[
  {
    "tableName": "SigninLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C2",
    "category": "Identity & Access",
    "description": "Interactive user sign-in events from Microsoft Entra ID including MFA, conditional access, and location",
    "keywords": [
      "sign-in",
      "login",
      "authentication",
      "entra",
      "aad",
      "mfa",
      "conditional access",
      "identity"
    ],
    "mitreSources": [
      "User Account: Authentication",
      "Logon Session: Logon Session Creation"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "medium",
    "volumeDriver": "sign-in",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AuditLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C3",
    "category": "Identity & Access",
    "description": "Entra ID directory audit events including user, group, role, and application changes",
    "keywords": [
      "audit",
      "entra",
      "aad",
      "directory",
      "role",
      "group",
      "application",
      "identity"
    ],
    "mitreSources": [
      "User Account: User Account Modification",
      "Active Directory: Active Directory Object Modification",
      "Group: Group Modification"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "medium",
    "volumeDriver": "admin-action",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADRiskyUsers",
    "connector": "Microsoft Entra ID Identity Protection",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Identity & Access",
    "description": "Users flagged as risky by Entra ID Identity Protection based on aggregated risk signals",
    "keywords": [
      "risky",
      "users",
      "identity protection",
      "entra",
      "aad",
      "risk",
      "compromise"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADUserRiskEvents",
    "connector": "Microsoft Entra ID Identity Protection",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Identity & Access",
    "description": "Individual risk detection events such as leaked credentials, anonymous IP sign-ins, and impossible travel",
    "keywords": [
      "risk",
      "events",
      "identity protection",
      "leaked credentials",
      "impossible travel",
      "entra",
      "aad"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "SecurityAlert",
    "connector": "Microsoft Sentinel (various)",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Security Alerts",
    "description": "Aggregated security alerts from all connected Microsoft and third-party providers",
    "keywords": [
      "alerts",
      "detections",
      "incidents",
      "security",
      "sentinel"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": true,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "security-operations",
    "logTypeId": "alert"
  },
  {
    "tableName": "SecurityIncident",
    "connector": "Microsoft Sentinel",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Security Alerts",
    "description": "Sentinel incidents created from correlated alerts and manual escalation",
    "keywords": [
      "incidents",
      "cases",
      "sentinel",
      "triage",
      "soc"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "platform": true,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules",
      "microsoft-learn-log-billing"
    ],
    "domainId": "security-operations",
    "logTypeId": "alert"
  },
  {
    "tableName": "AzureActivity",
    "connector": "Azure Activity Log",
    "classification": "primary",
    "valueRule": "C3",
    "category": "Cloud Control Plane",
    "description": "Azure subscription-level management events including resource CRUD, RBAC changes, and service health",
    "keywords": [
      "azure",
      "activity",
      "arm",
      "management",
      "resource",
      "rbac",
      "control plane"
    ],
    "mitreSources": [
      "Cloud Service: Cloud Service Modification"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "medium",
    "volumeDriver": "admin-action",
    "isFree": true,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "cloud",
    "logTypeId": "audit"
  },
  {
    "tableName": "OfficeActivity",
    "connector": "Microsoft 365",
    "classification": "primary",
    "valueRule": "C6",
    "category": "Cloud Control Plane",
    "description": "Office 365 audit events covering Exchange, SharePoint, OneDrive, and Teams user and admin activities",
    "keywords": [
      "office",
      "365",
      "sharepoint",
      "exchange",
      "teams",
      "onedrive",
      "audit"
    ],
    "mitreSources": [
      "Application Log: Application Log Content"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "high",
    "volumeDriver": "activity",
    "isFree": true,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "cloud",
    "logTypeId": "audit"
  },
  {
    "tableName": "MicrosoftGraphActivityLogs",
