| AAD Graph Logs |
AADGraphActivityLogs |
| Analysis Services |
AzureMetrics |
| API Management services |
APIMDevPortalAuditDiagnosticLog
ApiManagementGatewayLlmLog
ApiManagementGatewayLogs
ApiManagementGatewayMCPLog
ApiManagementWebSocketConnectionLogs
AzureMetrics |
| App Services |
AzureMetrics |
| Application Gateway for Containers |
AGCAccessLogs
AGCFirewallLogs
AzureMetrics |
| Application Gateways |
AGWAccessLogs
AGWFirewallLogs
AGWPerformanceLogs
AzureMetrics |
| Application Insights |
AppTraces |
| AppLinks |
MeshControlPlane |
| Automation account |
AzureMetrics |
| AVS Private Cloud |
AVSEsxiFirewallSyslog
AVSEsxiSyslog
AVSNsxEdgeSyslog
AVSNsxManagerSyslog
AVSSyslog
AVSVcSyslog |
| Azure AD Domain Services |
AADDomainServicesDNSAuditsDynamicUpdates
AADDomainServicesDNSAuditsGeneral
AzureMetrics |
| Azure API for FHIR |
AzureMetrics |
| Azure Arc Enabled Kubernetes |
ArcK8sAudit
ArcK8sAuditAdmin
ArcK8sControlPlane
AzureMetrics
ContainerLogV2
Perf |
| Azure Arc Provisioned Clusters |
AzureMetrics
ContainerLogV2
Perf |
| Azure Blockchain Service |
AzureMetrics |
| Azure Cache for Redis |
ACRConnectedClientList
ACREntraAuthenticationAuditLog
AzureMetrics |
| Azure Cache for Redis Enterprise |
REDConnectionEvents |
| Azure CloudHsm |
AzureMetrics
CloudHsmHardwareOperationAuditLogs
CloudHsmServiceOperationAuditLogs |
| Azure confidential ledger |
ACLTransactionLogs
ACLUserDefinedLogs
LedgerTransactionLogs
LedgerUserDefinedLogs |
| Azure Cosmos DB |
AzureMetrics
CDBCassandraRequests
CDBControlPlaneRequests
CDBDataPlaneRequests
CDBDataPlaneRequests15M
CDBDataPlaneRequests5M
CDBGremlinRequests
CDBMongoRequests
CDBPartitionKeyRUConsumption
CDBPartitionKeyStatistics
CDBQueryRuntimeStatistics
CDBTableApiRequests |
| Azure Cosmos DB for MongoDB (vCore) |
AzureMetrics
VCoreMongoRequests |
| Azure Data Explorer Clusters |
AzureMetrics |
| Azure Data Manager for Energy |
OEPDataplaneLogs |
| Azure Data Transfer |
DataTransferOperations |
| Azure Database for MariaDB Servers |
AzureMetrics |
| Azure Database for MySQL Flexible Servers |
AzureMetrics
MySqlAuditLogs
MySqlSlowLogs |
| Azure Database for MySQL Servers |
AzureMetrics |
| Azure Database for PostgreSQL Flexible Servers |
AzureMetrics
PGSQLAutovacuumStats
PGSQLDbTransactionsStats
PGSQLPgStatActivitySessions
PGSQLQueryStoreQueryText
PGSQLQueryStoreRuntime
PGSQLQueryStoreWaits
PGSQLServerLogs |
| Azure Database for PostgreSQL Servers |
AzureMetrics |
| Azure Database for PostgreSQL Servers V2 |
AzureMetrics |
| Azure Databricks Services |
AzureMetrics
DatabricksAccounts
DatabricksApps
DatabricksBrickStoreHttpGateway
DatabricksBudgetPolicyCentral
DatabricksCapsule8Dataplane
DatabricksClamAVScan
DatabricksCloudStorageMetadata
DatabricksClusterLibraries
DatabricksClusterPolicies
