Google SecOps mapping

Microsoft tables to Google SecOps log_type.

Use this matrix when moving between Microsoft Sentinel or Defender XDR table names and Google SecOps parser labels. Google's Microsoft Defender for Endpoint parser is intentionally broad: it accepts endpoint, email, Cloud Apps, TVM, alert/evidence, and identity advanced hunting table payloads under one log_type.

MICROSOFT_DEFENDER_ENDPOINTAdvancedHunting-<MicrosoftTable>95 Microsoft/Azure log typesCSV checked 2026-08-19

How to read this

The Microsoft table column is the table name you use in Defender XDR advanced hunting and often map to Sentinel workspaces when Microsoft security connectors or exports are in scope. The Google SecOps log_type is the ingestion parser label. For this combined parser, the raw category value becomes the UDM metadata.product_event_type value.

Google's Microsoft Defender for Endpoint parser covers multiple Microsoft Defender XDR advanced hunting tables, not only endpoint tables.
Google maps the raw category field to UDM metadata.product_event_type for this parser.
The parser-level map includes every Google supported log type whose product name starts with Microsoft Defender, including entries listed without a default parser. Supported without a default parser means the log_type exists, but Google does not provide prebuilt UDM normalization for that source.
Treat Microsoft table availability in Sentinel as connector/export dependent; the matrix maps the Microsoft table identity to the Google SecOps parser identity.
Blank table, parser URL, and update fields are expected for supported log types that do not have a Google prebuilt parser.

Quick links

Third-party SIEM exportRelated MDCA vs MDCNaming Defender for EndpointProduct CloudAppEventsTable

Source docs

Google MDE parserSecOps Google parser listSecOps Advanced hunting schemaMicrosoft Learn

Parser status

39 catalog rows have a Google prebuilt parser.
56 catalog rows are supported log types only.
8 catalog rows are Microsoft Defender-focused mappings.

Default parser distinction

Status	Meaning	Operational impact	Google reference
Google default parser	Google lists the log type in the supported default parser table.	Use the documented parser when the feed format matches Google's expected format.	Default parser list
Supported log type only	Google lists the log type in the supported-without-default-parser section.	Ingesting under the log_type is not the same as UDM normalization; plan custom parser work.	Without default parser

Microsoft Defender parser map

Microsoft source	Microsoft table or payload family	SecOps log_type	SecOps product_event_type	Parser status	Format	Google category	Ingestion guidance	Microsoft reference	Google reference
Microsoft Defender For Cloud	Defender for Cloud alert payloads	MICROSOFT_DEFENDER_CLOUD_ALERTS	record.operationName or parser-specific	Google default parser	JSON	Automation and DevOps Tools	Use Google's default parser when the feed matches the documented JSON format.	Microsoft docs	Google docs
Microsoft Defender for Endpoint combined hunting export	Multiple Defender XDR advanced hunting tables	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-<MicrosoftTable>	Google default parser	JSON	EDR	Use Google's default parser for the supported AdvancedHunting table payloads listed in the parser docs.	Microsoft docs	Google docs
Microsoft Defender Endpoint for iOS Logs	Mobile endpoint and email/security-result payload fields from Defender on iOS	MICROSOFT_DEFENDER_ENDPOINT_IOS	Parser-specific	Google default parser	JSON	Not categorized in parser list	Use Google's default parser when Defender Endpoint for iOS events match the documented JSON format.	Microsoft docs	Google docs
Microsoft Defender for Identity parser	Defender for Identity logs; Google sample uses AdvancedHunting-IdentityDirectoryEvents but does not publish an exhaustive table list.	MICROSOFT_DEFENDER_IDENTITY	Parser-specific	Google default parser	JSON	EDR	Use Google's default parser when Defender for Identity logs match the documented JSON format.	Microsoft docs	Google docs
Microsoft Defender for Office 365 parser	EmailEvents; EmailAttachmentInfo; EmailUrlInfo; EmailPostDeliveryEvents; UrlClickEvents	MICROSOFT_DEFENDER_MAIL	Parser-specific	Google default parser	JSON, JSON+CSV	Email server log types.	Use Google's default parser for the supported Microsoft Defender for Office 365 mail formats listed by Google.	Microsoft docs	Google docs
Microsoft Defender for Cloud Apps	CloudAppEvents and SaaS/CASB activity context	MICROSOFT_DEFENDER_CLOUD_APPS	No default parser listed	Supported log type only	Not listed	Supported log type without a default parser	Create or attach a custom parser before relying on UDM fields; Google lists the log_type but not a default parser.	Microsoft docs	Google docs
Microsoft Defender XDR	Defender XDR incidents, alerts, actions, and cross-product security payloads	MICROSOFT_DEFENDER_XDR	No default parser listed	Supported log type only	Not listed	Supported log type without a default parser	Create or attach a custom parser before relying on UDM fields; Google lists the log_type but not a default parser.	Microsoft docs	Google docs
Microsoft Defender External Attack Surface Management	External attack surface assets, observations, and exposure management payloads	MICROSOFT_EASM	No default parser listed	Supported log type only	Not listed	Supported log type without a default parser	Create or attach a custom parser before relying on UDM fields; Google lists the log_type but not a default parser.	Microsoft docs	Google docs

