Share via

SecurityEvent

  • Article

Security events collected from windows machines by Azure Security Center or Azure Sentinel.

Table attributes

Attribute Value
Resource types microsoft.securityinsights/securityinsights,
microsoft.compute/virtualmachines,
microsoft.conenctedvmwarevsphere/virtualmachines,
microsoft.azurestackhci/virtualmachines,
microsoft.scvmm/virtualmachines,
microsoft.compute/virtualmachinescalesets
Categories Security
Solutions Security, SecurityInsights
Basic log No
Ingestion-time transformation Yes
Sample Queries Yes

Columns

Column Type Description
AccessMask string Hexadecimal mask for the requested or performed operation.
Account string The Security context for services or users.
AccountDomain string Subject’s domain or computer name.
AccountExpires string The date when the account expires.
AccountName string The name of the account that requested the “remove domain trust” operation.
AccountSessionIdentifier string A unique identifier that is generated by the machine when the session is created.
AccountType string Identifies whether the account is a computer account (machine) or a user's.
Activity string The descriptive title of the event occurred.
AdditionalInfo string Additional information that is provided by the source, which do not mapped to other fields, represented by list.
AdditionalInfo2 string Additional information that is provided by the source, which do not mapped to other fields, represented by list.
AllowedToDelegateTo string The list of SPNs to which this account can present delegated credentials.
Attributes string Additional information about the event.
AuditPolicyChanges string Events that are generated when changes are made to the system audit policy or audit settings on a file or registry key.
AuditsDiscarded int Number of audit messages that were discarded.
AuthenticationLevel int Number of audit messages that were discarded.
AuthenticationPackageName string the name of loaded Authentication Package. The format is: DLL_PATH_AND_NAME: AUTHENTICATION_PACKAGE_NAME.
AuthenticationProvider string The identity of the provider responsible for the authentication process (can include a certificate authority, a username, a password authentication system, etc).
AuthenticationServer string The server in which located the authentication provider.
AuthenticationService int The service in which located the authentication provider.
AuthenticationType string the type of authentication that was used for the event (two-factor authentication, biometric authentication, etc).
AzureDeploymentID string Azure deployment ID of the cloud service the log belongs to.
_BilledSize real The record size in bytes
CACertificateHash string The hash value of the certificate authority's (CA) certificate that was used to authenticate the user who performed the event.
CalledStationID string Information about the ID of the station that initiated the action that led to the security event.
CallerProcessId string Hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process.
CallerProcessName string Full path and the name of the executable for the process.
CallingStationID string Information about the ID of the station that initiated the action that led to the security event.
CAPublicKeyHash string Hash value that identifies the public key of a certification authority (CA) that issued a certificate.
CategoryId string The category of the security event that occurred (login attempt, data breach, etc).
CertificateDatabaseHash string Hash value that identifies the database that issued a certificate.
Channel string The channel to which the event was logged.
ClassId string 'Class Guid' attribute of device.
ClassName string 'Class' attribute of device.
ClientAddress string IP address of the computer from which the TGT request was received.
ClientIPAddress string IP address of the computer that initiated the action that led to the event.
ClientName string computer name from which the user was reconnected. Has 'Unknown' value for console session.
CommandLine string The command line arguments that were passed to an application or process that was involved in the event.
CompatibleIds string 'Compatible Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':
Computer string The name of the computer on which the event occurred.
DCDNSName string The DNS name of the domain controller that was involved in the event.
DeviceDescription string the description of the device that was involved in the event.
DeviceId string The unique identifier of the device that was involved in the event.
DisplayName string It is a name, displayed in the address book for a particular account. This is usually the combination of the user's first name, middle initial, and last name.
Disposition string The event outcome/ resolution, such as whether the event was resolved or whether any action was taken in response to the event.
DomainBehaviorVersion string msDS-Behavior-Version domain attribute was modified. Numeric value.
DomainName string The name of removed trusted domain.
DomainPolicyChanged string Indicates whether any domain policies have been changed as part of the event (password policies, security policies, etc).
DomainSid string SID of the trust partner. This parameter might not be captured in the event, and in that case appears as 'NULL SID'.
EAPType string The type of Extensible Authentication Protocol (EAP) that was used for the event authentication process.
ElevatedToken string A 'Yes' or 'No' flag. If 'Yes', then the session this event represents is elevated and has administrator privileges.
ErrorCode int Contains error code for Failure events. For Success events this parameter has '0x0' value.
EventData string Event specific data associated with the event.
EventID int The identifier that the provider used to identify the event.