    "connector": "Microsoft Graph Activity Logs",
    "classification": "primary",
    "valueRule": "C7",
    "category": "Identity & Access",
    "description": "Microsoft Graph API request activity logs showing API calls made by applications and users",
    "keywords": [
      "graph",
      "api",
      "activity",
      "microsoft",
      "application",
      "request"
    ],
    "mitreSources": [
      "Application Log: Application Log Content"
    ],
    "recommendedTier": "datalake",
    "tierRule": "T3",
    "volumeClass": "very-high",
    "volumeDriver": "api-request",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AzureDiagnostics",
    "connector": "Azure Diagnostic Settings (legacy Azure Diagnostics mode)",
    "classification": "primary",
    "valueRule": "C5",
    "category": "Infrastructure Diagnostics",
    "description": "Consolidated diagnostic logs from Azure resources including Key Vault, SQL, App Gateway, and more. Legacy collection mode with a 500-column cap; prefer resource-specific tables (AZFW*, AGW*, AKS*, AZKVAuditLogs) where the service offers them",
    "keywords": [
      "diagnostics",
      "azure",
      "resource",
      "key vault",
      "sql",
      "app gateway"
    ],
    "mitreSources": [
      "Cloud Service: Cloud Service Modification",
      "Network Traffic: Network Traffic Flow"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T5",
    "volumeClass": "high",
    "volumeDriver": "application-trace",
    "isFree": false,
    "recommendedRetentionDays": 180,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "microsoft-learn-table-features",
      "log-baseline-classification-rules",
      "azure-sentinel-rule-corpus",
      "acsc-priority-logs-siem",
      "cisa-m-21-31-guidance"
    ],
    "domainId": "infrastructure-platform",
    "logTypeId": "diagnostic"
  },
  {
    "tableName": "AZKVAuditLogs",
    "connector": "Azure Key Vault",
    "classification": "primary",
    "valueRule": "C7",
    "category": "Cloud Control Plane",
    "description": "Azure Key Vault data plane audit events for secret, key and certificate operations with caller identity and result",
    "keywords": [
      "key",
      "vault",
      "secret",
      "certificate",
      "audit",
      "access"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "medium",
    "volumeDriver": "data-access",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "cloud",
    "logTypeId": "audit"
  },
  {
    "tableName": "AZFWThreatIntel",
    "connector": "Azure Firewall",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Network Security",
    "description": "Azure Firewall threat intelligence hits indicating known malicious IP/domain connections",
    "keywords": [
      "firewall",
      "threat intelligence",
      "azure firewall",
      "malicious",
      "ioc"
    ],
    "mitreSources": [
      "Network Traffic: Network Traffic Flow"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "network",
    "logTypeId": "security-event"
  },
  {
    "tableName": "AGWFirewallLogs",
    "connector": "Azure Application Gateway WAF",
    "classification": "primary",
    "valueRule": "C5",
    "category": "Network Security",
    "description": "Azure Application Gateway WAF logs with OWASP rule matches, blocked requests, and web attack detections",
    "keywords": [
      "application gateway",
      "waf",
      "firewall",
      "owasp",
      "sql injection",
      "xss",
      "web attack"
    ],
    "mitreSources": [
      "Network Traffic: Network Traffic Content"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "high",
    "volumeDriver": "web-request",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "network",
    "logTypeId": "security-event"
  },
  {
    "tableName": "StorageBlobLogs",
    "connector": "Azure Storage Account",
    "classification": "primary",
    "valueRule": "C7",
    "category": "Storage Access",
    "description": "Azure Blob Storage access logs including read, write, and delete operations on blobs and containers",
    "keywords": [
      "storage",
      "blob",
      "access",
      "azure",
      "data",
      "exfiltration"
    ],
    "mitreSources": [
      "Cloud Storage: Cloud Storage Access"
    ],
    "recommendedTier": "datalake",
    "tierRule": "T3",
    "volumeClass": "very-high",
    "volumeDriver": "data-access",
    "isFree": false,
    "recommendedRetentionDays": 180,
    "sourceIds": [
      "log-horizon-classifications",
      "acsc-priority-logs-siem",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "data-security",
    "logTypeId": "storage-access"
  },
  {
    "tableName": "SQLSecurityAuditEvents",
    "connector": "Azure SQL Database",
    "classification": "primary",
    "valueRule": "C7",
    "category": "Data Platform",
    "description": "Azure SQL Database and Managed Instance auditing events with statement, principal, client IP and success flag",
