Azure Groups, HdInsight, Integrations, Key Vaults, and Log Tables

Tables

AzureADGroupMembers

Membership relationships between Azure AD groups and their member objects.

Name	Type	Description
ID	integer	The unique identifier for the record in the AzureADGroupMembers table.
ParentId	string	The ID of the parent group that the member belongs to.
ParentType	string	The type of the parent, such as Group, which helps identify the relationship of the member to the parent entity.
MemberId	string	The ID of the member (`user`, `service principal`, etc.) within the group.
MemberType	string	The type of the member (`user`, `service principal`, etc.).
BatchID	integer	The unique identifier for the batch in which this record was processed.
BatchDate	datetime	The date and time when the batch containing the group member data was processed.
ConfigID	integer	The unique identifier for the configuration associated with the group membership data.
CompylGroupID	integer	The ID of the compliance group associated with the member.

AzureADGroups

Azure AD group objects defined in the tenant.

Name	Type	Description
ID	integer	The unique identifier for the record in the AzureADGroups table.
GroupId	string	The unique identifier for the group in Azure AD.
DisplayName	string	The display name of the group.
BatchID	integer	The unique identifier for the batch in which this record was processed.
BatchDate	datetime	The date and time when the batch containing the group data was processed.
ConfigID	integer	The unique identifier for the configuration associated with the group data.

AzureADGroupSettings

Group-level settings and values applied to Azure AD groups.

Name	Type	Description
ID	integer	The unique identifier for the record in the AzureADGroupSettings table.
GroupSettingId	string	The unique identifier for the group setting in Azure AD.
Name	string	The name of the group setting.
Value	string	The value associated with the group setting.
BatchID	integer	The unique identifier for the batch in which this record was processed.
BatchDate	datetime	The date and time when the batch containing the group setting data was processed.
ConfigID	integer	The unique identifier for the configuration associated with the group setting data.
CompylGroupID	integer	A reference identifier for grouping the settings related to specific group configuration (if applicable).

AzureADHdInsightClusters

Azure HDInsight cluster resources, including version, type, tier, and provisioning state.

Name	Type	Description
ConfigID	integer	The unique identifier for the configuration associated with the Azure HDInsight cluster.
ID	string	The unique identifier for the Azure HDInsight cluster.
Type	string	The type of the Azure HDInsight cluster (e.g., a specific resource type).
Location	string	The geographical region where the Azure HDInsight cluster is located.
Etag	string	A unique identifier for the version of the resource (used for concurrency checks).
Tags	string	Metadata tags associated with the Azure HDInsight cluster (e.g., for categorization or filtering).
ClusterVersion	string	The version of the Azure HDInsight cluster.
OsType	string	The type of operating system used by the cluster (e.g., `Linux`, `Windows`).
ClusterDefinitionBlueprint	string	The blueprint or template used for defining the cluster.
ClusterDefinitionKind	string	The specific kind of cluster (e.g., `Spark`, `Hadoop`).
ComputeProfile	string	The compute configuration for the cluster, such as the number and type of nodes.
ProvisioningState	string	The current state of the provisioning process (e.g., `creating`, `updating`).

AzureADIntegrations

Integration configuration records used to collect Azure data into this dataset.

Name	Type	Description
ID	integer	The unique identifier for the integration record.
Name	string	The name of the Azure AD integration.
IsEnabled	boolean	A flag indicating whether the integration is enabled (`true`) or disabled (`false`).
TenantId	string	The unique identifier of the Azure AD tenant associated with the integration.
ClientId	string	The client ID used for authentication in the Azure AD integration.
CreatedBy	string	The user or system that created the integration record.
CreatedDate	datetime	The date and time when the integration record was created.
ModifiedBy	string	The user or system that last modified the integration record.
ModifiedDate	datetime	The date and time when the integration record was last modified.
SubscriptionID	string	The Azure subscription ID associated with the integration.

AzureADKeyVaultCertificates

Certificates stored in Azure Key Vaults, including their thumbprint and lifecycle attributes.

Name	Type	Description
ConfigID	integer	The unique configuration identifier for the Key Vault certificate record.
ID	string	The unique identifier for the Key Vault certificate.
X5t	string	The certificate's thumbprint (base64-encoded) for validation purposes.
AttributesEnabled	boolean	A flag indicating whether the Key Vault certificate is enabled (`true`) or disabled (`false`).
AttributesNbf	integer	The Not Before date (UNIX timestamp) indicating the start of validity for the certificate.
AttributesExp	integer	The expiration date (UNIX timestamp) of the certificate.
AttributesCreated	integer	The timestamp when the certificate was created in the Key Vault.
AttributesUpdated	integer	The timestamp when the certificate was last updated in the Key Vault.
BatchDate	datetime	The date and time when the record was added or last updated.

