Pre-made baselines
Three cumulative starting points for Microsoft environments. Each download is a Log Horizon-compatible layer built from the current baseline catalog.
Minimum
Core Microsoft identity, Sentinel, Azure control-plane, and Microsoft 365 audit coverage.
Use this as a starting floor when the listed services are present. It favors broadly useful investigation records over comprehensive telemetry.
Included dataAlertAuditAuthentication and sign-in
Interactive authentication is the starting point for account access investigations.
Directory changes expose role, application, group, and policy modifications.
Identity Protection risk state adds prioritized identity context.
Individual risk detections explain why an identity was flagged.
Connected Microsoft security products surface detections through Sentinel alerts.
Incident records preserve correlation and investigation state.
Azure control-plane changes cover resource and access administration.
Microsoft 365 audit activity covers common user and administrative actions.
Recommended
Adds Microsoft Graph, common Azure resource logs, and behavior analytics.
Use this when the relevant products and Azure services are deployed. Resource-specific tables should only be enabled for resources that exist in the environment.
Includes every table from Minimum
Included dataAlertAuditAuthentication and sign-inData accessDiagnosticSecurity eventStorage access
Interactive authentication is the starting point for account access investigations.
Directory changes expose role, application, group, and policy modifications.
Identity Protection risk state adds prioritized identity context.
Individual risk detections explain why an identity was flagged.
Connected Microsoft security products surface detections through Sentinel alerts.
Incident records preserve correlation and investigation state.
Azure control-plane changes cover resource and access administration.
Microsoft 365 audit activity covers common user and administrative actions.
Microsoft Graph requests expose application and tenant API activity.
The shared diagnostics table covers Azure resources that do not yet use resource-specific tables.
Key Vault audit events record access to secrets, keys, and certificates.
Azure Firewall threat intelligence records network decisions tied to known indicators.
Application Gateway WAF events add web attack and enforcement context.
Blob access logs cover common data access and exfiltration investigations.
SQL audit events expose database access and administrative activity.
User and entity behavior analytics adds anomaly context.
Plus
Adds every Entra table in the catalog and broader Sentinel behavior data.
Use this for investigations that need wider identity and behavior context. Several additions can be high volume and may fit the data lake tier.
Includes every table from Recommended
Included dataAlertAuditAuthentication and sign-inData accessDiagnosticHealthSecurity eventStorage access
Interactive authentication is the starting point for account access investigations.
Directory changes expose role, application, group, and policy modifications.
Identity Protection risk state adds prioritized identity context.
Individual risk detections explain why an identity was flagged.
Connected Microsoft security products surface detections through Sentinel alerts.
Incident records preserve correlation and investigation state.
Azure control-plane changes cover resource and access administration.
Microsoft 365 audit activity covers common user and administrative actions.
Microsoft Graph requests expose application and tenant API activity.
The shared diagnostics table covers Azure resources that do not yet use resource-specific tables.
Key Vault audit events record access to secrets, keys, and certificates.
Azure Firewall threat intelligence records network decisions tied to known indicators.
Application Gateway WAF events add web attack and enforcement context.
Blob access logs cover common data access and exfiltration investigations.
SQL audit events expose database access and administrative activity.
User and entity behavior analytics adds anomaly context.
Non-interactive (token refresh, broker) sign-in events; extremely high volume but useful for token abuse detection
Service principal and application sign-in events from Entra ID for OAuth and API authentication
Managed identity sign-in events from Azure resources authenticating to Entra ID
User and group provisioning events showing sync operations between Entra ID and connected systems
Service principals flagged as risky by Entra ID Identity Protection
Individual risk detection events for service principals such as suspicious credential usage
AD FS sign-in events from federated authentication through Active Directory Federation Services
Sign-in logs for Microsoft first-party application service principals authenticating in the tenant
Legacy Azure AD Graph API request activity against tenant directory resources, useful for tracking deprecated API usage and enumeration
Microsoft Graph change notification delivery logs for webhook subscriptions in the tenant
Entra ID Protection risky agent identities (Agent ID) with risk level, risk state and remediation detail
Entra ID Protection risk detections for agent identities such as unfamiliar resource access, sign-in spikes and failed access attempts
Entra audit events for custom security attribute definition and assignment changes (add, update, delete)
Sentinel behavior records preserve generated behavior detections.
Behavior entities connect generated behaviors to affected assets.
Download the closest level, review its tables against the services you operate, then load it as a custom baseline layer. Tenant evidence and detection dependencies take precedence.