Edit

AADAgentRiskEvents

Logs generated by identity protection for Azure AD agent risk events.

Table attributes

Attribute Value
Resource types -
Categories -
Solutions LogManagement
Basic log Yes
Ingestion-time DCR support No
Lake-only ingestion Yes
Sample Queries -

Columns

Column Type Description
ActivityDateTime datetime Date and time when the risky activity occurred in UTC.
AdditionalInfo string Additional information associated with the agent risk event.
AgentDisplayName string Human-readable name of the agent.
AgentId string Identifier of the agent associated with this risk detection.
_BilledSize real The record size in bytes
CorrelationId string The ID for correlated log analytics events. Can be used to identify correlated events between multiple tables.
DetectedDateTime datetime Date and time when the risk was detected in UTC.
DetectionTimingType string Timing of the detected risk. Possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.
Id string Unique identifier for the risk detection event.
IdentityType string Type of identity associated with this detection. Possible values are: AgentIdentity, AgentUser, AgentIdentityBlueprintPrincipal.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
LastModifiedDateTime datetime Date and time when the risk detection was last modified in UTC.
OperationName string Name of the operation.
RiskDetail string Details of the detected risk. Possible values are: none, adminConfirmedAgentCompromised, adminConfirmedAgentSafe, unknownFutureValue.
RiskEventType string Type of the risk event, based on the detection algorithm.
RiskEvidence string A short explanation or information about the risk.
RiskLevel string Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
RiskState string State of the detected risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The date and time of the event in UTC.
Type string The name of the table