EventSourceName string The name of the software that logs the event (applicationor a succomponent).
ExtendedQuarantineState string The state of the network quarantine process, if applicable. Network quarantine is a process by which unauthorized devices are prevented from accessing a network until they meet certain security requirements or have been checked for malware.
FailureReason string textual explanation of Status field value. For this event, it typically has 'Account locked out' value.
FileHash string The hash value for any files that are were accessed or modified as part of the event, or any files that were used in the authentication or authorization process.
FilePath string Full path and filename of the key file on which the operation was performed.
FilePathNoUser string The path of any files that are related to the event, excluding the username or other user-specific information.
Filter string Filters that are used in the performed event.
ForceLogoff string '\Security Settings\Local Policies\Security Options\Network security: Force logoff when logon hours expire' group policy.
Fqbn string The fully qualified binary name (FQBN) for any files that are related to the event.
FullyQualifiedSubjectMachineName string The fully qualified domain name (FQDN) of the machine that initiated the event.
FullyQualifiedSubjectUserName string The username of the user or service that initiated the event in FQDN format.
GroupMembership string The list of group SIDs which logged account belongs to (member of). Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
HandleId string Hexadecimal value of a handle to Object Name. This field can be used for correlation with other events.
HardwareIds string 'Hardware Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':
HomeDirectory string User's home directory. If homeDrive attribute is set and specifies a drive letter, homeDirectory should be a UNC path. The path must be a network UNC of the form \Server\Share\Directory.
HomePath string User's home path. The path must be a network UNC of the form \Server\Share\Directory.
InterfaceUuid string The unique identifier (UUID) for the network interface that was used for the event.
IpAddress string the network address (usually IPv4 or IPv6) associated with the event.
IpPort string The network port number associated with the event.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
KeyLength int The length of NTLM Session Security key. Typically it has 128 bit or 56 bit length.
Level string Windows categorizes every event with a severity level. The levels in order of severity are information, verbose, warning, error and critical expressed in numbers.
LmPackageName string The name of the package or software component that is currently using the Local Security Authority (LSA) on the machine where the event is being generated.
LocationInformation string 'Location information' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details':
LockoutDuration string '\Security Settings\Account Policies\Account Lockout Policy\Account lockout duration' group policy. Numeric value.
LockoutObservationWindow string '\Security Settings\Account Policies\Account Lockout Policy\Reset account lockout counter after' group policy. Numeric value.
LockoutThreshold string '\Security Settings\Account Policies\Account Lockout Policy\Account lockout threshold' group policy. Numeric value.
LoggingResult string The result of the logon process.
LogonGuid string A GUID that can help you correlate this event with another event that can contain the same Logon GUID.
LogonHours string Hours that the account is allowed to logon to the domain.
LogonID string Hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID.
LogonProcessName string The name of registered logon process.
LogonType int The type of logon which was performed.
LogonTypeName string The type of logon or authentication event that is being captured by the event log (common values:Interactive, Network, RemoteInteractive, Unlock).
MachineAccountQuota string ms-DS-MachineAccountQuota domain attribute was modified. Numeric value.
MachineInventory string Information about the hardware configuration and software environment of the computer where the event is being generated. It can include different data points, for instance: the make and model of the computer, the amount of RAM or storage space available, the version numbers of various software applications, etc).
MachineLogon string Information about a successful logon event in the machine.
ManagementGroupName string Additional information based on the resource type.
MandatoryLabel string ID of integrity label which was assigned to the new process.
MaxPasswordAge string The period of time (in days) that a password can be used before the system requires the user to change it.
MemberName string The user account that was involved in the event.
MemberSid string The security identifier (SID) associated with the user account that was involved in the event.
MinPasswordAge string The period of time (in days) that a password must be used before the system requires the user to change it.
MinPasswordLength string The least number of characters that can make up a password for a user account.
MixedDomainMode string The domain mode of a system or domain controller.
NASIdentifier string The identifier of the network access server (NAS) that was involved in the event.
NASIPv4Address string The IPv4Address of the network access server (NAS) that was involved in the event, if applicable.
NASIPv6Address string The IPv6Address of the network access server (NAS) that was involved in the event, if applicable.
NASPort string the port on the network access server that was used in the event.
NASPortType string the type of network access server (NAS) used in the event.
