Log baseline for Microsoft Sentinel
Explore the generic Microsoft Sentinel log baseline by domain, table, tier, and retention. Each cell is a table. Click one to find it.
- Primary
- 589
- Analytics tier
- 406
- Field references
- 19,306
Four places a table can land
| AnalyticsNear-real-time detection, join targets, or no lake support. | Data lakeHigh-volume aggregation or investigation context. | |
|---|---|---|
| PrimarySecurity events and the context detections depend on. | Primary + Analytics350tables classified primary with the Analytics tier High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold. | Primary + Data lake239tables classified primary with the Data lake tier High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations. ExamplesTailscale_Network_CLDeviceImageLoadEventsAzureNetworkAnalytics_CL |
| SecondaryHealth, inventory, and reference data. | Secondary + Analytics56tables classified secondary with the Analytics tier Context that analytics-tier detections or Sentinel features join against, or context tables the lake cannot hold. | Secondary + Data lake128tables classified secondary with the Data lake tier Operational and reference context. ExamplesDeviceFileCertificateInfoUnifi_SiteManager_Devices_CLUnifi_SiteManager_Sites_CL |
Classification records security value and tier records where the data lives, and the methodology shows the rules behind each cell.
Baseline dataset
Showing 1-25 of 773
| Select |
|---|
No tables match these filters.