution ThreatAnalysis&Response:

Workbook	Selection Criteria
DynamicThreatModeling&Response

In solution ThreatConnect: SourceSystem startswith "ThreatConnect-"

Workbook
ThreatConnectOverview

In solution UniFi Site Manager (CCF): Title contains "Critical"
Title contains "IPS"
Title contains "adopted"
Title contains "data connector"
Title contains "log shipping"
Title startswith "UniFi Site Manager"

Workbook
UnifiSiteManager

In solution ZeroTrust(TIC3.0): AdditionalData contains "Microsoft Defender for Endpoint"

Workbook
ZeroTrustTIC3

Selection Criteria Summary (15 criteria, 16 total references)

References by type: 0 connectors, 16 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`ModifiedBy !in "Alert Grouping,Fusion,Incident created from alert"`	-	2	-	-	2
`Labels has "SOCRadar"` `Labels has "Synced"`	-	1	-	-	1
`Labels has "SOCRadar"`	-	1	-	-	1
`Severity == "High"` `Title !contains "URL"` `Title !contains "net"` `Title !contains "normalization"` `Title !contains "web"` `Title contains "AAD"` `Title contains "Account"` `Title contains "Identity"` `Title contains "Login"` `Title contains "Sign"` `Title contains "User"` `Title contains "WAF"` `Title contains "access"` `Title contains "anti"` `Title contains "app"` `Title contains "auth"` `Title contains "cert"` `Title contains "certificate"` `Title contains "cred"` `Title contains "data"` `Title contains "dns"` `Title contains "dos"` `Title contains "exploit"` `Title contains "impersonate"` `Title contains "inject"` `Title contains "intrusion"` `Title contains "key"` `Title contains "mal"` `Title contains "mining"` `Title contains "password"` `Title contains "program"` `Title contains "secret"` `Title contains "sensitive"` `Title contains "service principal"` `Title contains "tool"` `Title contains "travel"` `Title contains "virus"` `Title contains "ware"` `Title contains "worm"`	-	1	-	-	1
`ModifiedBy contains "playbook - censys"`	-	1	-	-	1
`Classification in "BenignPositive,FalsePositive,TruePositive,Undetermined"` `Severity == "High"` `Title contains "PII"` `Title contains "USB"` `Title contains "access"` `Title contains "account"` `Title contains "backdoor"` `Title contains "beacon"` `Title contains "brute"` `Title contains "c2"` `Title contains "confidential"` `Title contains "cred"` `Title contains "data"` `Title contains "deny"` `Title contains "drive"` `Title contains "execution"` `Title contains "exfil"` `Title contains "exploit"` `Title contains "file"` `Title contains "intellectual"` `Title contains "leak"` `Title contains "logon"` `Title contains "loss"` `Title contains "media"` `Title contains "removable"` `Title contains "restricted"` `Title contains "sensitive"` `Title contains "shared"` `Title contains "sign"` `Title contains "software"` `Title contains "spill"` `Title contains "storage"` `Title contains "test"` `Title contains "tool"` `Title contains "trojan"` `Title contains "usb"` `Title contains "virus"` `Title contains "ware"`	-	1	-	-	1
`AdditionalData contains "T0801"` `AdditionalData contains "T0803"` `AdditionalData contains "T0806"` `AdditionalData contains "T0807"` `AdditionalData contains "T0809"` `AdditionalData contains "T0811"` `AdditionalData contains "T0814"` `AdditionalData contains "T0816"` `AdditionalData contains "T0817"` `AdditionalData contains "T0821"` `AdditionalData contains "T0822"` `AdditionalData contains "T0826"` `AdditionalData contains "T0828"` `AdditionalData contains "T0831"` `AdditionalData contains "T0836"` `AdditionalData contains "T0838"` `AdditionalData contains "T0839"` `AdditionalData contains "T0842"` `AdditionalData contains "T0843"` `AdditionalData contains "T0845"` `AdditionalData contains "T0846"` `AdditionalData contains "T0847"` `AdditionalData contains "T0848"` `AdditionalData contains "T0849"` `AdditionalData contains "T0851"` `AdditionalData contains "T0855"` `AdditionalData contains "T0857"` `AdditionalData contains "T0858"` `AdditionalData contains "T0859"` `AdditionalData contains "T0861"` `AdditionalData contains "T0863"` `AdditionalData contains "T0865"` `AdditionalData contains "T0866"` `AdditionalData contains "T0867"` `AdditionalData contains "T0869"` `AdditionalData contains "T0871"` `AdditionalData contains "T0874"` `AdditionalData contains "T0874T0812"` `AdditionalData contains "T0881"` `AdditionalData contains "T0882"` `AdditionalData contains "T0883"` `AdditionalData contains "T0884"` `AdditionalData contains "T0885"` `AdditionalData contains "T0886"` `AdditionalData contains "T0889"` `Severity in "High,Low,Medium"` `Title contains "(MDIoT)"`	-	1	-	-	1
`Severity in "High,Informational,Low,Medium"`	-	1	-	-	1
`Classification == "TruePositive"`	-	1	-	-	1
`Comments !contains "Comment created from playbook"`	-	1	-	-	1
`Owner == "Unassigned"` `Owner != "Unassigned"` `Tasks != "[]"`	-	1	-	-	1
`ModifiedBy != "Incident created from alert"`	-	1	-	-	1
`SourceSystem startswith "ThreatConnect-"`	-	1	-	-	1
`Title contains "Critical"` `Title contains "IPS"` `Title contains "adopted"` `Title contains "data connector"` `Title contains "log shipping"` `Title startswith "UniFi Site Manager"`	-	1	-	-	1
`AdditionalData contains "Microsoft Defender for Endpoint"`	-	1	-	-	1
Total	0	16	0	0	16

