Field Search

Map fields to tables and requirements.

Search a schema field and see every table containing it, plus the source product, required license, and API used to query it.

Common Security Pivot Fields

Pivot	Fields to try	Use
Identity	AccountUpn, UserPrincipalName, Identity, InitiatingProcessAccountUpn	User investigation, sign-in pivots, mailbox activity
Endpoint	DeviceName, DeviceId, FileName, SHA256, InitiatingProcessFileName	Host timeline, file/process pivots, endpoint scoping
Network	RemoteIP, LocalIP, IPAddress, RemoteUrl, Url	IP/domain/URL pivots across endpoint and email telemetry
Email	SenderFromAddress, RecipientEmailAddress, NetworkMessageId, InternetMessageId	Message trace, attachment, URL, and click correlation

kql

let searchValue = "203.0.113.10";
union isfuzzy=true
  DeviceNetworkEvents,
  DeviceEvents,
  EmailEvents,
  EmailUrlInfo,
  UrlClickEvents,
  IdentityLogonEvents
| where tostring(pack_all()) has searchValue
| project Timestamp, Type, DeviceName, AccountUpn, SenderFromAddress, RecipientEmailAddress, RemoteIP, RemoteUrl, Url, NetworkMessageId
| order by Timestamp desc

Query Examples Using Common Fields

Field	Example	Catalog
`NetworkMessageId`	Email to URL to click investigation	Open query
`AuthenticationDetails`	Inbound email authentication summary	Open query
`ProcessCommandLine`	Suspicious PowerShell launch review	Open query
`Identity`	Intune policy change review	Open query
`RemoteIP`	Threat indicator to endpoint network join	Open query

5 field matches

Field	Type	Table	Source	License	API
`InitiatingProcessAccountSid` Security identifier of the account context that initiated the process.	string	DeviceProcessEvents	Microsoft Defender for Endpoint	Microsoft Defender for Endpoint P2	Microsoft Graph Security API Microsoft Defender for Endpoint APIs Legacy Microsoft Defender XDR APIs
`InitiatingProcessAccountSid` Security identifier of the account that ran the process responsible for the event.	string	DeviceFileEvents	Microsoft Defender for Endpoint	Microsoft Defender for Endpoint P2	Microsoft Graph Security API Microsoft Defender for Endpoint APIs Legacy Microsoft Defender XDR APIs
`InitiatingProcessAccountSid` Security identifier of the account that ran the process responsible for the network event.	string	DeviceNetworkEvents	Microsoft Defender for Endpoint	Microsoft Defender for Endpoint P2	Microsoft Graph Security API Microsoft Defender for Endpoint APIs Legacy Microsoft Defender XDR APIs
`InitiatingProcessAccountSid` Security identifier of the account that ran the process responsible for the registry event.	string	DeviceRegistryEvents	Microsoft Defender for Endpoint	Microsoft Defender for Endpoint P2	Microsoft Graph Security API Microsoft Defender for Endpoint APIs Legacy Microsoft Defender XDR APIs
`InitiatingProcessAccountSid` Security identifier of the account that ran the process responsible for loading the image.	string	DeviceImageLoadEvents	Microsoft Defender for Endpoint	Microsoft Defender for Endpoint P2	Microsoft Graph Security API Microsoft Defender for Endpoint APIs Legacy Microsoft Defender XDR APIs