--- title: Azure fields description: Azure Module Resource Fields for Azure activity logs. Identity Claims initiated by user Authorization Evidence Fields for Azure audit logs. The audit... url: https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/filebeat/exported-fields-azure products: - Beats - Filebeat applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Generally available --- # Azure fields Azure Module ## azure Azure subscription ID type: keyword Correlation ID type: keyword tenant ID type: keyword ## resource Resource Resource ID type: keyword Resource group type: keyword Resource type/namespace type: keyword Resource type/namespace type: keyword Name type: keyword Authorization rule type: keyword ## activitylogs Fields for Azure activity logs. identity name type: keyword ## identity Identity ## claims_initiated_by_user Claims initiated by user Name type: keyword Givenname type: keyword Surname type: keyword Fullname type: keyword Schema type: keyword Claims type: object ## authorization Authorization Scope type: keyword Action type: keyword ## evidence Evidence Role assignment scope type: keyword Role definition ID type: keyword Role type: keyword Role assignment ID type: keyword Principal ID type: keyword Principal type type: keyword Tenant ID type: keyword Level type: long Operation version type: keyword Operation name type: keyword Result type type: keyword Result signature type: keyword Category type: keyword Event Category type: keyword Properties type: flattened ## auditlogs Fields for Azure audit logs. The category of the operation. Currently, Audit is the only supported value. type: keyword The operation name type: keyword The operation version type: keyword Identity type: keyword Tenant ID type: keyword Result signature type: keyword ## properties The audit log properties Log result type: keyword Activity display name type: keyword Reason for the log result type: keyword Correlation ID type: keyword Logged by service type: keyword Operation type type: keyword ID type: keyword Activity timestamp type: date category type: keyword ## target_resources.* Target resources Display name type: keyword ID type: keyword Type type: keyword ip Address type: keyword User principal name type: keyword ## modified_properties.* Modified properties New value type: keyword Display value type: keyword Old value type: keyword ## initiated_by Information regarding the initiator ## app App Service principal name type: keyword Display name type: keyword App ID type: keyword Service principal ID type: keyword ## user User User principal name type: keyword Display name type: keyword ID type: keyword ip Address type: keyword ## platformlogs Fields for Azure platform logs. Operation name type: keyword Result type type: keyword Result signature type: keyword Category type: keyword Event Category type: keyword Status type: keyword ccpNamespace type: keyword Cloud type: keyword Environment type: keyword EventTimeString type: keyword Caller type: keyword ScaleUnit type: keyword ActivityId type: keyword Identity name type: keyword Event inner properties type: flattened ## signinlogs Fields for Azure sign-in logs. The operation name type: keyword The operation version type: keyword Tenant ID type: keyword Result signature type: keyword Result description type: keyword Result type type: keyword Identity type: keyword Category type: keyword Unique ID representing the sign-in activity. type: keyword Date and time (UTC) the sign-in was initiated. type: date User display name type: keyword Correlation ID type: keyword User principal name type: keyword User ID type: keyword App ID type: keyword App display name type: keyword Autonomous system number. type: long Client app used type: keyword Conditional access status type: keyword Original request ID type: keyword Is interactive type: boolean Token issuer name type: keyword Token issuer type type: keyword Processing time in milliseconds type: float Risk detail type: keyword Risk level aggregated type: keyword Risk level during signIn type: keyword Risk state type: keyword Resource display name type: keyword Error code type: long Device ID type: keyword Operating system type: keyword Browser type: keyword Display name type: keyword Trust type type: keyword If the device is compliant type: boolean If the device is managed type: boolean A list of conditional access policies that are triggered by the corresponding sign-in activity. type: array The result of the authentication attempt and additional details on the authentication method. type: array Additional authentication processing details, such as the agent name in case of PTA/PHS or Server/farm name in case of federated authentication. type: flattened Authentication protocol type. type: keyword Incoming token type. type: keyword Unique token identifier for the request. type: keyword This holds the highest level of authentication needed through all the sign-in steps, for sign-in to succeed. type: keyword Set of CA policies that apply to this sign-in, each as CA: policy name, and/or MFA: Per-user type: flattened type: boolean type: keyword The network location details including the type of network used and its names. type: array The identifier of the resource that the user signed in to. type: keyword type: keyword The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue. type: keyword The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue. type: keyword The application name used for sign-in. This field is populated when you are signing in using an application. type: keyword type: keyword The application identifier used for sign-in. This field is populated when you are signing in using an application. type: keyword type: keyword type: boolean type: keyword