AdditionalData

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`contains T0801`	-	1	-	-	1
`contains T0803`	-	1	-	-	1
`contains T0806`	-	1	-	-	1
`contains T0807`	-	1	-	-	1
`contains T0809`	-	1	-	-	1
`contains T0811`	-	1	-	-	1
`contains T0814`	-	1	-	-	1
`contains T0816`	-	1	-	-	1
`contains T0817`	-	1	-	-	1
`contains T0821`	-	1	-	-	1
`contains T0822`	-	1	-	-	1
`contains T0826`	-	1	-	-	1
`contains T0828`	-	1	-	-	1
`contains T0831`	-	1	-	-	1
`contains T0836`	-	1	-	-	1
`contains T0838`	-	1	-	-	1
`contains T0839`	-	1	-	-	1
`contains T0842`	-	1	-	-	1
`contains T0843`	-	1	-	-	1
`contains T0845`	-	1	-	-	1
`contains T0846`	-	1	-	-	1
`contains T0847`	-	1	-	-	1
`contains T0848`	-	1	-	-	1
`contains T0849`	-	1	-	-	1
`contains T0851`	-	1	-	-	1
`contains T0855`	-	1	-	-	1
`contains T0857`	-	1	-	-	1
`contains T0858`	-	1	-	-	1
`contains T0859`	-	1	-	-	1
`contains T0861`	-	1	-	-	1
`contains T0863`	-	1	-	-	1
`contains T0865`	-	1	-	-	1
`contains T0866`	-	1	-	-	1
`contains T0867`	-	1	-	-	1
`contains T0869`	-	1	-	-	1
`contains T0871`	-	1	-	-	1
`contains T0874`	-	1	-	-	1
`contains T0874T0812`	-	1	-	-	1
`contains T0881`	-	1	-	-	1
`contains T0882`	-	1	-	-	1
`contains T0883`	-	1	-	-	1
`contains T0884`	-	1	-	-	1
`contains T0885`	-	1	-	-	1
`contains T0886`	-	1	-	-	1
`contains T0889`	-	1	-	-	1
`contains Microsoft Defender for Endpoint`	-	1	-	-	1

Classification

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`TruePositive`	-	2	-	-	2
`BenignPositive`	-	1	-	-	1
`FalsePositive`	-	1	-	-	1
`Undetermined`	-	1	-	-	1