NetworkPolicyName string The name of the network policy associated with the event.
NewDate string New date in UTC time zone. The format is YYYY-MM-DD.
NewMaxUsers string The new maximum number of users allowed for a resource in the event.
NewProcessId string Hexadecimal Process ID of the new process. Process ID (PID) is a number used by the operating system to uniquely identify an active process.
NewProcessName string Full path and the name of the executable for the new process.
NewRemark string The new value of network share 'Comments:' field. Has 'N/A' value if it isn't set.
NewShareFlags string The share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.
NewTime string New time that was set in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ
NewUacValue string Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account.
NewValue string New value for changed registry key value.
NewValueType string New type of changed registry key value.
ObjectName string Name and other identifying information for the object for which access was requested. For example, for a file, the path would be included.
ObjectServer string Contains the name of the Windows subsystem calling the routine.
ObjectType string The type of an object that was accessed during the operation.
ObjectValueName string The name of modified registry key value.
OemInformation string The original equipment manufacturer (OEM) associated with a device or system in the event.
OldMaxUsers string The previous maximum number of users allowed for a resource in the event.
OldRemark string the old value of network share 'Comments:' field. Has 'N/A' value if it isn't set.
OldShareFlags string The previous share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.
OldUacValue string Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the previous value of userAccountControl attribute of user object.
OldValue string Old value for changed registry key value.
OldValueType string Old type of changed registry key value.
OperationType string The type of operation which was performed on an object
PackageName string The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon.
ParentProcessName string The name of the parent process associated with the event.
PasswordHistoryLength string \Security Settings\Account Policies\Password Policy\Enforce password history” group policy. Numeric value.
PasswordLastSet string Last time the account’s password was modified.
PasswordProperties string The password policies or properties associated with the event, for example: password length, complexity and expiration date.
PreviousDate string The previous date associated with the event.
PreviousTime string Previous time in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ.
PrimaryGroupId string Relative Identifier (RID) of user’s object primary group.
PrivateKeyUsageCount string The number of times a private key has been used.
PrivilegeList string The privileges, including user, group, or system privileges associated with the event.
Process string The name of the process that generates the event.
ProcessId string Identifies the process that generated the event.
ProcessName string Full path and the name of the executable for the process.
ProfilePath string Specifies a path to the account's profile. This value can be a null string, a local absolute path, or a UNC path.
Properties string Depends on Object Type. This field can be empty or contain the list of the object properties that were accessed.
ProtocolSequence string Information about the protocol used for an authentication attempt.
ProxyPolicyName string Name of the policy that was used to configure the proxy server for connecting to the network.
QuarantineHelpURL string URL that provides help with troubleshooting a network quarantine issue.
QuarantineSessionID string Identifier of the session where the file was assessed for quarantine.
QuarantineSessionIdentifier string Identifier of the session where the file was assessed for quarantine.
QuarantineState string It shows whether the file is quarantined.
QuarantineSystemHealthResult string Report that shows the status of the files that have been quarantined.
RelativeTargetName string Relative name of the accessed target file or folder. This file-path is relative to the network share. If access was requested for the share itself, then this field appears as “\”.
RemoteIpAddress string The IP address of the computer that initiated a remote connection.
RemotePort string The port number of the remote computer that initiated a connection.
Requester string The event requester identifier.
RequestId string A unique identifier that's associated with particular requests, such as those made over HTTP.
_ResourceId string A unique identifier for the resource that the record is associated with
RestrictedAdminMode string Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.
RowsDeleted string The number of rows that were deleted as a part of a particular operation.
SamAccountName string logon name for account used to support clients and servers from previous versions of Windows (pre-Windows 2000 logon name).
ScriptPath string Specifies the path of the account’s logon script.
SecurityDescriptor string Information about the security settings and permissions of a particular object or resource.
ServiceAccount string The security context that the service will run as when started.
ServiceFileName string Indicates the type of service that was registered with the Service Control Manager.
ServiceName string The name of installed service.
ServiceStartType int Contains information about how a particular service should be started, whether it should be started automatically or manually.
ServiceType string Indicates the type of service that was registered with the Service Control Manager.
SessionName string The name of the session to which the user was reconnected.