Microsoft and Azure log type catalog

This catalog is generated from the CSV data source. Empty Microsoft table and parser-update fields are retained as unknown or not applicable, especially for rows where Google recognizes the log_type but does not publish a prebuilt parser.

SecOps log_type	Microsoft product	Parser status	Support type	Microsoft tables supported	Notes	Parser reference	Latest parser update
AZURE	Microsoft Azure	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_ACTIVITY	Microsoft Azure Activity	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-07-21
AZURE_AD	Azure AD	Prebuilt parser	standard	SignInLogs; NonInteractiveUserSignInLogs; ServicePrincipalSignInLogs; ManagedIdentitySignInLogs; ProvisioningLogs; RiskyUsers; UserRiskEvents	Google documents these as Entra/Azure diagnostic log categories routed to the AZURE_AD log type; names are preserved here exactly.	Google docs	2026-07-23
AZURE_AD_AUDIT	Azure AD Directory Audit	Prebuilt parser	standard	AuditLogs	Google documents AuditLogs as the Entra diagnostic category routed to AZURE_AD_AUDIT.	Google docs	2026-03-06
AZURE_AD_CONTEXT	Azure AD Organizational Context	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-07-13
AZURE_AD_PASSWORD_PROTECTION	Azure AD Password Protection	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_AD_PROVISIONING	Azure AD Provisioning	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_AD_SIGNIN	Azure AD Sign-In	Prebuilt parser	standard	SignInLogs; NonInteractiveUserSignInLogs; ServicePrincipalSignInLogs; ManagedIdentitySignInLogs; ADFSSignInLogs	Google's parser page explicitly documents these sign-in log categories; they are not Defender XDR Advanced Hunting tables.	Google docs	2026-04-20
AZURE_API_MANAGEMENT	Azure API Management	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-01-21
AZURE_APPCONFIGURATION	Azure App Configuration	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_APPPLATFORM	Azure App Platform	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_APP_SERVICE	Azure App Service	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-10-18
AZURE_ARCDATA	Azure ArcData	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_ATP	Azure ATP	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_AUTHORIZATION	Azure Authorization	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_BASTION	Azure Bastion	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_CHANGEANALYSIS	Azure Change Analysis	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_COMPUTE	Azure Compute	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_CONTAINER_REGISTRY	Azure Container Registry	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
AZURE_COSMOS_DB	Azure Cosmos DB	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-01-16
AZURE_DATAFACTORY	Azure DataFactory	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_DEVOPS	Azure DevOps Audit	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-03-10
AZURE_DNS	Azure DNS logs	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_DOCUMENTDB	Azure DocumentDB	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_EVENTGRID	Azure Event Grid	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_EVENTHUB	Azure Event Hub	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_FIREWALL	Azure Firewall	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-04-13
AZURE_FRONT_DOOR	Azure Front Door	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-04-16
AZURE_GATEWAY	Azure Application Gateway	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-07-22
AZURE_GATEWAY_CONTAINERS	Azure Application Gateway for Containers	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
AZURE_HYBRIDCOMPUTE	Azure Hybrid Compute	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_KEYVAULT_AUDIT	Azure Key Vault logging	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-07-14
AZURE_LOGIC_APPS	Azure Logic Apps	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
AZURE_LOG_ANALYTICS_WORKSPACE	Azure Log Analytics Workspace	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_MDM_INTUNE	Microsoft Intune	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-12-26
