Microsoft Sentinel event schema

Question

Microsoft Sentinel event schema

Updated July 07, 2026 11:01

Accepted Answer

Root-level fields are present in the logs for all event types.
Some root-level fields, such as ActorDetails and Location, are dynamic objects with their own field definitions.
EventResultDetails is currently defined only for Authentication events. For all other event types, its value is null.
Some event types include a dynamic EventData field. Its structure depends on the corresponding EventType and EventSubType.
Some EventData definitions also include AdditionalFields. These fields are included only when the specified conditions are met.

Root-level event fields

Field name	Class	Type	Format	Description
TimeGenerated	Mandatory	Datetime	Datetime	The time the event was sent to the Log Analytics workspace.
SchemaVersion	Mandatory	String	2.0.0	The version of the event schema.
ActorUserEmail	Mandatory	String	{email address}	The user's email address.
ActorUserIsExternal	Mandatory	Boolean	True False	Whether the user belongs to the subscription domain.
ActorDetails	Mandatory	Dynamic	Depends on ActorDetails	See ActorDetails.
EventType	Mandatory	Enumerated	Authentication UserActivity AdminActivity DomainUserManagement	The type of operation reported by the event.
EventSubType	Mandatory	Enumerated	Defined by EventType	The subtype of the operation.
EventTimestamp	Mandatory	Datetime	{ISO-8601 formatted timestamp}	The time the reporting device generated the event.
EventResult	Mandatory	Enumerated	Success Failure Partial	The result of the event.
EventResultDetails	Recommended	Enumerated /null	Defined by EventType	Additional details about the event result.
EventData	Mandatory	Dynamic	Defined by EventType	Event-specific data.
Location	Mandatory	Dynamic	Depends on Location	See Location.

ActorDetails

Field name	Class	Type	Format	Description
ActorUserId	Recommended	String	{uuid_v4}	The user's unique identifier.
ActorUserFirstName	Recommended	String	{first name}	The user's first name.
ActorUserLastName	Recommended	String	{last name}	The user's last name.
ActorUserRole	Recommended	Enumerated	Owner Co-Owner Administrator Member	The user's role in the subscription.
ActorSessionId	Recommended	String	[a-z0-9]{64}	The user's session identifier. SHA256("TresoritSIEM" + {SessionId})
ActorUserDomainId	Recommended	String	{uuid_v4}	The unique identifier of the user's domain.
ActorUserDomainName	Recommended	String	{organization name}	The name of the user's subscription organization.
ActorDeviceName	Recommended	String	{device name}	The name of the device or web session where the event originated.
ActorDeviceId	Recommended	String	[a-zA-Z0-9]{32}	The device's unique identifier.
ActorDeviceType	Recommended	Enumerated	Web NativeDesktop NativeMobile	The client type.
ActorDevicePlatform	Recommended	Enumerated	Windows macOS Linux iOS Android	The device's platform.
ActorDeviceIpAddress	Recommended	IP address	{ipv4}	The device's IP address.
ClientAgent	Recommended	String	{ClientVersionNumber}({ClientType}; {ClientId})	Tresorit-specific client information.
HttpUserAgent	Recommended	String	{BrowserInformation} ({SystemInformation}) {platform} ({platform-details}) {extensions}	The HTTP User-Agent header from the original request.

Location

Field name	Class	Type	Format	Description
GeolocationCountry	Recommended	String	{country}	The approximate country based on the originating IP address.
GeolocationRegion	Recommended	String	{region}	The approximate region based on the originating IP address.
GeolocationCity	Recommended	String	{city}	The approximate city based on the originating IP address.
GeolocationLongitude	Recommended	Longitude	^-?([0-9]{1,2}\|1[0-7][0-9]\|180)(\.[0-9]{1,10})$	The approximate longitude based on the originating IP address.
GeolocationLatitude	Recommended	Latitude	^-?([0-8]?[0-9]\|90)(\.[0-9]{1,10})$	The approximate latitude based on the originating IP address.

Authentication event fields

Field name	Class	Type	Format	Description
EventSubType	Mandatory	Enumerated	Login Logout DeviceRegister DeviceRevoke DomainVerifiedSignup SignupViaInvitation	The Authentication event subtype.
EventResultDetails	Recommended	Enumerated	WrongPassword IpPolicyConflict ClientLocationPolicyConflict ClientPlatformPolicyConflict UserIsDisabledByPolicy ServiceUnavailableInCountry null if EventResult is Success	Additional details about the event result.
EventData	Mandatory	Dynamic	Depends on EventData	See Authentication EventData.

