Azure Monitor Logs table reference organized by solution
AADDomainServices
ADAssessment
ADAssessmentPlus
ADReplication
ADSecurityAssessment
AlertManagement
AntiMalware
ApplicationInsights
AzureAssessment
AzureSecurityOfThings
AzureSentinelDSRE
AzureSentinelPrivatePreview
BehaviorAnalyticsInsights
ChangeTracking
CompatibilityAssessment
- UADriver
- UAApp
- UAComputer
- UASysReqIssue
- UAUpgradedComputer
- UAIESiteDiscovery
- UAOfficeAddIn
- UAProposedActionPlan
- UAComputerRank
- UAFeedback
- UADriverProblemCodes
- UAHardwareSecurity
ContainerInsights
- ContainerImageInventory
- ContainerServiceLog
- ContainerLog
- ContainerInventory
- KubeNodeInventory
- KubePodInventory
- KubeEvents
- KubeServices
- ContainerNodeInventory
- InsightsMetrics
- KubeHealth
- KubeMonAgentEvents
- KubePVInventory
Containers
CustomizedWindowsEventsFiltering
Deprecated
DeviceHealthProd
- DHDriverReliability
- DHOSCrashData
- DHOSReliability
- DHWipAppLearning
- DHLogonFailures
- DHLogonMetrics
- DHAppReliability
- DHAppFailure
DnsAnalytics
ExchangeAssessment
ExchangeOnlineAssessment
IISAssessmentPlus
InfrastructureInsights
InternalWindowsEvent
LogManagement
- Event
- Usage
- Perf
- W3CIISLog
- Alert
- ETWEvent
- ServiceFabricReliableServiceEvent
- ServiceFabricOperationalEvent
- Syslog
- ServiceFabricReliableActorEvent
- ComputerGroup
- Operation
- AzureActivity
- Heartbeat
- AzureMetrics
- SigninLogs
- AuditLogs
- AppCenterError
- IntuneAuditLogs
- IntuneOperationalLogs
- AutoscaleEvaluationsLog
- AutoscaleScaleActionsLog
- DatabricksWorkspace
- DatabricksAccounts
- DatabricksClusters
- DatabricksNotebook
- DatabricksSSH
- DatabricksDBFS
- DatabricksJobs
- DatabricksSQLPermissions
- DatabricksTables
- DatabricksSecrets
- AADDomainServicesAccountLogon
- BlockchainApplicationLog
- BlockchainProxyLog
- ADFActivityRun
- ADFPipelineRun
- ADFTriggerRun
- AADDomainServicesAccountManagement
- AADDomainServicesDirectoryServiceAccess
- AADDomainServicesPolicyChange
- AADDomainServicesPrivilegeUse
- AADDomainServicesSystemSecurity
- ApiManagementGatewayLogs
- AddonAzureBackupAlerts
- AddonAzureBackupJobs
- AddonAzureBackupPolicy
- AddonAzureBackupProtectedInstance
- AddonAzureBackupStorage
- CoreAzureBackup
- ContainerRegistryRepositoryEvents
- ContainerRegistryLoginEvents
- BaiJobEvent
- AppPlatformLogsforSpring
- AmlComputeJobEvent
- AmlComputeClusterNodeEvent
- BaiClusterEvent
- AmlComputeClusterEvent
- BaiClusterNodeEvent
- DatabricksInstancePools
- MicrosoftHealthcareApisAuditLogs
- AppServiceEnvironmentPlatformLogs
- FailedIngestion
- SucceededIngestion
- MicrosoftDataShareShareLog
- MicrosoftDynamicsTelemetrySystemMetricsLogs
- MicrosoftDynamicsTelemetryPerformanceLogs
- MicrosoftDataShareSentSnapshotLog
- AppServiceConsoleLogs
- AppServiceAppLogs
- IntuneDeviceComplianceOrg
- StorageFileLogs
- StorageQueueLogs
- StorageTableLogs
- StorageBlobLogs
- AppServiceAuditLogs
- AppServiceHTTPLogs
- MicrosoftAzureBastionAuditLogs
- FunctionAppLogs
- AppPlatformSystemLogs
- MicrosoftDataShareReceivedSnapshotLog
- SignalRServiceDiagnosticLogs