AZURE_MDM_INTUNE_CONTEXT	Microsoft Intune Context	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-09-19
AZURE_NATGW_FLOW	Azure NAT Gateway Flow	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
AZURE_NIX_SYSTEM	Azure Nix System	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_NSG_EVENT	Azure Network Security Group Event	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_NSG_FLOW	Microsoft Azure NSG Flow	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-05-20
AZURE_ORG_CONTEXT	Azure Org Context	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_POSTGRESQL	Azure PostgreSQL	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_RECOVERY_SERVICES_VAULTS	Azure Recovery Services Vaults	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_RESOURCE_LOGS	Microsoft Azure Resource	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-07-27
AZURE_RISKY_USERS	Azure Risky Users	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_RISK_EVENTS	Azure Risk Events	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_SECURITY_CENTER	Azure Security Center	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_SERVICE_PRINCIPAL_LOGINS	Azure Service Principal Logins	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_SOFTWARE_VULNERABILITIES	Azure Software Vulnerabilities	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
AZURE_SQL	Azure SQL	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-04-30
AZURE_STORAGE_AUDIT	Azure Storage Audit	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2026-05-05
AZURE_VNET_FLOW	Azure VNET Flow	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-07-18
AZURE_VPN	Azure VPN	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-10-11
AZURE_WAF	Azure WAF	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-08-22
AZURE_WVD_CONNECTIONS	Azure Windows Virtual Desktop Connections Logs	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
AZURE_WVD_MANAGEMENT	Azure Windows Virtual Desktop Management Logs	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_ADS	Microsoft Ads	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
MICROSOFT_ATA	Microsoft ATA	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-01-29
MICROSOFT_CASB	Microsoft CASB	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-03-26
MICROSOFT_CASB_CONTEXT	Microsoft CASB Files & Entities	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_COPILOT_INTERACTION	Microsoft Copilot Interaction	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
MICROSOFT_DATABRICKS_WORKSPACES	Microsoft Azure Databricks	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_DEFENDER_CLOUD_ALERTS	Microsoft Defender For Cloud	Prebuilt parser	standard	SecurityAlert	Google documents SecurityAlert as the Log Analytics table used by the Blob Storage collection method; Event Hub continuous export does not require this table.	Google docs	2026-04-09
MICROSOFT_DEFENDER_CLOUD_APPS	Microsoft Defender for Cloud Apps	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_DEFENDER_ENDPOINT	Microsoft Defender for Endpoint	Prebuilt premium parser	premium	AlertEvidence; AlertInfo; CloudAppEvents; DeviceAlertEvents; DeviceEvents; DeviceFileCertificateInfo; DeviceFileEvents; DeviceImageLoadEvents; DeviceInfo; DeviceLogonEvents; DeviceNetworkEvents; DeviceNetworkInfo; DeviceProcessEvents; DeviceRegistryEvents; DeviceTvmInfoGathering; DeviceTvmInfoGatheringKB; DeviceTvmSecureConfigurationAssessment; DeviceTvmSecureConfigurationAssessmentKB; DeviceTvmSoftwareEvidenceBeta; DeviceTvmSoftwareInventory; DeviceTvmSoftwareVulnerabilities; DeviceTvmSoftwareVulnerabilitiesKB; EmailAttachmentInfo; EmailEvents; EmailPostDeliveryEvents; EmailUrlInfo; IdentityInfo; IdentityLogonEvents	Explicit table/event-type list in Google's Microsoft Defender for Endpoint parser documentation. Do not assume additional XDR tables are supported.	Google docs	2026-06-03
MICROSOFT_DEFENDER_ENDPOINT_IOS	Microsoft Defender Endpoint for iOS	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-03-10