    "keywords": [
      "sql",
      "database",
      "audit",
      "statement",
      "login",
      "principal"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "high",
    "volumeDriver": "data-access",
    "isFree": false,
    "recommendedRetentionDays": 180,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "data-security",
    "logTypeId": "data-access"
  },
  {
    "tableName": "BehaviorAnalytics",
    "connector": "Microsoft Sentinel UEBA",
    "classification": "primary",
    "valueRule": "C8",
    "category": "Identity & Access",
    "description": "User and Entity Behavior Analytics results showing anomalous activities and risk scores",
    "keywords": [
      "ueba",
      "behavior",
      "analytics",
      "anomaly",
      "risk",
      "user"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "high",
    "volumeDriver": "activity",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADNonInteractiveUserSignInLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C2",
    "category": "Identity & Access",
    "description": "Non-interactive (token refresh, broker) sign-in events; extremely high volume but useful for token abuse detection",
    "keywords": [
      "sign-in",
      "non-interactive",
      "token",
      "entra",
      "aad",
      "identity",
      "refresh"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "datalake",
    "tierRule": "T3",
    "volumeClass": "very-high",
    "volumeDriver": "token-sign-in",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "acsc-priority-logs-siem",
      "cisa-m-21-31-guidance",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADServicePrincipalSignInLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C2",
    "category": "Identity & Access",
    "description": "Service principal and application sign-in events from Entra ID for OAuth and API authentication",
    "keywords": [
      "service principal",
      "app",
      "sign-in",
      "oauth",
      "entra",
      "aad",
      "identity"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "datalake",
    "tierRule": "T3",
    "volumeClass": "high",
    "volumeDriver": "token-sign-in",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "acsc-priority-logs-siem",
      "cisa-m-21-31-guidance",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADManagedIdentitySignInLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C2",
    "category": "Identity & Access",
    "description": "Managed identity sign-in events from Azure resources authenticating to Entra ID",
    "keywords": [
      "managed identity",
      "sign-in",
      "azure",
      "entra",
      "aad",
      "identity"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "datalake",
    "tierRule": "T3",
    "volumeClass": "high",
    "volumeDriver": "token-sign-in",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "acsc-priority-logs-siem",
      "cisa-m-21-31-guidance",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADProvisioningLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C3",
    "category": "Identity & Access",
    "description": "User and group provisioning events showing sync operations between Entra ID and connected systems",
    "keywords": [
      "provisioning",
      "sync",
      "scim",
      "entra",
      "aad",
      "identity"
    ],
    "mitreSources": [
      "User Account: User Account Creation",
      "User Account: User Account Modification"
    ],
    "recommendedTier": "datalake",
    "tierRule": "T4",
    "volumeClass": "medium",
    "volumeDriver": "admin-action",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "acsc-priority-logs-siem",
      "cisa-m-21-31-guidance",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADRiskyServicePrincipals",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Identity & Access",
    "description": "Service principals flagged as risky by Entra ID Identity Protection",
    "keywords": [
      "risky",
      "service principal",
      "identity protection",
      "entra",
      "aad"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADServicePrincipalRiskEvents",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Identity & Access",
    "description": "Individual risk detection events for service principals such as suspicious credential usage",
    "keywords": [
      "risk",
      "events",
      "service principal",
      "identity protection",
      "entra",
      "aad"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "ADFSSignInLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C2",
    "category": "Identity & Access",
    "description": "AD FS sign-in events from federated authentication through Active Directory Federation Services",
    "keywords": [
      "adfs",
      "sign-in",
      "federation",
      "entra",
      "aad",
      "authentication"
    ],
    "mitreSources": [
