CloudAuditEvents
CloudAuditEvents contains cloud audit events for cloud platforms protected by Microsoft Defender for Cloud, including Azure Resource Manager, AWS, GCP, Kubernetes audit, and other cloud platform sources.
tablesCurrent
Relationships
Schema
| Field | Type | Description | Copy |
|---|---|---|---|
Timestamp | datetime | Date and time when the cloud audit event was recorded. | |
DataSource | string | Cloud audit data source such as GCP, AWS, Azure Resource Manager, Kubernetes Audit, or another cloud platform. | |
ActionType | string | Activity type such as Create, Read, Update, Delete, Other, or Unknown. | |
OperationName | string | Audit event operation name as it appears in the source record. | |
ResourceId | string | Unique identifier of the cloud resource accessed. | |
IPAddress | string | Client IP address used to access the cloud resource or control plane. | |
RawEventData | dynamic | Full raw event information from the cloud audit data source in JSON format. | |
AdditionalFields | dynamic | Additional information about the audit event. |
Sample KQL
Recent cloud control-plane writes
Find write-style operations across protected cloud platforms.
kql
CloudAuditEvents
| where Timestamp > ago(24h)
| where ActionType in ("Create", "Update", "Delete")
| project Timestamp, DataSource, OperationName, ResourceId, IPAddress
| order by Timestamp desc