DatabricksClusters
DatabricksDBFS
DatabricksDashboards
DatabricksDataMonitoring
DatabricksDataRooms
DatabricksDatabricksSQL
DatabricksDeltaPipelines
DatabricksFeatureStore
DatabricksFiles
DatabricksFilesystem
DatabricksGenie
DatabricksGitCredentials
DatabricksGlobalInitScripts
DatabricksGroups
DatabricksIAMRole
DatabricksIngestion
DatabricksInstancePools
DatabricksJobs
DatabricksLakeviewConfig
DatabricksLineageTracking
DatabricksMLflowAcledArtifact
DatabricksMLflowExperiment
DatabricksMarketplaceConsumer
DatabricksMarketplaceProvider
DatabricksModelRegistry
DatabricksNotebook
DatabricksOnlineTables
DatabricksPartnerHub
DatabricksPredictiveOptimization
DatabricksRBAC
DatabricksRFA
DatabricksRemoteHistoryService
DatabricksRepos
DatabricksSQL
DatabricksSQLPermissions
DatabricksSSH
DatabricksSecrets
DatabricksServerlessRealTimeInference
DatabricksUnityCatalog
DatabricksVectorSearch
DatabricksWebTerminal
DatabricksWebhookNotifications
DatabricksWorkspace
DatabricksWorkspaceFiles |
| Azure Health Data Services de-identification service |
AHDSDeidAuditLogs |
| Azure Local |
AzureMetrics
CommonSecurityLog
Perf
SecurityEvent |
| Azure Local |
Perf |
| Azure Managed CCF |
CCFApplicationLogs |
| Azure Managed Lustre |
AFSAuditLogs
AzureMetrics |
| Azure Migrate Data Replication |
ASRv2HealthEvents
ASRv2JobEvents
ASRv2ProtectedItems
ASRv2ReplicationExtensions
ASRv2ReplicationPolicies
ASRv2ReplicationVaults |
| Azure Monitor autoscale settings |
AzureMetrics |
| Azure Monitor Dashboard with Grafana |
AGSUpdateEvents |
| Azure Monitor Diagnostics Agents |
DataSetOutput
DataSetRuns
PerfInsightsFindings
PerfInsightsImpactedResources
PerfInsightsRun |
| Azure Monitor pipeline |
AzureMonitorPipelineLogErrors |
| Azure Monitor Workspace |
AMWMetricsUsageDetails |
| Azure Operator Insights - Data Product |
AOIDatabaseQuery
AOIDigestion
AOIStorage
AzureMetrics |
| Azure Quantum Provider Accounts |
QuantumProviderAccountJobAuditLogs
QuantumProviderAccountQueueAuditLogs
QuantumProviderAccountTargetAuditLogs |
| Azure Quantum Workspaces |
QuantumWorkspaceJobAuditLogs |
| Azure Sentinel |
SecurityEvent
DnsAuditEvents
AggregatedSecurityAlert
SentinelBehaviorInfo
SentinelBehaviorEntities |
| Azure Sentinel CEF Table |
CommonSecurityLog |
| Azure Sentinel Web Session Logs |
ASimWebSessionLogs |
| Azure Sphere |
ASCAuditLogs
ASCDeviceEvents |
| Azure Spring Apps |
AzureMetrics |
| Azure Storage Mover |
AzureMetrics
StorageMoverAuditLogs
StorageMoverCopyLogsFailed
StorageMoverCopyLogsTransferred
StorageMoverJobRunLogs |
| Azure Traffic Collector |
AzureMetrics |
| Azure virtual machine extensions |
AMAHealth |
| Azure Virtual Network Manager |
AVNMConnectivityConfigurationChange
AVNMIPAMPoolAllocationChange
AVNMNetworkGroupMembershipChange
AVNMRuleCollectionChange