      "User Account: Authentication"
    ],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "medium",
    "volumeDriver": "sign-in",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "MicrosoftServicePrincipalSignInLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C2",
    "category": "Identity & Access",
    "description": "Sign-in logs for Microsoft first-party application service principals authenticating in the tenant",
    "keywords": [
      "entra",
      "service",
      "principal",
      "signin",
      "microsoft",
      "application"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "high",
    "volumeDriver": "token-sign-in",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADGraphActivityLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C7",
    "category": "Identity & Access",
    "description": "Legacy Azure AD Graph API request activity against tenant directory resources, useful for tracking deprecated API usage and enumeration",
    "keywords": [
      "entra",
      "graph",
      "legacy",
      "api",
      "activity",
      "directory"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "medium",
    "volumeDriver": "api-request",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "GraphNotificationsActivityLogs",
    "connector": "Microsoft Entra ID",
    "classification": "secondary",
    "valueRule": "C9",
    "category": "Platform Health",
    "description": "Microsoft Graph change notification delivery logs for webhook subscriptions in the tenant",
    "keywords": [
      "graph",
      "notification",
      "webhook",
      "subscription",
      "delivery"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T5",
    "volumeClass": "medium",
    "volumeDriver": "application-trace",
    "isFree": false,
    "recommendedRetentionDays": 90,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "microsoft-learn-table-features",
      "log-baseline-classification-rules"
    ],
    "domainId": "security-operations",
    "logTypeId": "health"
  },
  {
    "tableName": "AADRiskyAgents",
    "connector": "Microsoft Entra ID Protection",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Identity & Access",
    "description": "Entra ID Protection risky agent identities (Agent ID) with risk level, risk state and remediation detail",
    "keywords": [
      "entra",
      "agent",
      "identity",
      "risk",
      "risky",
      "protection"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADAgentRiskEvents",
    "connector": "Microsoft Entra ID Protection",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Identity & Access",
    "description": "Entra ID Protection risk detections for agent identities such as unfamiliar resource access, sign-in spikes and failed access attempts",
    "keywords": [
      "entra",
      "agent",
      "risk",
      "detection",
      "event",
      "protection"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "AADCustomSecurityAttributeAuditLogs",
    "connector": "Microsoft Entra ID",
    "classification": "primary",
    "valueRule": "C3",
    "category": "Identity & Access",
    "description": "Entra audit events for custom security attribute definition and assignment changes (add, update, delete)",
    "keywords": [
      "entra",
      "custom",
      "security",
      "attribute",
      "audit",
      "assignment"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "admin-action",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "identity",
    "logTypeId": "authentication"
  },
  {
    "tableName": "SentinelBehaviorInfo",
    "connector": "Microsoft Sentinel",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Security Alerts",
    "description": "Sentinel behaviors, conclusions or insights derived from one or more raw events, providing investigation context",
    "keywords": [
      "sentinel",
      "behavior",
      "insight",
      "investigation",
      "context"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "security-operations",
    "logTypeId": "alert"
  },
  {
    "tableName": "SentinelBehaviorEntities",
    "connector": "Microsoft Sentinel",
    "classification": "primary",
    "valueRule": "C1",
    "category": "Security Alerts",
    "description": "Entities (file, process, device, user) involved in Sentinel behaviors and observations including detected threats",
    "keywords": [
      "sentinel",
      "behavior",
      "entity",
      "observation",
      "threat"
    ],
    "mitreSources": [],
    "recommendedTier": "analytics",
    "tierRule": "T1",
    "volumeClass": "low",
    "volumeDriver": "alert",
    "isFree": false,
    "recommendedRetentionDays": 365,
    "sourceIds": [
      "log-horizon-classifications",
      "log-baseline-volume-model",
      "log-baseline-classification-rules"
    ],
    "domainId": "security-operations",
    "logTypeId": "alert"
  }
]