Authentication EventData

Field name	Class	Type	Format	Description
LoginMethod	Optional	Enumerated	Password TwoFactor SSO	The user's authentication method. Mandatory if EventSubType is Login.
RevokeMode	Optional	Enumerated	CertRevoke CertRevokeWithDeviceWipe (best effort)	Whether synchronized folders and files are deleted from the device. Mandatory if EventSubType is DeviceRevoke.
TargetDeviceName	Optional	String	{device name}	The target device's name. Mandatory if EventSubType is DeviceRegister or DeviceRevoke.
TargetDeviceId	Optional	String	{device identifier}	The target device's unique identifier. Mandatory if EventSubType is DeviceRegister or DeviceRevoke.
TargetDeviceType	Optional	Enumerated	Web NativeDesktop NativeMobile	The target device's type. Mandatory if EventSubType is DeviceRegister or DeviceRevoke.
TargetDevicePlatform	Optional	Enumerated	Windows macOS Linux iOS Android	The target device's platform.
AdditionalFields	Optional	Dynamic	Depends on AdditionalFields	See Authentication AdditionalFields.

Authentication AdditionalFields

Event type

Event subtype

Condition

Additional fields

Authentication

Login

LoginMethod == Password

TwoFactorOptions: Totp, Sms, Voice, Email
The user's enabled two-factor authentication options.

Authentication

Login

LoginMethod == TwoFactor

SelectedTwoFactorOption: Totp, Sms, Voice, Email
The user's selected two-factor authentication option.

TwoFactorOptionTarget: string
The phone number or email address associated with the selected two-factor authentication option.
null if the selected option is Totp.

User activity event fields

Field name	Class	Type	Format	Description
EventSubType	Mandatory	Enumerated	SIEMEnable SIEMDisable SIEMConfigurationModify AdvancedControlEnable AdvancedControlDisable SSOEnable SSODisable SCIMEnable SCIMDisable CompanyNameEdit DomainCustomization GenerateADConnectorAPIKey RemoveADConnectorAPIKey AddVerifiedEmailDomain RemoveVerifiedEmailDomain SetVerifiedEmailDomainRule NewPolicyTemplate DeletePolicyTemplate ModifyPolicyTemplate	The subdivision of the operation Admin.
EventResultDetails	Recommended	Dynamic	N/A	Not applicable to this event type.
EventData	Mandatory	Dynamic	User activity EventData	See User activity EventData.

User activity EventData

Field name	Class	Type	Format	Description
AdditionalFields	Optional	Dynamic	Depends on AdditionalFields	See User activity AdditionalFields.

User activity AdditionalFields

Event type	Event subtype	Condition	Additional fields
UserActivity	TwoFactorOptionConfig	Phone number setup, verification, or removal	Action: StartPhoneNumberSetupWithTextMessage,StartPhoneNumberSetupWithVoiceCall,VerifyPhoneNumberWithTextMessage,VerifyPhoneNumberWithVoiceCall,RemovePhoneNumber PhoneNumber: <phone number>
UserActivity	TwoFactorOptionConfig	TOTP setup or verification	Action: StartTOTPSetup, VerifyTOTPSetup
UserActivity	TwoFactorOptionConfig	Two-factor authentication option enabled or disabled	Action: EnableOption, DisableOption Option: Sms, Voice, Email, Totp

Admin activity event fields

Field name	Class	Type	Format	Description
EventSubType	Mandatory	Enumerated	SIEMEnable SIEMDisable SIEMConfigurationModify AdvancedControlEnable AdvancedControlDisable SSOEnable SSODisable SCIMEnable SCIMDisable CompanyNameEdit DomainCustomization GenerateADConnectorAPIKey RemoveADConnectorAPIKey AddVerifiedEmailDomain RemoveVerifiedEmailDomain SetVerifiedEmailDomainRule NewPolicyTemplate DeletePolicyTemplate ModifyPolicyTemplate	The Admin activity event subtype.
EventResultDetails	Recommended	Dynamic	N/A	Not applicable to this event type.
EventData	Mandatory	Dynamic	Depends on EventData	See Admin activity EventData.

Admin activity EventData

Field name	Class	Type	Format	Description
AdditionalFields	Optional	Dynamic	Depends on AdditionalFields	See Admin activity AdditionalFields.