AzureMetrics |
| Bastions |
AzureMetrics |
| Batch Accounts |
AzureMetrics |
| Chaos Experiment |
ChaosStudioExperimentEventLogs |
| Cognitive Services |
AzureMetrics |
| Communication Services |
ACSAdvancedMessagingOperations
ACSCallAutomationIncomingOperations
ACSCallAutomationMediaSummary
ACSCallAutomationStreamingUsage
ACSCallClientMediaStatsTimeSeries
ACSCallClientOperations
ACSCallClientServiceRequestAndOutcome
ACSCallClosedCaptionsSummary
ACSCallDiagnostics
ACSCallDiagnosticsUpdates
ACSCallRecordingIncomingOperations
ACSCallRecordingSummary
ACSCallSummary
ACSCallSummaryUpdates
ACSCallingMetrics
ACSJobRouterIncomingOperations
ACSOptOutManagementOperations
ACSRoomsIncomingOperations
ACSSMSIncomingOperations
AzureMetrics |
| Container Apps |
AppEnvSessionConsoleLogs
AppEnvSessionLifecycleLogs
AppEnvSessionPoolEventLogs
AppEnvSpringAppConsoleLogs
ContainerAppConsoleLogs
ContainerAppHTTPLogs |
| Container Registries |
AzureMetrics |
| Data factories |
AzureMetrics |
| Data Lake Analytics |
AzureMetrics |
| Data Lake Storage Gen1 |
AzureMetrics |
| Data Share |
AzureMetrics |
| Defender for Storage Settings |
StorageMalwareScanningResults |
| Desktop Virtualization Application Groups |
AzureMetrics |
| Desktop Virtualization Host Pools |
AzureMetrics |
| Desktop Virtualization workspaces |
AzureMetrics |
| Dev Centers |
AzureMetrics
DevCenterAgentHealthLogs
DevCenterBillingEventLogs
DevCenterConnectionLogs
DevCenterDiagnosticLogs
DevCenterResourceOperationLogs |
| Device Provisioning Services |
AzureMetrics |
| DNS Resolver Policies |
DNSQueryLogs |
| Durable Task Schedulers |
DurableTaskSchedulerLogs |
| Edge Actions |
EdgeActionConsoleLog
EdgeActionServiceLog |
| Event Grid Domains |
AzureMetrics |
| Event Grid Namespaces |
AzureMetrics
EGNFailedHttpDataPlaneOperations
EGNSuccessfulHttpDataPlaneOperations |
| Event Grid Partner Namespaces |
AzureMetrics |
| Event Grid Partner Topics |
AzureMetrics |
| Event Grid System Topics |
AzureMetrics |
| Event Grid Topics |
AzureMetrics |
| Event Hubs |
AZMSApplicationMetricLogs
AZMSArchiveLogs
AZMSAutoscaleLogs
AZMSCustomerManagedKeyUserLogs
AZMSDiagnosticErrorLogs
AZMSKafkaCoordinatorLogs
AZMSKafkaUserErrorLogs
AZMSOperationalLogs
AZMSRunTimeAuditLogs
AZMSVnetConnectionEvents
AzureMetrics |
| Experiment Workspace |
AEWExperimentAssignmentSummary
AEWExperimentScorecardMetricPairs
AEWExperimentScorecards |
| ExpressRoute Circuits |
AzureMetrics |
| Firewalls |
AZFWApplicationRule
AZFWApplicationRuleAggregation
AZFWDnsFlowTrace
AZFWDnsQuery
AZFWFatFlow
AZFWFlowTrace
AZFWIdpsSignature
AZFWInternalFqdnResolutionFailure
AZFWNatRule
AZFWNatRuleAggregation
AZFWNetworkRule
AZFWNetworkRuleAggregation
AZFWThreatIntel
AzureMetrics |
| Front Doors |
AzureMetrics |
| Health Data Services |