MICROSOFT_DEFENDER_IDENTITY	Microsoft Defender for Identity	Prebuilt parser	standard	Not published or not applicable	No exhaustive table list found in Google's parser documentation. A sample uses AdvancedHunting-IdentityDirectoryEvents, so the table field is intentionally left blank.	Google docs	2026-04-15
MICROSOFT_DEFENDER_MAIL	Microsoft Defender for Office 365	Prebuilt parser	standard	EmailEvents; EmailAttachmentInfo; EmailUrlInfo; EmailPostDeliveryEvents; UrlClickEvents	Explicit Advanced Hunting tables listed by Google's Microsoft Defender for Office 365 parser documentation.	Google docs	2026-07-19
MICROSOFT_DEFENDER_XDR	Microsoft Defender XDR	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
MICROSOFT_DOTNET	Microsoft Dotnet Log Files	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_DYNAMICS_365	Microsoft Dynamics 365 User Activity	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-12-16
MICROSOFT_EASM	Microsoft Defender External Attack Surface Management	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_ENTRA_ID_PROTECTION	Microsoft Entra ID Protection	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
MICROSOFT_GRAPH_ACTIVITY_LOGS	Microsoft Graph Activity Logs	Prebuilt parser	standard	MicrosoftGraphActivityLogs	Google explicitly routes the MicrosoftGraphActivityLogs Entra diagnostic category to this log type.	Google docs	2024-10-08
MICROSOFT_GRAPH_ALERT	Microsoft Graph API Alerts	Prebuilt premium parser	premium	Not published or not applicable	Not documented	Google docs	2026-07-10
MICROSOFT_GRAPH_INCIDENT	Microsoft Graph Incident	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
MICROSOFT_GRAPH_RISKY_USERS	Microsoft Graph Risky Users	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_IAS	Microsoft IAS Server	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-04-25
MICROSOFT_IDENTITY_PROTECTION	Microsoft Identity Protection	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_INSIGHTS_COMPONENTS	Microsoft Insights/Components	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_LAPS	Windows LAPS	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-08-19
MICROSOFT_NETLOGON	Microsoft Netlogon	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2024-12-24
MICROSOFT_NPS	Network Policy Server	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-12-31
MICROSOFT_POWERBI_ACTIVITY_LOG	Power BI Activity Log	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_PURVIEW	Microsoft Purview	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	Google docs	No parser update listed
MICROSOFT_RISK_DETECTIONS	Microsoft Azure AD Risk Detections	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_SCEP	Microsoft System Center Endpoint Protection	Prebuilt parser	standard	Not published or not applicable	Not documented	Google docs	2025-02-24
MICROSOFT_SECURITY_ACTIONS	Microsoft Security Actions	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_SECURITY_ALERTS	Microsoft Security Advisories Alerts	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_SENTINEL	Microsoft Sentinel	Prebuilt parser	standard	Not published or not applicable	Google documents Sentinel incidents/alerts delivered through Logic Apps/webhooks; no Microsoft table support list is documented.	Google docs	2026-07-09
MICROSOFT_SERVICEBUS_NAMESPACES	Microsoft ServiceBus/Namespaces	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_SQL_MANAGED_INSTANCES	Microsoft Azure SQL Managed Instances	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_SSTP	Microsoft SSTP VPN	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
MICROSOFT_THREAT_INDICATORS	Microsoft Threat Indicators	No default parser	N/A (no parser)	Not published or not applicable	No Google default parser is listed; Microsoft table support is not inferred.	No prebuilt parser doc	No parser update listed
OFFICE_365	Office 365	Prebuilt premium parser	premium	Not published or not applicable	Not table-based. Google documents Office 365 Management Activity API content types: Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, and DLP.All.	Google docs	2026-07-10

