Content Comparison

cloud.azure

Data from Event Hubs, VM Metrics, Entra ID, and other sources.

cloud.azure.service.type

For most Azure services, there is a separate table for each type of log associated with that service.

cloud.azure.ad.*

Entra ID identity and access management logs.

cloud.azure.ad.signin_all

This union table combines all the different Entra ID authentication logs.

auth.all

Authentication logs, including Entra ID and Azure SQL authentication.

web.all.access

Web activity, including Azure Application Gateway.

firewall.all.traffic

Firewall activity, including Azure Firewall

network.dns

DNS activity, including Azure Firewall DNS Proxy.