46-50

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
id	`str`
azureTenantId	`str`
actionType	`str`
actionUrl	`str`
controlCategory	`str`
title	`str`
deprecated	`bool`
implementationCost	`str`
lastModifiedDateTime	`str`
maxScore	`float8`
rank	`int4`
remediation	`str`
remediationImpact	`str`
service	`str`
threats	`str`
tier	`str`
userImpact	`str`
vendorInformation__provider	`str`
vendorInformation__providerVersion	`str`
vendorInformation__subProvider	`str`
vendorInformation__vendor	`str`
complianceInformation	`str`
controlStateUpdates	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
id	`str`
azureTenantId	`str`
activeUserCount	`int4`
createdDateTime	`timestamp`
currentScore	`float8`
enabledServices	`str`
licensedUserCount	`int4`
maxScore	`float8`
vendorInformation__provider	`str`
vendorInformation__providerVersion	`str`
vendorInformation__subProvider	`str`
vendorInformation__vendor	`str`
averageComparativeScores	`str`
controlScores	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

51-55

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
CreationTime	`timestamp`
Id	`str`
Operation	`str`
OrganizationId	`str`
RecordType	`int4`
UserKey	`str`
UserType	`int4`
Version	`int4`
Workload	`str`
UserId	`str`
AadAppId	`str`
DataType	`str`
DatabaseType	`str`
RelativeUrl	`str`
ResultCount	`str`
ResultStatus	`str`
ObjectId	`str`
AlertId	`str`
AlertLinks	`str`
AlertType	`str`
Category	`str`
Comments	`str`
Data	`str`
Name	`str`
PolicyId	`str`
Severity	`str`
Source	`str`
Status	`str`
SecurityComplianceCenterEventType	`int4`
ClientApplication	`str`
CmdletVersion	`str`
EffectiveOrganization	`str`
NonPIIParameters	`str`
Parameters	`str`
StartTime	`timestamp`
UserServicePlan	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
CreationTime	`timestamp`
Id	`str`
Operation	`str`
OrganizationId	`str`
RecordType	`int4`
UserKey	`str`
UserType	`int4`
Version	`int4`
Workload	`str`
ClientIP	`ip4`
ObjectId	`str`
UserId	`str`
CorrelationId	`str`
EventSource	`str`
ItemType	`str`
ListId	`str`
ListItemUniqueId	`str`
Site	`str`
UserAgent	`str`
WebId	`str`
EventData	`str`
TargetUserOrGroupType	`str`
UniqueSharingId	`str`
SiteUrl	`str`
SourceRelativeUrl	`str`
TargetUserOrGroupName	`str`
ApplicationId	`str`
SourceFileExtension	`str`
SourceFileName	`str`
HighPriorityMediaProcessing	`bool`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