AHDSDicomAuditLogs
AHDSDicomDiagnosticLogs
AHDSMedTechDiagnosticLogs |
| HealthCare Interoperability Service |
AHCIDiagnosticLogs |
| Integration Account. |
LIATrackingEvents |
| Intune Specialist Reports. |
Windows365AuditLogs |
| IoT Hub |
AzureMetrics |
| Key Vaults |
AZKVAuditLogs
AZKVPolicyEvaluationDetailsLogs
AzureMetrics |
| Kubernetes Services |
AKSAudit
AKSAuditAdmin
AKSControlPlane
AzureMetrics
ContainerLogV2
ContainerNetworkLogs
Perf
RetinaNetworkFlowLogs |
| Load Balancers |
ALBHealthEvent
AzureMetrics |
| Log Analytics workspaces |
AppGenAIContent
AzureMetrics
AzureMetricsV2
LAJobLogs
LAQueryLogs
LASummaryLogs
OTelEvents
OTelLogs
OTelSpans
OTelTraces
OTelTracesAgent
Perf |
| Logic Apps |
AzureMetrics |
| Machine Learning |
AzureMetrics |
| Managed DevOps Pools |
MDPResourceLog |
| Media Services |
AMSKeyDeliveryRequests
AMSLiveEventOperations
AMSMediaAccountHealth
AMSStreamingEndpointRequests
AzureMetrics |
| Microsoft Connected Cache |
AzureMetrics |
| Microsoft Connected Vehicle Platform |
AzureMetrics |
| Microsoft Defender for Cloud |
SecurityAttackPathData |
| Microsoft Discovery Bookshelves |
DiscoveryBookshelfAuditLogs |
| Microsoft Discovery Supercomputers |
DiscoverySupercomputerAuditLogs |
| Microsoft Discovery Workspaces |
DiscoveryWorkspaceAuditLogs |
| Microsoft Graph Logs |
SigninLogs |
| Microsoft Planetary Computer Pro |
MPCAuditLogs
MPCIngestionLogs |
| Microsoft Playwright Testing |
AzureMetrics |
| Microsoft Sentinel Agent Event ASim schema |
ASimAgentEventLogs |
| Microsoft Sentinel Alert Event ASim schema |
ASimAlertEventLogs |
| Microsoft Sentinel ASim |
ASimDhcpEventLogs
ASimFileEventLogs
ASimUserManagementActivityLogs
ASimRegistryEventLogs |
| Microsoft Sentinel Asset Entity ASim schema |
ASimAssetEntityLogs |
| Microsoft Sentinel Audit Event ASim schema |
ASimAuditEventLogs |
| Microsoft Sentinel Authentication Event ASIM schema |
ASimAuthenticationEventLogs |
| Microsoft Sentinel DNS activity ASim schema |
ASimDnsActivityLogs |
| Microsoft Sentinel Network Session ASim schema |
ASimNetworkSessionLogs |
| Microsoft Sentinel Process Event ASim schema |
ASimProcessEventLogs |
| Microsoft Sentinel Threat Intelligence. |
ThreatIntelObjects
ThreatIntelIndicators |
| Microsoft.StandbyPool |
SCGPoolExecutionLog
SCGPoolRequestLog |
| Microsoft.StandbyPool |
SVMPoolExecutionLog
SVMPoolRequestLog |
| Network Devices (Operator Nexus) |
AzureMetrics
MNFDeviceUpdates
MNFSystemSessionHistoryUpdates
MNFSystemStateMessageUpdates |
| Network Interfaces |
AzureMetrics |
| Network Security Groups |
AzureMetrics |
| Network Security Perimeters |
NSPAccessLogs |
| Network Virtual Appliance |
AzureMetrics |
| Nexus BareMetal Machines |
AzureMetrics
NCBMBreakGlassAuditLogs
NCBMSecurityDefenderLogs
NCBMSecurityLogs
NCBMSystemLogs |
