English (United States) Deutsch

Articles in this section

Microsoft Sentinel event schema

Updated
  • Root-level fields are present in the logs for all event types.
  • Some root-level fields, such as ActorDetails and Location, are dynamic objects with their own field definitions.
  • EventResultDetails is currently defined only for Authentication events. For all other event types, its value is null.
  • Some event types include a dynamic EventData field. Its structure depends on the corresponding EventType and EventSubType.
  • Some EventData definitions also include AdditionalFields. These fields are included only when the specified conditions are met.

 

Root-level event fields

Field name Class Type Format Description
TimeGenerated Mandatory Datetime Datetime Time the event was sent to the Log Analytics workspace.
SchemaVersion Mandatory String 2.0.0 Version of the event schema.
ActorUserEmail Mandatory String {email address}

User's email address.

If Tresorit Support performed the action, the value is support@tresorit.com and all other actor user fields are empty.
ActorUserIsExternal Mandatory Boolean
  • True
  • False
 Whether the user belongs to the subscription domain.
ActorDetails Mandatory Dynamic Depends on ActorDetails See ActorDetails.
EventType Mandatory Enumerated
  • Authentication
  • UserActivity
  • AdminActivity
  • DomainUserManagement
 Type of operation reported by the event.
EventSubType Mandatory Enumerated Depends on EventType Subtype of the operation.
EventTimestamp Mandatory Datetime {ISO-8601 formatted timestamp} Time the reporting device generated the event.
EventResult Mandatory Enumerated
  • Success
  • Failure
  • Partial
 Result of the event.
EventResultDetails Recommended Enumerated / null Defined for each EventType Defined only for some event types. See the corresponding event schema.
EventData Mandatory Dynamic Defined for each EventType Event type-specific schema definition.
Location Mandatory Dynamic Depends on Location See Location.

ActorDetails

Field name Class Type Format Description
ActorUserId Recommended String {uuid_v4} User's unique identifier.
ActorUserFirstName Recommended String {first name} User's first name.
ActorUserLastName Recommended String {last name} User's last name.
ActorUserRole Recommended Enumerated
  • Owner
  • Co-Owner
  • Administrator
  • Member
 User's role in the subscription.
ActorSessionId Recommended String [a-z0-9]{64} User's unique session identifier.
SHA256("TresoritSIEM" + {SessionId})
ActorUserDomainId Recommended String {uuid_v4} Unique identifier of the user's domain.
ActorUserDomainName Recommended String {organization name} Name of the user's subscription organization.
ActorDeviceName Recommended String {device name} Name of the device or web session where the event originated.
ActorDeviceId Recommended String [a-zA-Z0-9]{32} Device's unique identifier.
ActorDeviceType Recommended Enumerated
  • Web
  • NativeDesktop
  • NativeMobile
 Client type from which the event originated.
ActorDevicePlatform Recommended Enumerated
  • Windows
  • macOS
  • Linux
  • iOS
  • Android
 Operating system of the device from which the event originated.
ActorDeviceIpAddress Recommended IP address {ipv4} Device's IP address.
ClientAgent Recommended String {ClientVersionNumber}({ClientType};{ClientId}) Tresorit-specific client agent information.
HttpUserAgent Recommended String User-Agent: {BrowserInformation} ({SystemInformation}) {platform} ({platform-details}) {extensions} The HTTP user agent from the original request.

Location

Field name Class Type Format Description
GeolocationCountry Recommended String {country} Approximate country based on the originating IP address.*
GeolocationRegion Recommended String {region} Approximate region based on the originating IP address.*
GeolocationCity Recommended String {city} Approximate city based on the originating IP address.*
GeolocationLongitude Recommended Longitude ^-?([0-9]{1,2}|1[0-7][0-9]|180)(\.[0-9]{1,10})$ Approximate longitude based on the originating IP address.*
GeolocationLatitude Recommended Latitude ^-?([0-8]?[0-9]|90)(\.[0-9]{1,10})$ Approximate latitude based on the originating IP address.*

* Geolocation accuracy may vary.

 

Authentication event fields

Field name Class Type Format Description
EventSubType Mandatory Enumerated
  • Login
  • Logout
  • DeviceRegister
  • DeviceRevoke
  • DomainVerifiedSignup
  • SignupViaInvitation
 Describes a subdivision of the Authentication  operation.
Each schema (based on EventType) documents the list of values valid for this field.
EventResultDetails Recommended Enumerated
  • WrongPassword
  • IpPolicyConflict
  • ClientLocationPolicyConflict
  • ClientPlatformPolicyConflict
  • UserIsDisabledByPolicy
  • ServiceUnavailableInCountry
  • null if EventResult is Success
Additional information about the result of the Authentication event.
EventData Mandatory Dynamic Defined for each EventSubType See Authentication EventData.