Admin activity AdditionalFields

Event type	Event subtype	Condition	Additional fields
AdminActivity	SIEMEnable	Always	SentinelWorkspaceId: Target Log Analytics workspace ID. EnabledLogTypes: Log types forwarded to Microsoft Sentinel.
AdminActivity	SIEMConfigurationModify	Always	SentinelWorkspaceId: Target Log Analytics workspace ID. EnabledLogTypes: Log types forwarded to Microsoft Sentinel.
AdminActivity	SSOEnable	Always	SsoType: Adfs, AzureAd, Okta, GoogleWs
AdminActivity	NewPolicyTemplate	Create a new policy template	PolicyName: Name of the created policy template. PolicyId: Unique identifier of the created policy template.
AdminActivity	NewPolicyTemplate	Clone an existing policy template	PolicyName: Name of the created policy template. PolicyId: Unique identifier of the created policy template. ClonedFromPolicyId: Unique identifier of the source policy template.
AdminActivity	CompanyNameEdit	ChangeBillingInfoV3Async	OriginalCompanyName: Original company name before renaming. NewCompanyName: New company name after renaming.
AdminActivity	CompanyNameEdit	RenameDomainAsync	OriginalCompanyName: Original company name before renaming. NewCompanyName: New company name after renaming.
AdminActivity	AddVerifiedEmailDomain	Always	EmailDomain: Added email domain. ValidationMethod: DnsTxt, Email. Status: Pending, Completed.
AdminActivity	RemoveVerifiedEmailDomain	Always	EmailDomain: Removed email domain.
AdminActivity	SetVerifiedEmailDomainRule	Always	EmailDomain: Configured verified email domain. AutoAssignmentSettings: Auto-assignment rule value.
AdminActivity	ModifyPolicyTemplate	Always, unless called from CloneGroupSettingsCoreAsync	OriginalTemplate: Policy configuration before modification. NewTemplate: Policy configuration after modification.
AdminActivity	ModifySubscription	Always	OldMainSubscription: Previous subscription details (PlanName, SeatCount, PeriodType). NewMainSubscription: Updated subscription details (PlanName, SeatCount, PeriodType).

Domain user management event fields

Field name	Class	Type	Format	Description
EventSubType	Mandatory	Enumerated	UserInvite UserAutoAdd UserRemove UserWipe UserSuspend UserUnsuspend RoleChange PolicyAssign PasswordReset TwoFactorDisable DeviceRevoke DataOwnershipTransfer	The subdivision of the operation DomainUserManagement.
EventResultDetails	Recommended	Dynamic	N/A	Additional conditional event details for Admin activity.
EventData	Mandatory	Dynamic	Depends on EventData	See Domain user management EventData.

Domain user management EventData

Field name	Class	Type	Format	Description
TargetUserId	Optional	String	{uuid_v4}	The target user's unique identifier. Mandatory unless EventSubType is DomainInvite.
TargetUserEmail	Optional	String	{email address}	The target user's email address. Mandatory unless EventSubType is DomainInvite (GDPR).
TargetUserFirstName	Optional	String	{first name}	The target user's first name.
TargetUserLastName	Optional	String	{last name}	The target user's last name.
TargetUserRole	Mandatory	Enumerated	Owner Co-Owner Administrator Member	The target user's role in the subscription.
TargetUserNewRole	Optional	Enumerated	Owner Co-Owner Administrator Member	The target user's new role in the subscription. Mandatory if EventSubType is RoleChange.
TargetUserPolicyId	Optional	String	{uuid_v4}	The target user's current policy identifier. Mandatory if EventSubType is PolicyAssign.
TargetUserPolicy	Optional	String	{name of old policy}	The target user's current policy name. Mandatory if EventSubType is PolicyAssign.
TargetUserNewPolicyId	Optional	String	{uuid_v4}	The target user's new policy identifier. Mandatory if EventSubType is PolicyAssign.
TargetUserNewPolicy	Optional	String	{name of new policy}	The target user's new policy name. Mandatory if EventSubType is PolicyAssign.
TargetDeviceName	Optional	String	{device name}	The target device's name. Mandatory if EventSubType is DeviceRevoke.
TargetDeviceId	Optional	String	{device identifier}	The target device's unique identifier. Mandatory if EventSubType is DeviceRevoke.
TargetDeviceType	Optional	Enumerated	Web NativeDesktop NativeMobile	The target device's type. Mandatory if EventSubType is DeviceRevoke.
TargetDevicePlatform	Optional	Enumerated	Windows macOS Linux iOS Android	The target device's platform.
AdditionalFields	Optional	Dynamic	Depends on AdditionalFields	See Domain user management AdditionalFields.

Domain user management AdditionalFields

Event type

Event subtype

Condition

Additional fields

DomainUserManagement

DataOwnershipTransfer

Always

SourceUserId: Unique identifier of the previous owner.

SourceUserRole: Role of the previous owner.

SourceContainerId: Unique identifier of the transferred container.

DomainUserManagement

TwoFactorOptionConfig

Two-factor authentication option enabled or disabled

Action: EnableOption, DisableOption

Option: Sms, Voice, Email, Totp