| Nexus Cluster Managers |
AzureMetrics
NCMClusterOperationsLogs |
| Nexus Clusters |
AzureMetrics
NCCIDRACLogs
NCCKubernetesAPIAuditLogs
NCCKubernetesLogs
NCCPlatformOperationsLogs
NCCVMOrchestrationLogs |
| Nexus Storage Appliances |
AzureMetrics
NCSStorageAlerts
NCSStorageAudits
NCSStorageLogs |
| NGINXaaS |
NGXOperationLogs
NGXSecurityLogs
NginxUpstreamUpdateLogs |
| Online Experiment Workspace |
OEWAuditLogs |
| Oracle Cloud |
OracleCloudDatabase |
| Power BI Datasets |
PowerBIDatasetsTenant |
| Power BI Datasets |
PowerBIDatasetsWorkspace |
| Power BI Embedded |
AzureMetrics |
| Project CI Workspace |
AzureMetrics |
| Public IP Addresses |
AzureMetrics |
| Relay |
AZMSHybridConnectionsEvents
AZMSVnetConnectionEvents
AzureMetrics |
| Search Services |
AzureMetrics |
| Service Bus |
AZMSApplicationMetricLogs
AZMSDiagnosticErrorLogs
AZMSOperationalLogs
AZMSRunTimeAuditLogs
AZMSVnetConnectionEvents
AzureMetrics |
| Service Fabric Clusters |
AzureMetrics |
| SignalR |
AzureMetrics |
| SQL Databases |
AzureMetrics |
| SQL Managed Instances |
AzureMetrics |
| SQL Servers |
AzureMetrics |
| Storage Accounts |
AzureMetrics
StorageBlobLogs
StorageFileLogs
StorageQueueLogs
StorageTableLogs |
| Stream Analytics jobs |
AzureMetrics |
| Synapse Workspaces |
AzureMetrics
SynapseSqlPoolDmsWorkers
SynapseSqlPoolExecRequests
SynapseSqlPoolRequestSteps
SynapseSqlPoolSqlRequests
SynapseSqlPoolWaits |
| System Center Virtual Machine Manager |
AzureMetrics
CommonSecurityLog
Perf
SecurityEvent |
| Time Series Insights Environments |
AzureMetrics |
| Toolchain orchestrator |
TOUserAudits
TOUserDiagnostics |
| Traffic Manager Profiles |
AzureMetrics |
| Virtual Machine Scale Sets |
AzureMetrics
CommonSecurityLog
DataSetOutput
DataSetRuns
Perf
PerfInsightsFindings
PerfInsightsImpactedResources
PerfInsightsRun
SecurityEvent |
| Virtual machines |
AzureMetrics
CommonSecurityLog
DataSetOutput
DataSetRuns
Perf
PerfInsightsFindings
PerfInsightsImpactedResources
PerfInsightsRun
SecurityEvent |
| Virtual Network Gateways |
AzureMetrics |
| Virtual Networks |
AzureMetrics |
| Virtual Private Network Gateways |
AzureMetrics |
| VMware |
AzureMetrics
CommonSecurityLog
Perf
SecurityEvent |
| Workload Monitor |
AzureMetrics |
| workload orchestration |
WOUserAudits
WOUserDiagnostics |
| Zero Trust Segmentation |
ZTSGraph
ZTSJobStatus
ZTSMetadata
ZTSRequest |
| No service defined |
AADAgentRiskEvents
AADManagedIdentitySignInLogs
AADNonInteractiveUserSignInLogs
AADProvisioningLogs
AADRiskyAgents
AADRiskyServicePrincipals
AADRiskyUsers
AADServicePrincipalRiskEvents
AADServicePrincipalSignInLogs
AADUserRiskEvents
ABAPAuditLog
ABAPAuthorizationDetails
ABAPChangeDocsLog
ABAPTableDataLog
ABAPUserDetails
ADFSSignInLogs
AWSALBAccessLogs
AWSCloudTrail
AWSCloudWatch