Authentication EventData

Field name Class Type Format Description
LoginMethod Optional Enumerated
  • Password
  • TwoFactor
  • SSO
 Authentication method used by the user.
Mandatory if EventSubType is Login.
RevokeMode Optional Enumerated
  • CertRevoke
  • CertRevokeWithDeviceWipe (best effort)
 Whether synchronized folders and files are deleted from the device.
Mandatory if EventSubType is DeviceRevoke.
TargetDeviceName Optional String {device name} Name of the device being registered or revoked.
Mandatory if EventSubType is DeviceRegister or DeviceRevoke.
TargetDeviceId Optional String {device identifier} Unique identifier of the device being registered or revoked.
Mandatory if EventSubType is DeviceRegister or DeviceRevoke.
TargetDeviceType Optional Enumerated
  • Web
  • NativeDesktop
  • NativeMobile
 Type of the device being registered or revoked.
Mandatory if EventSubType is DeviceRegister or DeviceRevoke.
TargetDevicePlatform Optional Enumerated
  • Windows
  • macOS
  • Linux
  • iOS
  • Android
 Platform of the target device.
AdditionalFields Optional Dynamic Defined for each EventSubType See Authentication AdditionalFields.

Authentication AdditionalFields

Event type Event subtype Condition Additional fields
Authentication Login LoginMethod == Password TwoFactorOptions: Totp, Sms, Voice, Email
Enabled two-factor authentication options for the user.
Authentication Login LoginMethod == TwoFactor

SelectedTwoFactorOption: Totp, Sms, Voice, Email
User's selected two-factor authentication option.

TwoFactorOptionTarget: String
Phone number or email address associated with the selected two-factor authentication option.
null if the selected option is Totp.

 

UserActivity event fields

Field name Class Type Format Description
EventSubType Mandatory Enumerated
  • PasswordChange
  • TwoFactorEnable
  • TwoFactorDisable
  • TwoFactorOptionConfig
  • DomainInviteAccept
  • DomainInviteDecline
  • AdvancedControlAccept
 Describes a subdivision of the UserActivity operation.
Each schema (based on EventType) documents the list of values valid for this field.
EventResultDetails Recommended Dynamic N/A Not applicable to this event type.
EventData Mandatory Dynamic Defined for each EventSubType See UserActivity EventData.

UserActivity EventData

Field name Class Type Format Description
AdditionalFields Optional Dynamic Defined for each EventSubType See UserActivity AdditionalFields.

UserActivity AdditionalFields

Event type Event subtype Condition Additional fields
UserActivity TwoFactorOptionConfig Phone number setup, verification, or removal

Action: StartPhoneNumberSetupWithTextMessage, StartPhoneNumberSetupWithVoiceCall, VerifyPhoneNumberWithTextMessage, VerifyPhoneNumberWithVoiceCall, RemovePhoneNumber

PhoneNumber: <phone number>
UserActivity TwoFactorOptionConfig TOTP setup or verification Action: StartTOTPSetup, VerifyTOTPSetup
UserActivity TwoFactorOptionConfig 2FA option enabled or disabled

Action: EnableOption, DisableOption

Option: Totp, Sms, Voice, Email

 

AdminActivity event fields

Field name Class Type Format Description
EventSubType Mandatory Enumerated
  • SIEMEnable
  • SIEMDisable
  • SIEMConfigurationModify
  • AdvancedControlEnable
  • AdvancedControlDisable
  • SSOEnable
  • SSODisable
  • SCIMEnable
  • SCIMDisable
  • CompanyNameEdit
  • DomainCustomization
  • GenerateADConnectorAPIKey
  • RemoveADConnectorAPIKey
  • AddVerifiedEmailDomain
  • RemoveVerifiedEmailDomain
  • SetVerifiedEmailDomainRule
  • NewPolicyTemplate
  • DeletePolicyTemplate
  • ModifyPolicyTemplate
 Describes a subdivision of the AdminActivity operation.
Each schema (based on EventType) documents the list of values valid for this field.
EventResultDetails Recommended Dynamic N/A Not applicable to this event type.
EventData Mandatory Dynamic Defined for each EventSubType See AdminActivity EventData.

AdminActivity EventData

Field name Class Type Format Description
AdditionalFields Optional Dynamic Defined for each EventSubType See AdminActivity AdditionalFields.

AdminActivity AdditionalFields

Event type Event subtype Condition Additional fields
AdminActivity SIEMEnable Always

SentinelWorkspaceId: Target Log Analytics workspace ID used by Microsoft Sentinel.

EnabledLogTypes: Log types sent to Microsoft Sentinel.
AdminActivity SIEMConfigurationModify Always

SentinelWorkspaceId: Target Log Analytics workspace ID used by Microsoft Sentinel.

EnabledLogTypes: Log types sent to Microsoft Sentinel.
AdminActivity SSOEnable Always SsoType: Adfs, AzureAd, Okta, GoogleWs
AdminActivity NewPolicyTemplate Create a new policy template

PolicyName: Name of the created policy template.

