azure activity log

Expression

product = "azure activity log"

Fields

Field	Core	Detection	Informational
tenant_id			✓
resource		✓
service_name		✓
resource_type			✓
fallback_user_name
domain_user_name
operation_first			✓
event_category			✓
src_ip		✓
operation_name			✓
result		✓
subscription_id			✓
resource_group			✓
domain			✓
resource_path			✓
correlation_id			✓
result_code			✓
operation_last			✓
resource_name			✓
authorization_scope			✓
user		✓
operation		✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
bucket-write
disk-read
disk-write	src_resource	Default			✓
	disk_state	Default			✓
	os_type	Default			✓
	dest_host	Default		✓
	disk_size	Default			✓
	resource_name	Default			✓
	region	Default			✓
	src_resource_type	Default			✓
endpoint-command
endpoint-key-write	key_name	Default			✓
endpoint-write	image_name	Default			✓
	instance_id	Default			✓
	interface_id	Default			✓
	image_publisher	Default			✓
	os_admin	Default			✓
	image_release	Default			✓
	os_type	Default			✓
	vm_size	Default			✓
	resource_name	Default			✓
	region	Default			✓
	image_version	Default			✓
	src_resource_type	Default			✓
image-write	src_resource	Default			✓
	os_type	Default			✓
	resource_name	Default			✓
	region	Default			✓
role-write	role	Default			✓
	assignble_scope	Default			✓
	allowed_data_actions	Default			✓
	role_definition	Default			✓
	description	Default			✓
	allowed_permissions	Default			✓
	denied_data_actions	Default			✓
snapshot-read
snapshot-write	src_resource	Default			✓
	os_type	Default			✓
	region	Default			✓
	src_resource_type	Default			✓
user-permission-modify	assignment_id
	role_definition_id
	principal_type
	principal_id