CommonSecurityLog

This table is for collecting events in the Common Event Format, that are most often sent from different security appliances such as Check Point, Palo Alto and more.

Table attributes

Attribute	Value
Resource types	microsoft.securityinsights/cef, microsoft.compute/virtualmachines, microsoft.conenctedvmwarevsphere/virtualmachines, microsoft.azurestackhci/virtualmachines, microsoft.scvmm/virtualmachines, microsoft.compute/virtualmachinescalesets
Categories	Security
Solutions	Security, SecurityInsights
Basic log	No
Ingestion-time transformation	Yes
Sample Queries	Yes

Columns

Column	Type	Description
Activity	string	A string that represents a human-readable and understandable description of the event.
AdditionalExtensions	string	A placeholder for additional fields. Fields are logged as key-value pairs.
ApplicationProtocol	string	The protocol used in the application, such as HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on.
_BilledSize	real	The record size in bytes
CollectorHostName	string	The hostname of the collector machine running the agent.
CommunicationDirection	string	Any information about the direction the observed communication has taken. Valid values: 0 = Inbound, 1 = Outbound.
Computer	string	Host, from Syslog.
DestinationDnsDomain	string	The DNS part of the fully-qualified domain name (FQDN).
DestinationHostName	string	The destination that the event refers to in an IP network. The format should be an FQDN associated with the destination node, when a node is available. For example: host.domain.com or host.
DestinationIP	string	The destination IpV4 address that the event refers to in an IP network.
DestinationMACAddress	string	The destination MAC address (FQDN).
DestinationNTDomain	string	The Windows domain name of the destination address.
DestinationPort	int	Destination port. Valid values: 0 - 65535.
DestinationProcessId	int	The ID of the destination process associated with the event.
DestinationProcessName	string	The name of the event’s destination process, such as telnetd or sshd.
DestinationServiceName	string	The service that is targeted by the event. For example: sshd.
DestinationTranslatedAddress	string	Identifies the translated destination referred to by the event in an IP network, as an IPv4 IP address.
DestinationTranslatedPort	int	Port after translation, such as a firewall Valid port numbers: 0 - 65535.
DestinationUserID	string	Identifies the destination user by ID. For example: in Unix, the root user is generally associated with the user ID 0.
DestinationUserName	string	Identifies the destination user by name.
DestinationUserPrivileges	string	Defines the destination use's privileges. Valid values: Admninistrator, User, Guest.
DeviceAction	string	The action mentioned in the event.
DeviceAddress	string	The IPv4 address of the device generating the event.
DeviceCustomDate1	string	One of two timestamp fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomDate1Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomDate2	string	One of two timestamp fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomDate2Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomFloatingPoint1	real	One of four floating point fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomFloatingPoint1Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomFloatingPoint2	real	One of four floating point fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomFloatingPoint2Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomFloatingPoint3	real	One of four floating point fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomFloatingPoint3Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomFloatingPoint4	real	One of four floating point fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomFloatingPoint4Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomIPv6Address1	string	One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomIPv6Address1Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomIPv6Address2	string	One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomIPv6Address2Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomIPv6Address3	string	One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomIPv6Address3Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomIPv6Address4	string	One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.
DeviceCustomIPv6Address4Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomNumber1	int	Soon to be a deprecated field. Will be replaced by FieldDeviceCustomNumber1.
DeviceCustomNumber1Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomNumber2	int	Soon to be a deprecated field. Will be replaced by FieldDeviceCustomNumber2.
DeviceCustomNumber2Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomNumber3	int	Soon to be a deprecated field. Will be replaced by FieldDeviceCustomNumber3.
DeviceCustomNumber3Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomString1	string	One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomString1Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomString2	string	One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomString2Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomString3	string	One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomString3Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomString4	string	One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomString4Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomString5	string	One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomString5Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceCustomString6	string	One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.
