Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Logs generated by identity protection for Azure AD risky agents.
Table attributes
| Attribute | Value |
|---|---|
| Resource types | - |
| Categories | - |
| Solutions | LogManagement |
| Basic log | Yes |
| Ingestion-time DCR support | No |
| Lake-only ingestion | Yes |
| Sample Queries | - |
Columns
| Column | Type | Description |
|---|---|---|
| AgentDisplayName | string | Human-readable name of the agent. |
| _BilledSize | real | The record size in bytes |
| CorrelationId | string | The ID for correlated log analytics events. Can be used to identify correlated events between multiple tables. |
| Id | string | Unique identifier of the agent at risk. |
| IdentityType | string | Type of identity associated with this agent. Possible values are: AgentIdentity, AgentUser, AgentIdentityBlueprintPrincipal. |
| _IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
| IsDeleted | bool | Indicates whether the agent has been deleted. |
| IsEnabled | bool | Indicates whether the agent is enabled. |
| IsProcessing | bool | Indicates whether the agent's risky state is being processed by the backend. |
| OperationName | string | Name of the operation. |
| RiskDetail | string | Details of the detected risk. Possible values are: none, adminConfirmedAgentCompromised, adminConfirmedAgentSafe, unknownFutureValue. |
| RiskLastModifiedDateTime | datetime | Date and time when the risky agent was last modified in UTC. |
| RiskLevel | string | Level of the detected risky agent. Possible values are: low, medium, high, hidden, none, unknownFutureValue. |
| RiskState | string | State of the agent's risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue. |
| SourceSystem | string | The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics |
| TenantId | string | The Log Analytics workspace ID |
| TimeGenerated | datetime | The date and time of the event in UTC. |
| Type | string | The name of the table |