AWSEKSLogs
AWSELBFlowLogs
AWSGuardDuty
AWSNLBAccessLogs
AWSNetworkFirewallAlert
AWSNetworkFirewallFlow
AWSNetworkFirewallTls
AWSRoute53Resolver
AWSS3ServerAccess
AWSSecurityHubFindings
AWSVPCFlow
AWSWAF
AgentsInfo
AlertEvidence
AlertInfo
Anomalies
AzureDevOpsAuditing
BehaviorEntities
BehaviorInfo
CampaignInfo
CloudAppEvents
CloudAuditEvents
CloudDnsEvents
CloudProcessEvents
CloudStorageAggregatedEvents
CommunicationComplianceActivity
CopilotActivity
CrowdStrikeAlerts
CrowdStrikeAuditEvents
CrowdStrikeCases
CrowdStrikeDetections
CrowdStrikeHosts
CrowdStrikeIncidents
CrowdStrikeVulnerabilities
DataverseActivity
DeviceBehaviorEntities
DeviceBehaviorInfo
DeviceCustomFileEvents
DeviceCustomImageLoadEvents
DeviceCustomNetworkEvents
DeviceCustomProcessEvents
DeviceCustomRegistryEvents
DeviceCustomScriptEvents
DeviceEvents
DeviceFileCertificateInfo
DeviceFileEvents
DeviceImageLoadEvents
DeviceInfo
DeviceLogonEvents
DeviceNetworkEvents
DeviceNetworkInfo
DeviceProcessEvents
DeviceRegistryEvents
DeviceTvmSecureConfigurationAssessment
DeviceTvmSecureConfigurationAssessmentKB
DeviceTvmSoftwareInventory
DeviceTvmSoftwareVulnerabilities
DeviceTvmSoftwareVulnerabilitiesKB
DisruptionAndResponseEvents
DynamicEventCollection
EmailAttachmentInfo
EmailEvents
EmailPostDeliveryEvents
EmailUrlInfo
EnrichedMicrosoft365AuditLogs
FileMaliciousContentInfo
GCPApigee
GCPAuditLogs
GCPCDN
GCPCloudRun
GCPCloudSQL
GCPComputeEngine
GCPDNS
GCPFirewallLogs
GCPIAM
GCPIDS
GCPLoadBalancer
GCPMonitoring
GCPNAT
GCPNATAudit
GCPResourceManager
GCPVPCFlow
GKEAPIServer
GKEApplication
GKEAudit
GKEControllerManager
GKEHPADecision
GKEScheduler
GoogleCloudSCC
GoogleWorkspaceReports
IdentityAccountInfo
IdentityDirectoryEvents
IdentityEvents
IdentityLogonEvents
IdentityQueryEvents
IlumioInsights
IntuneDevices
MDCDetectionDNSEvents
MDCDetectionFimEvents
MDCDetectionGatingValidationEvents
MDCDetectionK8SApiEvents
MDCDetectionProcessV2Events
MDCFileIntegrityMonitoringEvents
MessageEvents
MessagePostDeliveryEvents
MessageUrlInfo
MicrosoftGraphActivityLogs
MicrosoftGraphPolicyLogs
MicrosoftPurviewInformationProtection
MicrosoftServicePrincipalSignInLogs
NetworkAccessAlerts
NetworkAccessConnectionEvents
NetworkAccessGenerativeAIInsights
NetworkAccessTraffic
NetworkSessions
OAuthAppInfo
OktaSystemLogs
PowerAppsActivity
PowerAutomateActivity
PowerBIActivity
PowerPlatformAdminActivity
PowerPlatformConnectorActivity
PowerPlatformDlpActivity
PreAuthenticationDiscoveryLogs
ProjectActivity
QualysKnowledgeBase
Rapid7InsightVMCloudAssets
Rapid7InsightVMCloudVulnerabilities
RemoteNetworkHealthLogs
SalesforceAuditTrail
SalesforceLoginHistory
SecurityCaseEvent
SentinelAlibabaCloudAPIGatewayLogs
SentinelAlibabaCloudVPCFlowLogs
SentinelAlibabaCloudWAFLogs
SentinelImpervaWAFCloudV2Logs
UrlClickEvents |