PolicyId: Unique identifier of the created policy template.
AdminActivity NewPolicyTemplate Clone an existing policy template

PolicyName: Name of the created policy template.

PolicyId: Unique identifier of the created policy template.

ClonedFromPolicyId: Unique identifier of the source policy template.
AdminActivity CompanyNameEdit

ChangeBillingInfoV3Async: The domain name is currently the old account name

RenameDomainAsync: Always

OriginalCompanyName: Original company name before renaming.

NewCompanyName: New company name after renaming.
AdminActivity CompanyNameEdit RenameDomainAsync

OriginalCompanyName: Original company name before renaming.

NewCompanyName: New company name after renaming.
AdminActivity AddVerifiedEmailDomain Always

EmailDomain: Added email domain.
ValidationMethod: DnsTxt, Email

Status: Pending, Completed
AdminActivity RemoveVerifiedEmailDomain Always EmailDomain: Removed email domain.
AdminActivity SetVerifiedEmailDomainRule Always

EmailDomain: Configured verified email domain.

AutoAssignmentSettings: Configured AutoAssignmentRuleEnum value as a string.
AdminActivity ModifyPolicyTemplate Always, unless called from CloneGroupSettingsCoreAsync

OriginalTemplate: Policy configuration JSON before modification.

NewTemplate: Policy configuration JSON after modification.
AdminActivity ModifySubscription Always

OldMainSubscription:
PlanName: Enterprise or Enterprise Annual
SeatCount: integer
PeriodType: month or year

NewMainSubscription:
PlanName: Enterprise or Enterprise Annual
SeatCount: integer
PeriodType: month or year

 

DomainUserManagement event fields

Field name Class Type Format Description
EventSubType Mandatory Enumerated
  • UserInvite
  • UserAutoAdd
  • UserRemove
  • UserWipe
  • UserSuspend
  • UserUnsuspend
  • RoleChange
  • PolicyAssign
  • PasswordReset
  • TwoFactorDisable
  • DeviceRevoke
  • DataOwnershipTransfer
 Describes a subdivision of the DomainUserManagement operation.
Each schema (based on EventType) documents the list of values valid for this field.
EventResultDetails Recommended Dynamic N/A Not applicable to this event type.
EventData Mandatory Dynamic Defined for each EventSubType See DomainUser-Management EventData.

DomainUserManagement EventData

Field name Class Type Format Description
TargetUserId Optional String {uuid_v4} Unique identifier of the target user.
Mandatory unless EventSubType is DomainInvite.
TargetUserEmail Optional String {email address} Email address of the target user.
Mandatory unless EventSubType is DomainInvite (GDPR).
TargetUserFirstName Optional String {first name} First name of the target user.
TargetUserLastName Optional String {last name} Last name of the target user.
TargetUserRole Mandatory Enumerated
  • Owner
  • Co-Owner
  • Administrator
  • Member
 The target user's role in the subscription.
TargetUserNewRole Optional Enumerated
  • Owner
  • Co-Owner
  • Administrator
  • Member
 The target user's new role in the subscription.
Mandatory if EventSubType is RoleChange.
TargetUserPolicyId Optional String {uuid_v4} Unique identifier of the target user's current policy.
Mandatory if EventSubType is PolicyAssign.
TargetUserPolicy Optional String {name of old policy} Name of the target user's current policy.
Mandatory if EventSubType is PolicyAssign.
TargetUserNewPolicyId Optional String {uuid_v4} Unique identifier of the target user's new policy.
Mandatory if EventSubType is PolicyAssign.
TargetUserNewPolicy Optional String {name of new policy} Name of the target user's new policy.
Mandatory if EventSubType is PolicyAssign.
TargetDeviceName Optional String {device name} Name of the device being revoked.
Mandatory if EventSubType is DeviceRevoke.
TargetDeviceId Optional String {device identifier} Unique identifier of the device being revoked.
Mandatory if EventSubType is DeviceRevoke.
TargetDeviceType Optional Enumerated
  • Web
  • NativeDesktop
  • NativeMobile
 Type of the device being revoked.
Mandatory if EventSubType is DeviceRevoke.
TargetDevicePlatform Optional Enumerated
  • Windows
  • macOS
  • Linux
  • iOS
  • Android
 Platform of the device being revoked.
AdditionalFields Optional Dynamic Defined for each EventSubType See DomainUser-Management AdditionalFields.

DomainUserManagement AdditionalFields

Event type Event subtype Condition Additional fields
DomainUserManagement DataOwnershipTransfer Always

SourceUserId: Unique identifier of the previous owner.

SourceUserRole: Role of the previous owner.

SourceContainerId: Unique identifier of the transferred container.
DomainUserManagement TwoFactorOptionConfig 2FA option enabled or disabled

Action: EnableOption, DisableOption

Option: Totp, Sms, Voice, Email
Was this article helpful?
1 out of 1 found this helpful

Related articles