Combined MDE parser matrix

Microsoft log source	Microsoft table	SecOps log_type	SecOps product_event_type	Microsoft reference	SecOps reference	Note
Microsoft Defender XDR	AlertEvidence	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-AlertEvidence	Table docs	Parser docs	Alert/evidence records from Defender XDR, not only endpoint telemetry.
Microsoft Defender XDR	AlertInfo	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-AlertInfo	Table docs	Parser docs	Alert metadata across supported Defender providers.
Microsoft Defender for Cloud Apps	CloudAppEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-CloudAppEvents	Table docs	Parser docs	SaaS/CASB activity is included in Google's MDE parser log_type.
Microsoft Defender for Endpoint	DeviceAlertEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceAlertEvents	Table docs	Parser docs	Endpoint alert events.
Microsoft Defender for Endpoint	DeviceEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceEvents	Table docs	Parser docs	General endpoint events.
Microsoft Defender for Endpoint	DeviceFileCertificateInfo	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceFileCertificateInfo	Table docs	Parser docs	Certificate information for signed endpoint files.
Microsoft Defender for Endpoint	DeviceFileEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceFileEvents	Table docs	Parser docs	Endpoint file events.
Microsoft Defender for Endpoint	DeviceImageLoadEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceImageLoadEvents	Table docs	Parser docs	DLL/image load events.
Microsoft Defender for Endpoint	DeviceInfo	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceInfo	Table docs	Parser docs	Endpoint inventory and state. Google sample logs show this product_event_type pattern.
Microsoft Defender for Endpoint	DeviceLogonEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceLogonEvents	Table docs	Parser docs	Endpoint sign-in events.
Microsoft Defender for Endpoint	DeviceNetworkEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceNetworkEvents	Table docs	Parser docs	Endpoint network connections.
Microsoft Defender for Endpoint	DeviceNetworkInfo	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceNetworkInfo	Table docs	Parser docs	Endpoint network adapter and interface state.
Microsoft Defender for Endpoint	DeviceProcessEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceProcessEvents	Table docs	Parser docs	Endpoint process creation and command-line activity.
Microsoft Defender for Endpoint	DeviceRegistryEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceRegistryEvents	Table docs	Parser docs	Endpoint registry activity.
Microsoft Defender Vulnerability Management	DeviceTvmInfoGathering	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmInfoGathering	Table docs	Parser docs	TVM assessment signal in the same Google log_type.
Microsoft Defender Vulnerability Management	DeviceTvmInfoGatheringKB	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmInfoGatheringKB	Table docs	Parser docs	TVM knowledge-base metadata.
Microsoft Defender Vulnerability Management	DeviceTvmSecureConfigurationAssessment	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmSecureConfigurationAssessment	Table docs	Parser docs	Secure configuration assessment results.
Microsoft Defender Vulnerability Management	DeviceTvmSecureConfigurationAssessmentKB	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmSecureConfigurationAssessmentKB	Table docs	Parser docs	Secure configuration assessment knowledge base.
Microsoft Defender Vulnerability Management	DeviceTvmSoftwareEvidenceBeta	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmSoftwareEvidenceBeta	Table docs	Parser docs	Software evidence table; verify current Microsoft naming because of the beta suffix.
Microsoft Defender Vulnerability Management	DeviceTvmSoftwareInventory	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmSoftwareInventory	Table docs	Parser docs	Software inventory.
Microsoft Defender Vulnerability Management	DeviceTvmSoftwareVulnerabilities	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmSoftwareVulnerabilities	Table docs	Parser docs	Software vulnerability findings.
Microsoft Defender Vulnerability Management	DeviceTvmSoftwareVulnerabilitiesKB	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-DeviceTvmSoftwareVulnerabilitiesKB	Table docs	Parser docs	Software vulnerability knowledge base.
Microsoft Defender for Office 365	EmailAttachmentInfo	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-EmailAttachmentInfo	Table docs	Parser docs	MDO email attachment table inside the combined Google MDE parser.
Microsoft Defender for Office 365	EmailEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-EmailEvents	Table docs	Parser docs	MDO email events inside the combined Google MDE parser.
Microsoft Defender for Office 365	EmailPostDeliveryEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-EmailPostDeliveryEvents	Table docs	Parser docs	MDO post-delivery actions inside the combined Google MDE parser.
Microsoft Defender for Office 365	EmailUrlInfo	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-EmailUrlInfo	Table docs	Parser docs	MDO URL metadata inside the combined Google MDE parser.
Microsoft Defender XDR / Identity	IdentityInfo	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-IdentityInfo	Table docs	Parser docs	Identity entity context in the combined parser.
Microsoft Defender XDR / Identity	IdentityLogonEvents	MICROSOFT_DEFENDER_ENDPOINT	AdvancedHunting-IdentityLogonEvents	Table docs	Parser docs	Identity sign-in/logon events in the combined parser.

Field rule

For the Microsoft Defender for Endpoint parser, Google documents that the raw category field maps to UDM metadata.product_event_type. That is why a Microsoft table such as DeviceInfo appears as AdvancedHunting-DeviceInfo after SecOps parsing.

json

{
  "category": "AdvancedHunting-DeviceInfo",
  "properties": {
    "DeviceId": "example-device-id",
    "DeviceName": "workstation01.contoso.com"
  }
}

Borrowable snippet

These KQL datatables mirror the matrix and parser-status map. Paste them into notes, detections, workbook prototypes, or migration spreadsheets as compact lookup tables.