DeviceCustomString6Label	string	All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
DeviceDnsDomain	string	The DNS domain part of the full qualified domain name (FQDN).
DeviceEventCategory	string	Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. Example: '/Monitor/Disk/Read'.
DeviceEventClassID	string	String or integer that serves as a unique identifier per event type.
DeviceExternalID	string	A name that uniquely identifies the device generating the event.
DeviceFacility	string	The facility generating the event. For example: auth or local1.
DeviceInboundInterface	string	The interface on which the packet or data entered the device. For example: ethernet1/2.
DeviceMacAddress	string	The MAC address of the device generating the event.
DeviceName	string	The FQDN associated with the device node, when a node is available. For example: host.domain.com or host.
DeviceNtDomain	string	The Windows domain of the device address.
DeviceOutboundInterface	string	Interface on which the packet or data left the device.
DevicePayloadId	string	Unique identifier for the payload associated with the event.
DeviceProduct	string	String that together with device product and version definitions, uniquely identifies the type of sending device.
DeviceTimeZone	string	Timezone of the device generating the event.
DeviceTranslatedAddress	string	Identifies the translated device address that the event refers to, in an IP network. The format is an Ipv4 address.
DeviceVendor	string	String that together with device product and version definitions, uniquely identifies the type of sending device.
DeviceVersion	string	String that together with device product and version definitions, uniquely identifies the type of sending device.
EndTime	datetime	The time at which the activity related to the event ended.
EventCount	int	A count associated with the event, showing how many times the same event was observed.
EventOutcome	string	Displays the outcome, usually as ‘success’ or ‘failure’.
EventType	int	Event type. Value values include: 0: base event, 1: aggregated, 2: correlation event, 3: action event. Note: This event can be omitted for base events.
ExternalID	int	Soon to be a deprecated field. Will be replaced by ExtID.
ExtID	string	An ID used by the originating device (will replace legacy ExternalID). Typically, these values have increasing values that are each associated with an event.
FieldDeviceCustomNumber1	long	One of three number fields available to map fields that do not apply to any other in this dictionary (will replace legacy DeviceCustomNumber1). Use sparingly and seek a more specific, dictionary supplied field when possible.
FieldDeviceCustomNumber2	long	One of three number fields available to map fields that do not apply to any other in this dictionary (will replace legacy DeviceCustomNumber2). Use sparingly and seek a more specific, dictionary supplied field when possible.
FieldDeviceCustomNumber3	long	One of three number fields available to map fields that do not apply to any other in this dictionary (will replace legacy DeviceCustomNumber3). Use sparingly and seek a more specific, dictionary supplied field when possible.
FileCreateTime	string	Time when the file was created.
FileHash	string	Hash of a file.
FileID	string	An ID associated with a file, such as the inode.
FileModificationTime	string	Time when the file was last modified.
FileName	string	The file's name, without the path.
FilePath	string	Full path to the file, including the filename. For example: C:\ProgramFiles\WindowsNT\Accessories\wordpad.exe or /usr/bin/zip.
FilePermission	string	The file's permissions. For example: '2,1,1'.
FileSize	int	The size of the file in bytes.
FileType	string	File type, such as pipe, socket, and so on.
FlexDate1	string	A timestamp field available to map a timestamp that does not apply to any other defined timestamp field in this dictionary. Use all flex fields sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.
FlexDate1Label	string	The label field is a string and describes the purpose of the flex field.
FlexNumber1	int	Number fields available to map Int data that does not apply to any other field in this dictionary.
FlexNumber1Label	string	The label that describes the value in FlexNumber1
FlexNumber2	int	Number fields available to map Int data that does not apply to any other field in this dictionary.
FlexNumber2Label	string	The label that describes the value in FlexNumber2
FlexString1	string	One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.
FlexString1Label	string	The label field is a string and describes the purpose of the flex field.
FlexString2	string	One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary.
FlexString2Label	string	The label field is a string and describes the purpose of the flex field.
IndicatorThreatType	string	The threat type of the MaliciousIP according to our TI feed.
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
