Find fields across tables.
Schemas are loaded independently from table records so fields can be searched, compared, and linked back to source tables.
Current Schemas
| Table | Fields | High-value fields |
|---|---|---|
| DeviceProcessEvents | 7 | Timestamp, DeviceId, DeviceName, ActionType, FileName, ProcessCommandLine |
| DeviceEvents | 6 | Timestamp, DeviceId, DeviceName, ActionType, AdditionalFields, RemoteIP |
| DeviceFileEvents | 10 | Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath |
| DeviceNetworkEvents | 10 | Timestamp, DeviceId, DeviceName, ActionType, RemoteIP, RemotePort |
| DeviceRegistryEvents | 9 | Timestamp, DeviceId, DeviceName, ActionType, RegistryKey, RegistryValueName |
| DeviceLogonEvents | 10 | Timestamp, DeviceId, DeviceName, ActionType, LogonType, AccountName |
| DeviceImageLoadEvents | 9 | Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath |
| DeviceInfo | 10 | Timestamp, DeviceId, DeviceName, ClientVersion, PublicIP, OSPlatform |
| EmailEvents | 49 | Timestamp, NetworkMessageId, InternetMessageId, SenderMailFromAddress, SenderFromAddress, SenderDisplayName |
| EmailUrlInfo | 8 | Timestamp, NetworkMessageId, Url, UrlDomain, UrlLocation, UrlChainId |
| EmailAttachmentInfo | 17 | Timestamp, NetworkMessageId, SenderFromAddress, SenderDisplayName, SenderObjectId, RecipientEmailAddress |
| EmailPostDeliveryEvents | 15 | Timestamp, NetworkMessageId, InternetMessageId, Action, ActionType, ActionTrigger |
| UrlClickEvents | 19 | Timestamp, Url, ActionType, AccountUpn, Workload, NetworkMessageId |
| CampaignInfo | 8 | Timestamp, CampaignName, CampaignId, CampaignType, CampaignSubtype, NetworkMessageId |
| FileMaliciousContentInfo | 16 | Timestamp, Workload, FileName, FolderPath, FileSize, SHA256 |
| MessageEvents | 27 | Timestamp, LastEditedTime, TeamsMessageId, SenderEmailAddress, SenderDisplayName, SenderObjectId |
| MessageUrlInfo | 6 | Timestamp, TeamsMessageId, Url, UrlDomain, ThreatTypes, ReportId |
| MessagePostDeliveryEvents | 15 | Timestamp, TeamsMessageId, Action, ActionType, ActionTrigger, ActionResult |
| SecurityAlert | 10 | TimeGenerated, SystemAlertId, AlertName, AlertSeverity, AlertType, Status |
| SecurityIncident | 10 | TimeGenerated, IncidentNumber, Title, Severity, Status, Owner |
| ThreatIntelIndicators | 26 | AdditionalFields, AzureTenantId, _BilledSize, Confidence, Created, Data |
| ThreatIntelObjects | 16 | AdditionalFields, AzureTenantId, _BilledSize, Data, Id, _IsBillable |