Find fields across tables.
Schemas are loaded independently from table records so fields can be searched, compared, and linked back to source tables.
Current Schemas
| Table | Fields | High-value fields |
|---|---|---|
| DeviceProcessEvents | 7 | Timestamp, DeviceId, DeviceName, ActionType, FileName, ProcessCommandLine |
| DeviceEvents | 6 | Timestamp, DeviceId, DeviceName, ActionType, AdditionalFields, RemoteIP |
| DeviceFileEvents | 10 | Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath |
| DeviceNetworkEvents | 10 | Timestamp, DeviceId, DeviceName, ActionType, RemoteIP, RemotePort |
| DeviceRegistryEvents | 9 | Timestamp, DeviceId, DeviceName, ActionType, RegistryKey, RegistryValueName |
| DeviceLogonEvents | 10 | Timestamp, DeviceId, DeviceName, ActionType, LogonType, AccountName |
| DeviceImageLoadEvents | 9 | Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath |
| DeviceInfo | 10 | Timestamp, DeviceId, DeviceName, ClientVersion, PublicIP, OSPlatform |
| IntuneAuditLogs | 12 | _BilledSize, Category, CorrelationId, Identity, _IsBillable, OperationName |
| IntuneOperationalLogs | 9 | _BilledSize, Category, _IsBillable, OperationName, Properties, Result |
| EmailEvents | 49 | Timestamp, NetworkMessageId, InternetMessageId, SenderMailFromAddress, SenderFromAddress, SenderDisplayName |
| EmailUrlInfo | 8 | Timestamp, NetworkMessageId, Url, UrlDomain, UrlLocation, UrlChainId |
| EmailAttachmentInfo | 17 | Timestamp, NetworkMessageId, SenderFromAddress, SenderDisplayName, SenderObjectId, RecipientEmailAddress |
| EmailPostDeliveryEvents | 15 | Timestamp, NetworkMessageId, InternetMessageId, Action, ActionType, ActionTrigger |
| UrlClickEvents | 19 | Timestamp, Url, ActionType, AccountUpn, Workload, NetworkMessageId |
| CampaignInfo | 8 | Timestamp, CampaignName, CampaignId, CampaignType, CampaignSubtype, NetworkMessageId |
| CloudAppEvents | 8 | Timestamp, ActionType, Application, AccountObjectId, IPAddress, AuditSource |
| CloudAuditEvents | 8 | Timestamp, DataSource, ActionType, OperationName, ResourceId, IPAddress |
| FileMaliciousContentInfo | 16 | Timestamp, Workload, FileName, FolderPath, FileSize, SHA256 |
| MessageEvents | 27 | Timestamp, LastEditedTime, TeamsMessageId, SenderEmailAddress, SenderDisplayName, SenderObjectId |
| MessageUrlInfo | 6 | Timestamp, TeamsMessageId, Url, UrlDomain, ThreatTypes, ReportId |
| MessagePostDeliveryEvents | 15 | Timestamp, TeamsMessageId, Action, ActionType, ActionTrigger, ActionResult |
| SecurityAlert | 10 | TimeGenerated, SystemAlertId, AlertName, AlertSeverity, AlertType, Status |
| SecurityIncident | 10 | TimeGenerated, IncidentNumber, Title, Severity, Status, Owner |
| ThreatIntelIndicators | 26 | AdditionalFields, AzureTenantId, _BilledSize, Confidence, Created, Data |
| ThreatIntelObjects | 16 | AdditionalFields, AzureTenantId, _BilledSize, Data, Id, _IsBillable |