Comments

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`!contains Comment created from playbook`	-	1	-	-	1

Labels

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`has SOCRadar`	-	2	-	-	2
`has Synced`	-	1	-	-	1

ModifiedBy

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`!= Incident created from alert`	-	3	-	-	3
`!= Alert Grouping`	-	2	-	-	2
`!= Fusion`	-	2	-	-	2
`contains playbook - censys`	-	1	-	-	1

Owner

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`Unassigned`	-	1	-	-	1
`!= Unassigned`	-	1	-	-	1

Severity

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`High`	-	4	-	-	4
`Low`	-	2	-	-	2
`Medium`	-	2	-	-	2
`Informational`	-	1	-	-	1

SourceSystem

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`startswith ThreatConnect-`	-	1	-	-	1

Tasks

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`!= []`	-	1	-	-	1

Title

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`contains access`	-	2	-	-	2
`contains cred`	-	2	-	-	2
`contains data`	-	2	-	-	2
`contains exploit`	-	2	-	-	2
`contains sensitive`	-	2	-	-	2
`contains tool`	-	2	-	-	2
`contains virus`	-	2	-	-	2
`contains ware`	-	2	-	-	2
`!contains URL`	-	1	-	-	1
`!contains net`	-	1	-	-	1
`!contains normalization`	-	1	-	-	1
`!contains web`	-	1	-	-	1
`contains AAD`	-	1	-	-	1
`contains Account`	-	1	-	-	1
`contains Identity`	-	1	-	-	1
`contains Login`	-	1	-	-	1
`contains Sign`	-	1	-	-	1
`contains User`	-	1	-	-	1
`contains WAF`	-	1	-	-	1
`contains anti`	-	1	-	-	1
`contains app`	-	1	-	-	1
`contains auth`	-	1	-	-	1
`contains cert`	-	1	-	-	1
`contains certificate`	-	1	-	-	1
`contains dns`	-	1	-	-	1
`contains dos`	-	1	-	-	1
`contains impersonate`	-	1	-	-	1
`contains inject`	-	1	-	-	1
`contains intrusion`	-	1	-	-	1
`contains key`	-	1	-	-	1
`contains mal`	-	1	-	-	1
`contains mining`	-	1	-	-	1
`contains password`	-	1	-	-	1
`contains program`	-	1	-	-	1
`contains secret`	-	1	-	-	1
`contains service principal`	-	1	-	-	1
`contains travel`	-	1	-	-	1
`contains worm`	-	1	-	-	1
`contains PII`	-	1	-	-	1
`contains USB`	-	1	-	-	1
`contains account`	-	1	-	-	1
`contains backdoor`	-	1	-	-	1
`contains beacon`	-	1	-	-	1
`contains brute`	-	1	-	-	1
`contains c2`	-	1	-	-	1
`contains confidential`	-	1	-	-	1
`contains deny`	-	1	-	-	1
`contains drive`	-	1	-	-	1
`contains execution`	-	1	-	-	1
`contains exfil`	-	1	-	-	1
`contains file`	-	1	-	-	1
`contains intellectual`	-	1	-	-	1
`contains leak`	-	1	-	-	1
`contains logon`	-	1	-	-	1
`contains loss`	-	1	-	-	1
`contains media`	-	1	-	-	1
`contains removable`	-	1	-	-	1
`contains restricted`	-	1	-	-	1
`contains shared`	-	1	-	-	1
`contains sign`	-	1	-	-	1
`contains software`	-	1	-	-	1
`contains spill`	-	1	-	-	1
`contains storage`	-	1	-	-	1
`contains test`	-	1	-	-	1
`contains trojan`	-	1	-	-	1
`contains usb`	-	1	-	-	1
`contains (MDIoT)`	-	1	-	-	1
`contains Critical`	-	1	-	-	1
`contains IPS`	-	1	-	-	1
`contains adopted`	-	1	-	-	1
`contains data connector`	-	1	-	-	1
`contains log shipping`	-	1	-	-	1
`startswith UniFi Site Manager`	-	1	-	-	1