AzureADKeyVaultDeletedVaults

Soft-deleted Key Vault resources pending purge, including deletion and purge dates.

Name	Type	Description
ConfigID	integer	The unique configuration identifier for the deleted Key Vault record.
ID	string	The unique identifier for the deleted Key Vault.
Name	string	The name of the deleted Key Vault.
Type	string	The type of the deleted Key Vault (e.g., Microsoft.KeyVault`,` vaults`).
PropertiesVaultId	string	The identifier of the vault before it was deleted.
PropertiesLocation	string	The geographic location where the deleted Key Vault was hosted.
PropertiesDeletionDate	datetime	The date and time when the Key Vault was deleted.
PropertiesScheduledPurgeDate	datetime	The date and time when the deleted Key Vault is scheduled to be permanently purged.
PropertiesPurgeProtectionEnabled	boolean	A flag indicating whether purge protection is enabled (`true`) or disabled (`false`) for the deleted vault.
BatchDate	datetime	The date and time when the record was added or last updated.

AzureADKeyVaultKeys

Cryptographic keys stored in Azure Key Vaults, including enablement and expiration status.

Name	Type	Description
ID	integer	The unique identifier for the Key Vault key.
AzureKeyVaultID	integer	The identifier of the Azure Key Vault where the key resides.
KeyIdentifier	string	The unique identifier for the key within the Key Vault.
Enabled	boolean	A flag indicating whether the Key Vault key is enabled (`true`) or disabled (`false`).
Expiration	datetime	The date and time when the Key Vault key will expire, if applicable.
BatchID	integer	The identifier for the batch process that handled the Key Vault key.
BatchDate	datetime	The date and time when the batch process was executed or the key data was last updated.
ConfigID	integer	The unique configuration identifier for the record associated with the Key Vault key.

AzureADKeyVaultKeyVersions

Version history of cryptographic keys stored in Azure Key Vaults.

Name	Type	Description
ConfigID	integer	The unique configuration identifier for the record associated with the Key Vault key version.
ID	string	The unique identifier for the Key Vault key version.
AttributesEnabled	boolean	A flag indicating whether the Key Vault key version is enabled (`true`) or disabled (`false`).
AttributesCreated	integer	The timestamp when the Key Vault key version was created.
AttributesUpdated	integer	The timestamp when the Key Vault key version was last updated.
AttributesRecoveryLevel	string	The recovery level for the Key Vault key version, indicating the data retention policy (e.g., `Purgeable`, `Recoverable`).
BatchDate	datetime	The date and time when the batch process was executed or the key version data was last updated.

AzureADKeyVaultManagedHSMs

Azure Key Vault Managed HSM resources, including administrators and soft-delete/purge protection settings.

Name	Type	Description
ConfigID	integer	The unique configuration identifier for the record associated with the Managed HSM instance.
ID	string	The unique identifier for the Managed HSM instance.
Type	string	The resource type of the Managed HSM instance.
Location	string	The geographical location where the Managed HSM instance is deployed.
SkuFamily	string	The SKU family of the Managed HSM instance, indicating the performance or capacity tier.
SkuName	string	The specific SKU name of the Managed HSM instance, which defines the pricing and performance characteristics.
TagsDept	string	A tag used to categorize the Managed HSM instance, such as department or project.
TagsEnvironment	string	A tag used to categorize the Managed HSM instance by environment, such as development, testing, or production.
PropertiesTenantId	string	The tenant ID associated with the Managed HSM instance.
PropertiesInitialAdminObjectIds	string	The list of initial administrator object IDs for the Managed HSM instance.
PropertiesEnableSoftDelete	boolean	A flag indicating whether soft delete is enabled (`true`) or disabled (`false`) for the Managed HSM instance.
PropertiesSoftDeleteRetentionInDays	integer	The retention period (in days) for deleted Managed HSM instances before they are permanently purged.

AzureADKeyVaults

Azure Key Vault resources, including their URI and soft-delete configuration.

Name	Type	Description
ID	integer	Unique identifier for the Azure Key Vault instance.
Name	string	The name of the Azure Key Vault instance.
Type	string	The resource type of the Azure Key Vault instance.
Location	string	The geographical location where the Azure Key Vault instance is deployed.
BatchID	integer	The identifier for the batch process that was executed when the record was updated or inserted.
BatchDate	datetime	The date and time when the batch process occurred or when the Key Vault instance data was last updated.
ConfigID	integer	A unique identifier for the configuration settings associated with the Azure Key Vault instance.
VaultUri	string	The URI endpoint of the Azure Key Vault instance, which is used for programmatic access to the vault's data and operations.
EnableSoftDelete	boolean	Indicates whether the soft delete feature is enabled (`true`) or disabled (`false`) for the Azure Key Vault instance. Soft delete allows recovery of vaults.