kql

let GoogleSecOpsDefenderParserStatus = datatable(
  MicrosoftSource:string,
  SecOpsLogType:string,
  ParserStatus:string,
  Format:string,
  IngestionGuidance:string
)
[
  "Microsoft Defender For Cloud", "MICROSOFT_DEFENDER_CLOUD_ALERTS", "Google default parser", "JSON", "Use Google's default parser when the feed matches the documented JSON format.",
  "Microsoft Defender for Endpoint combined hunting export", "MICROSOFT_DEFENDER_ENDPOINT", "Google default parser", "JSON", "Use Google's default parser for the supported AdvancedHunting table payloads listed in the parser docs.",
  "Microsoft Defender Endpoint for iOS Logs", "MICROSOFT_DEFENDER_ENDPOINT_IOS", "Google default parser", "JSON", "Use Google's default parser when Defender Endpoint for iOS events match the documented JSON format.",
  "Microsoft Defender for Identity parser", "MICROSOFT_DEFENDER_IDENTITY", "Google default parser", "JSON", "Use Google's default parser when Defender for Identity logs match the documented JSON format.",
  "Microsoft Defender for Office 365 parser", "MICROSOFT_DEFENDER_MAIL", "Google default parser", "JSON, JSON+CSV", "Use Google's default parser for the supported Microsoft Defender for Office 365 mail formats listed by Google.",
  "Microsoft Defender for Cloud Apps", "MICROSOFT_DEFENDER_CLOUD_APPS", "Supported log type only", "Not listed", "Create or attach a custom parser before relying on UDM fields; Google lists the log_type but not a default parser.",
  "Microsoft Defender XDR", "MICROSOFT_DEFENDER_XDR", "Supported log type only", "Not listed", "Create or attach a custom parser before relying on UDM fields; Google lists the log_type but not a default parser.",
  "Microsoft Defender External Attack Surface Management", "MICROSOFT_EASM", "Supported log type only", "Not listed", "Create or attach a custom parser before relying on UDM fields; Google lists the log_type but not a default parser."
];

kql

let GoogleSecOpsMicrosoftMap = datatable(
  MicrosoftLogSource:string,
  MicrosoftTable:string,
  SecOpsLogType:string,
  SecOpsProductEventType:string
)
[
  "Microsoft Defender XDR", "AlertEvidence", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-AlertEvidence",
  "Microsoft Defender XDR", "AlertInfo", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-AlertInfo",
  "Microsoft Defender for Cloud Apps", "CloudAppEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-CloudAppEvents",
  "Microsoft Defender for Endpoint", "DeviceAlertEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceAlertEvents",
  "Microsoft Defender for Endpoint", "DeviceEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceEvents",
  "Microsoft Defender for Endpoint", "DeviceFileCertificateInfo", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceFileCertificateInfo",
  "Microsoft Defender for Endpoint", "DeviceFileEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceFileEvents",
  "Microsoft Defender for Endpoint", "DeviceImageLoadEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceImageLoadEvents",
  "Microsoft Defender for Endpoint", "DeviceInfo", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceInfo",
  "Microsoft Defender for Endpoint", "DeviceLogonEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceLogonEvents",
  "Microsoft Defender for Endpoint", "DeviceNetworkEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceNetworkEvents",
  "Microsoft Defender for Endpoint", "DeviceNetworkInfo", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceNetworkInfo",
  "Microsoft Defender for Endpoint", "DeviceProcessEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceProcessEvents",
  "Microsoft Defender for Endpoint", "DeviceRegistryEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceRegistryEvents",
  "Microsoft Defender Vulnerability Management", "DeviceTvmInfoGathering", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmInfoGathering",
  "Microsoft Defender Vulnerability Management", "DeviceTvmInfoGatheringKB", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmInfoGatheringKB",
  "Microsoft Defender Vulnerability Management", "DeviceTvmSecureConfigurationAssessment", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmSecureConfigurationAssessment",
  "Microsoft Defender Vulnerability Management", "DeviceTvmSecureConfigurationAssessmentKB", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmSecureConfigurationAssessmentKB",
  "Microsoft Defender Vulnerability Management", "DeviceTvmSoftwareEvidenceBeta", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmSoftwareEvidenceBeta",
  "Microsoft Defender Vulnerability Management", "DeviceTvmSoftwareInventory", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmSoftwareInventory",
  "Microsoft Defender Vulnerability Management", "DeviceTvmSoftwareVulnerabilities", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmSoftwareVulnerabilities",
  "Microsoft Defender Vulnerability Management", "DeviceTvmSoftwareVulnerabilitiesKB", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-DeviceTvmSoftwareVulnerabilitiesKB",
  "Microsoft Defender for Office 365", "EmailAttachmentInfo", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-EmailAttachmentInfo",
  "Microsoft Defender for Office 365", "EmailEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-EmailEvents",
  "Microsoft Defender for Office 365", "EmailPostDeliveryEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-EmailPostDeliveryEvents",
  "Microsoft Defender for Office 365", "EmailUrlInfo", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-EmailUrlInfo",
  "Microsoft Defender XDR / Identity", "IdentityInfo", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-IdentityInfo",
  "Microsoft Defender XDR / Identity", "IdentityLogonEvents", "MICROSOFT_DEFENDER_ENDPOINT", "AdvancedHunting-IdentityLogonEvents"
];