ShareLocalPath string The local path of accessed network share.
ShareName string The name of accessed network share. The format is: \*\SHARE_NAME.
SidHistory string Contains previous SIDs used for the object if the object was moved from another domain.
SourceComputerId string Unique identifier assigned to each computer in a Windows domain.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Status string The reason why logon failed. For this event, it typically has '0xC0000234' value. The most common status codes are listed in Table 12. Windows logon status codes.
StorageAccount string Sets the storage account access key.
SubcategoryGuid string The unique GUID of changed subcategory.
SubcategoryId string A unique identifier for a specific type of the event.
Subject string Information about the security principal (for instance: user account) that initiated the event.
SubjectAccount string Information about the account that is initiating the event.
SubjectDomainName string Information about the domain or workgroup to which the subject account belongs.
SubjectKeyIdentifier string A unique identifier for a particular certificate subject.
SubjectLogonId string A unique identifier for the logon session associated with the subject account.
SubjectMachineName string Information about the machine or system from which the event was created.
SubjectMachineSID string The security identifier (SID) for the machine that generated the event.
SubjectUserName string The name of the user account that generated the event.
SubjectUserSid string The security identifier (SID) for the user account that generated the event.
_SubscriptionId string A unique identifier for the subscription that the record is associated with
SubStatus string Additional information about logon failure. The most common substatus codes listed in the 'Table 12. Windows logon status codes'.
TableId string The specific data table identifier the event data is stored in.
TargetAccount string The account targeted by the event (user name, computer name, etc).
TargetDomainName string The name of the domain that the target account belongs to.
TargetInfo string Additional information about the event target (for example: the path to a file or folder, the name of a registry key, etc).
TargetLinkedLogonId string Information that helps to link related events together by their logon attempt IDs. It can be useful in keeping all relevant events organized, tracking activity across multiple sessions, and identifying the attack source.
TargetLogonGuid string A globally unique identifier (GUID) associated with the logon session related to the event.
TargetLogonId string A unique identifier associated with the logon session related to the event.
TargetOutboundDomainName string The domain that the account specified in the TargetAccount field was authenticated against during an outbound authentication attempt.
TargetOutboundUserName string The name of the user account that was authenticated during an outbound authentication attempt.
TargetServerName string The name of the server on which the new process was run. Has “localhost” value if the process was run locally.
TargetSid string The security identifier (SID) of the server on which the new process was run.
TargetUser string The user account identifier that generated the new process.
TargetUserName string The name of the user account that generated the new process.
TargetUserSid string The security identifier (SID) associated with the user or resource involved in the event.
Task int The task defined in the event.
TemplateContent string The content of the event message or notification in a structured form.
TemplateDSObjectFQDN string FQDN of the DS object that represents the GPO template.
TemplateInternalName string The internal name of the GPO template.
TemplateOID string the unique identifier for the template that was used to create the event.
TemplateSchemaVersion string Version of the template schema that defines the data to include with an event.
TemplateVersion string Version of the template that defines the data to include with an event.
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The time stamp when the event was generated on the computer.
TokenElevationType string Type of token that was assigned to a new process in accordance with User Account Control Policy.
TransmittedServices string The list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see https://msdn.microsoft.com/library/cc246072.aspx.
Type string The name of the table
UserAccountControl string Shows the list of changes in userAccountControl attribute. You will see a line of text for each change.
UserParameters string If you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see <value changed, but not displayed> in this field. For local accounts, this field is not applicable and always has <value not set> value.
UserPrincipalName string Internet-style login name for the account, based on the Internet standard RFC 822. By convention this should map to the account's email name.
UserWorkstations string Contains the list of NetBIOS or DNS names of the computers from which the user can logon. Each computer name is separated by a comma. The name of a computer is the sAMAccountName property of a computer object.
VendorIds string 'Hardware Ids' attribute of device. To see device properties, start Device Manager, open specific device properties, and click 'Details'.
VirtualAccount string A 'Yes' or 'No' flag, which indicates if the account is a virtual account (e.g., 'Managed Service Account'), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using 'NetworkService'.
Workstation string The name of the machine that was used to perform the event.
WorkstationName string Machine name from which a logon attempt was performed.