LogSeverity	string	A string or integer that describes the importance of the event. Valid string values: Unknown , Low, Medium, High, Very-High Valid integer values are: 0-3 = Low, 4-6 = Medium, 7-8 = High, 9-10 = Very-High.
MaliciousIP	string	If one of the IP in the message was correlate with the current TI feed we have it will show up here.
MaliciousIPCountry	string	The country of the MaliciousIP according to the GEO information at the time of the record ingestion.
MaliciousIPLatitude	real	The Latitude of the MaliciousIP according to the GEO information at the time of the record ingestion.
MaliciousIPLongitude	real	The Longitude of the MaliciousIP according to the GEO information at the time of the record ingestion.
Message	string	A message that gives more details about the event.
OldFileCreateTime	string	Time when the old file was created.
OldFileHash	string	Hash of the old file.
OldFileID	string	And ID associated with the old file, such as the inode.
OldFileModificationTime	string	Time when the old file was last modified.
OldFileName	string	Name of the old file.
OldFilePath	string	Full path to the old file, including the filename. For example: C:\ProgramFiles\WindowsNT\Accessories\wordpad.exe or /usr/bin/zip.
OldFilePermission	string	Permissions of the old file. For example: '2,1,1'.
OldFileSize	int	The size of the old file in bytes.
OldFileType	string	File type of the old file, such as a pipe, socket, and so on.
OriginalLogSeverity	string	A non-mapped version of LogSeverity. For example: Warning/Critical/Info insted of the normilized Low/Medium/High in the LogSeverity Field
ProcessID	int	Defines the ID of the process on the device generating the event.
ProcessName	string	Process name associated with the event. For example: in UNIX, the process generating the syslog entry.
Protocol	string	Transport protocol that identifies the Layer-4 protocol used. Possible values include protocol names, such as TCP or UDP.
Reason	string	The reason an audit event was generated. For example 'bad password' or 'unknown user'. This could also be an error or return code. Example: '0x1234'.
ReceiptTime	string	The time at which the event related to the activity was received. Different then the 'Timegenerated' field, which is when the event was recieved in the log collector machine.
ReceivedBytes	long	Number of bytes transferred inbound.
RemoteIP	string	The remote IP address, derived from the event's direction value, if possible.
RemotePort	string	The remote port, derived from the event's direction value, if possible.
ReportReferenceLink	string	Link to the report of the TI feed.
RequestClientApplication	string	The user agent associated with the request.
RequestContext	string	Describes the content from which the request originated, such as the HTTP Referrer.
RequestCookies	string	Cookies associated with the request.
RequestMethod	string	The method used to access a URL. Valid values include methods such as POST, GET, and so on.
RequestURL	string	The URL accessed for an HTTP request, including the protocol. For example: http://www/secure.com.
_ResourceId	string	A unique identifier for the resource that the record is associated with
SentBytes	long	Number of bytes transferred outbound.
SimplifiedDeviceAction	string	A mapped version of DeviceAction, such as Denied > Deny.
SourceDnsDomain	string	The DNS domain part of the complete FQDN.
SourceHostName	string	Identifies the source that event refers to in an IP network. Format should be a fully qualified domain name (DQDN) associated with the source node, when a node is available. For example: host or host.domain.com.
SourceIP	string	The source that an event refers to in an IP network, as an IPv4 address.
SourceMACAddress	string	Source MAC address.
SourceNTDomain	string	The Windows domain name for the source address.
SourcePort	int	The source port number. Valid port numbers are 0 - 65535.
SourceProcessId	int	The ID of the source process associated with the event.
SourceProcessName	string	The name of the event's source process.
SourceServiceName	string	The service responsible for generating the event.
SourceSystem	string	The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
SourceTranslatedAddress	string	Identifies the translated source that the event refers to in an IP network.
SourceTranslatedPort	int	Source port after translation, such as a firewall. Valid port numbers are 0 - 65535.
SourceUserID	string	Identifies the source user by ID.
SourceUserName	string	Identifies the source user by name. Email addresses are also mapped into the UserName fields. The sender is a candidate to put into this field.
SourceUserPrivileges	string	The source user's privileges. Valid values include: Administrator, User, Guest.
StartTime	datetime	The time when the activity that the event refers to started.
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
TenantId	string	The Log Analytics workspace ID
ThreatConfidence	string	The threat confidence of the MaliciousIP according to our TI feed.
ThreatDescription	string	The threat description of the MaliciousIP according to our TI feed.
ThreatSeverity	int	The threat severity of the MaliciousIP according to our TI feed at the time of the record ingestion.
TimeGenerated	datetime	Event collection time in UTC.
Type	string	The name of the table