AzureADKeyVaultSecrets

Secrets stored in Azure Key Vaults, including enablement and expiration status.

Name	Type	Description
ID	integer	Unique identifier for the Azure Key Vault Secret instance.
AzureKeyVaultID	integer	The ID of the Azure Key Vault to which the secret belongs.
Identifier	string	The unique identifier for the secret within the Azure Key Vault instance.
Enabled	boolean	Indicates whether the secret is enabled (`true`) or disabled (`false`).
Expiration	datetime	The expiration date and time for the secret, after which it will be considered invalid or expired.
BatchID	integer	The identifier for the batch process that was executed when the secret record was updated or inserted.
BatchDate	datetime	The date and time when the batch process occurred or when the secret data was last updated.
ConfigID	integer	A unique identifier for the configuration settings associated with the Azure Key Vault secret.

AzureADLogAlerts

Fired Azure Monitor alert instances, including severity, monitor condition, and target resource.

Name	Type	Description
ConfigID	integer	A unique identifier for the configuration settings associated with the Azure log alert instance.
ID	string	Unique identifier for the log alert instance.
Type	string	The type of alert (e.g., `security`, `monitoring`, etc.).
EssentialsSeverity	string	The severity level of the alert (e.g., `high`, `medium`, `low`).
EssentialsSignalType	string	The type of signal that triggered the alert (e.g., `anomaly`, `policy violation`).
EssentialsAlertState	string	The current state of the alert (e.g., `active`, `resolved`, `dismissed`).
EssentialsMonitorCondition	string	The condition or event that caused the alert to trigger.
EssentialsMonitorService	string	The Azure service or resource that is associated with the alert.
EssentialsTargetResource	string	The resource that the alert is targeting (e.g., `a virtual machine`, `storage account`, etc.).
EssentialsTargetResourceName	string	The name of the resource that triggered the alert.
EssentialsTargetResourceGroup	string	The resource group that contains the resource.
EssentialsTargetResourceType	string	The type of the targeted resource (e.g., `virtual machine`, `database`).

AzureADLogAnalyticsWorkspaces

Log Analytics workspace resources, including SKU, retention, and network access settings.

Name	Type	Description
ConfigID	integer	A unique identifier for the configuration associated with the Log Analytics workspace.
ID	string	Unique identifier for the Log Analytics workspace instance.
PropertiesCustomerId	string	The customer ID associated with the Log Analytics workspace.
PropertiesProvisioningState	string	The current provisioning state of the Log Analytics workspace (e.g., `succeeded`, `pending`, `failed`).
PropertiesSkuName	string	The SKU (Stock Keeping Unit) name for the workspace, which defines the pricing and feature set.
PropertiesRetentionInDays	integer	The number of days that the logs are retained in the workspace.
PropertiesPublicNetworkAccessForQuery	string	Specifies whether public network access is allowed for querying the workspace (e.g., `enabled`, `disabled`).
PropertiesPublicNetworkAccessForIngestion	string	Specifies whether public network access is allowed for ingesting data into the workspace (e.g., `enabled`, `disabled`).
Name	string	The name of the Log Analytics workspace.
Type	string	The type of the Log Analytics workspace (e.g., `Microsoft.OperationalInsights`).
Location	string	The Azure region where the Log Analytics workspace is located.
Tags	string	Tags associated with the workspace (e.g., `department`, `environment`).
BatchDate	datetime	The date and time when the batch operation for the Log Analytics workspace occurred or was last updated.

AzureADLogProfiles

Azure Monitor log profile resources controlling Activity Log export destinations and retention.

Name	Type	Description
ConfigID	integer	A unique identifier for the configuration associated with the log profile.
ID	string	Unique identifier for the Log Profile instance.
Type	string	The type of the Log Profile (e.g., `Microsoft.LogProfile`).
Name	string	The name of the Log Profile.
Location	string	The Azure region where the Log Profile is located.
PropertiesStorageAccountId	string	The ID of the storage account associated with the Log Profile for storing the logs.
PropertiesServiceBusRuleId	string	The ID of the service bus rule associated with the Log Profile for event routing.
PropertiesLocations	string	The geographical locations for which the Log Profile is configured.
PropertiesCategories	string	Categories of logs being collected in the Log Profile (e.g., `AuditLogs`, `SecurityLogs`).
PropertiesRetentionPolicyEnabled	boolean	Specifies whether a retention policyis enabled for the logs in the profile (e.g., `true` or `false`).
PropertiesRetentionPolicyDays	integer	The number of days for which logs are retained in the Log Profile if retention policy is enabled.
BatchDate	datetime	The date and time when the batch operation for the Log Profile occurred or was last updated.