- AegDeliveryFailureLogs
- AegPublishFailureLogs
- AppServiceFileAuditLogs
- IoTHubDistributedTracing
- requests
- dependencies
- AppAvailabilityResults
- AppBrowserTimings
- AppDependencies
- AppEvents
- AppMetrics
- AppPageViews
- AppPerformanceCounters
- AppRequests
- AppSystemEvents
- AppTraces
- ADFSSISIntegrationRuntimeLogs
- ADFSSISPackageEventMessages
- ADFSSISPackageEventMessageContext
- ADFSSISPackageExecutableStatistics
- ADFSSISPackageExecutionComponentPhases
- ADFSSISPackageExecutionDataStatistics
- AzureDevOpsAuditing
- AppExceptions
- WVDCheckpoints
- WVDConnections
- WVDErrors
- WVDFeeds
- WVDHostRegistrations
- WVDManagement
- AppServicePlatformLogs
- TSIIngress
- ADTEventRoutesOperation
- ADTModelsOperation
- ADTDigitalTwinsOperation
- ADTQueryOperation
- AmlComputeCpuGpuUtilization
- AmlRunStatusChangedEvent
- AADNonInteractiveUserSignInLogs
- AADServicePrincipalSignInLogs
- AADManagedIdentitySignInLogs
- AppServiceAntivirusScanLogs
- HDInsightKafkaLogs
- HDInsightKafkaMetrics
- HDInsightHBaseLogs
- HDInsightHBaseMetrics
- HDInsightStormLogs
- HDInsightStormMetrics
- HDInsightStormTopologyMetrics
- HDInsightGatewayAuditLogs
- HDInsightAmbariSystemMetrics
- HDInsightAmbariClusterAlerts
- HDInsightSparkApplicationEvents
- HDInsightSparkBlockManagerEvents
- HDInsightSparkEnvironmentEvents
- HDInsightJupyterNotebookEvents
- HDInsightSparkExecutorEvents
- HDInsightSparkExtraEvents
- HDInsightSparkJobEvents
- HDInsightSparkSQLExecutionEvents
- HDInsightSparkStageEvents
- HDInsightSparkStageTaskAccumulables
- HDInsightSparkTaskEvents
- HDInsightSparkLogs
- HDInsightSecurityLogs
- HDInsightRangerAuditLogs
- HDInsightHiveAndLLAPLogs
- HDInsightHiveAndLLAPMetrics
- HDInsightHadoopAndYarnLogs
- HDInsightHadoopAndYarnMetrics
- HDInsightOozieLogs
- LAQueryLogs
- PowerBIDatasetsTenantPreview
- PowerBIDatasetsWorkspacePreview
- ADXCommand
- ADXQuery
- AppServiceIPSecAuditLogs
- ADXTableDetails
- ADXTableUsageStatistics
- NWConnectionMonitorTestResult
- NWConnectionMonitorPathResult
- NWConnectionMonitorDNSResult
- NWConnectionMonitorDestinationListenerResult
- AppServiceAntivirusScanAuditLogs
- AADProvisioningLogs
- ADXIngestionBatching
- SynapseRBACEvents
- SynapseGatewayEvents
- ABSChannelToBotRequests
- ABSDependenciesRequests
- ACSChatIncomingOperations
- ACSSMSIncomingOperations
- ACSBillingUsage
- AEWAuditLogs
- ABSBotRequests
- WVDAgentHealthStatus
- SynapseRbacOperations
- SynapseGatewayApiRequests
- SynapseSqlPoolExecRequests
- SynapseSqlPoolRequestSteps
- SynapseSqlPoolDmsWorkers
- SynapseSqlPoolWaits
- SynapseSqlPoolSqlRequests
- SynapseIntegrationPipelineRunsEnded
- SynapseIntegrationActivityRunsEnded
- SynapseIntegrationTriggerRunsEnded
- SynapseBigDataPoolApplicationsEnded
- SynapseBuiltinSqlPoolRequestsEnded
- IntuneDevices
- AzureDiagnostics
Microsoft365Analytics
- MAWindowsCurrencyAssessmentDailyCounts
- MAWindowsDeploymentStatus
- MAProposedPilotDevices
- MAOfficeCurrencyAssessmentDailyCounts
- MAOfficeBuildInfo
- MAOfficeSuite
- MAWindowsBuildInfo
- MAApplication
- MAOfficeAddin
- MADevice
- MAApplicationReadiness
- MAOfficeApp
- MAApplicationInstance
- MADeviceReadiness
- MADriverReadiness
- MAOfficeAddinReadiness
- MAOfficeAddinInstance
- MAOfficeAppReadiness
- MADeploymentPlan
- MAOfficeAppInstance
- MAOfficeCurrencyAssessment
- MAOfficeSuiteInstance
- MAWindowsCurrencyAssessment
- MAApplicationHealth
- MAOfficeAddinHealth
- MAOfficeDeploymentStatus
- MAOfficeAppHealth
- MAOfficeMacroIssueReadiness
- MAOfficeMacroSummary
- MAApplicationInstanceReadiness
- MADriverInstanceReadiness
- MAOfficeAddinInstanceReadiness
- MAWindowsSysReqInstanceReadiness
- MAOfficeAddinHealthIssues
- MAOfficeMacroIssueInstanceReadiness
- MAApplicationHealthIssues
- MADevicePnPHealth
- MAApplicationHealthAlternativeVersions
- MADevicePnPHealthAlternativeVersions
- MADevicePnPHealthIssues
- MAOfficeMacroHealth
- MAOfficeMacroHealthIssues
- MADeviceNotEnrolled
- MAOfficeAppCrashesNRT
- MAOfficeAppSessionsNRT
- MAOfficeAppInstanceHealth
- MAOfficeMacroErrorNRT
- MAOfficeAddinHealthEventNRT
- MAOfficeAddinEntityHealth
- MAOfficeMacroGlobalHealth
- MAWindowsDeploymentStatusNRT
- MADeviceNRT
- MAOfficeDeploymentStatusNRT
NetworkMonitoring
SCCMAssessmentPlus
SCOMAssessment
SCOMAssessmentPlus
SPAssessment
SQLAssessment
SQLAssessmentPlus
SQLDataClassification
SQLQueryPerformance
SQLThreatDetection
SQLVulnerabilityAssessment
Security
- ProtectionStatus
- SecurityEvent
- WindowsFirewall
- Update
- UpdateSummary
- SecurityBaseline
- SecurityBaselineSummary
- SecurityDetection
- SysmonEvent
- LinuxAuditLog
- CommonSecurityLog
- SecurityAlert
- SecurityRecommendation
- SecurityNestedRecommendation
- SecureScoreControls
- SecureScores
- SecurityRegulatoryCompliance
SecurityCenter
- ProtectionStatus
- Update
- UpdateSummary
- SecurityBaseline
- SecurityBaselineSummary
- SecurityAlert
- SecurityNestedRecommendation
- SecureScoreControls
- SecureScores
- SecurityRegulatoryCompliance
SecurityCenterFree
- ProtectionStatus
- Update
- UpdateSummary
- SecurityBaseline
- SecurityBaselineSummary
- SecurityAlert
- SecurityRecommendation
- SecurityNestedRecommendation
- SecureScoreControls
- SecureScores
SecurityInsights
- SecurityEvent
- OfficeActivity
- LinuxAuditLog
- CommonSecurityLog
- SecurityAlert
- AWSCloudTrail
- ThreatIntelligenceIndicator
- HuntingBookmark
- McasShadowItReporting
- DHCPActivity
- SecurityIncident
- Dynamics365Activity
- Watchlist
- DeviceEvents
- DeviceFileEvents
- DeviceImageLoadEvents
- DeviceInfo
- DeviceLogonEvents
- DeviceNetworkEvents
- DeviceNetworkInfo
- DeviceProcessEvents
- DeviceRegistryEvents
- DeviceFileCertificateInfo
- Anomalies
ServiceMap
SfBAssessment
SfBOnlineAssessment
SharePointOnlineAssessment
SurfaceHub
- DeviceConnectSession
- DeviceCalendar
- DeviceEtw
- DeviceSkypeSignIn
- DeviceHeartbeat
- DeviceAppLaunch
- DeviceHardwareHealth
- DeviceCleanup
- DeviceAppCrash
- DeviceHealth
- DeviceSkypeHeartbeat
- DeviceSleepState
Updates
VMInsights
WEFInternalUat
WEF_10x
WEF_10xDSRE
WaaSUpdateInsights
- WaaSInsiderStatus
- WaaSUpdateStatus
- WaaSDeploymentStatus
- WDAVThreat
- WDAVStatus
- WUDOAggregatedStatus
- WUDOStatus