Baseline stats
Follow the baseline from security domain to Sentinel table, then inspect which fields appear most often in public detection rules. Click any chart to drill in.
Where public rules look
One column per table, grouped by domain and then log type. Height is field references across 5,158 parsed rules (log scale). The selection is lit. 117 of 773 tables are referenced at all.
Drill down
- Primary
- Analytics tier
- Seen in rules
- Field references
Fields used in rules
Composition
Tier × retention
Domain and log type
Inner ring is domain, outer ring is log type.
Tables per domain
Solid is primary, tinted is secondary.
Most referenced tables
Field references across 5,158 parsed rules.
Field references by domain
The 14 most used fields × 10 domains. Select a domain name to drill in.
| Domain | TimeGenerated | ActionType | DeviceName | DeviceId | FileName | ThreatTypes | InitiatingProcessFileName | Computer | Type | OperationName | EventID | ProcessCommandLine | EmailDirection | Category |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 322 | 44 | 13 | 3 | 31 | 173 | 88 | ||||||||
| 282 | 199 | 450 | 371 | 255 | 239 | 198 | 46 | 199 | 191 | |||||
| 145 | 25 | 10 | 1 | 16 | 23 | 17 | ||||||||
| 227 | 212 | 33 | 9 | 13 | ||||||||||
| 38 | 72 | 15 | 227 | 2 | 185 | 2 | ||||||||
| 106 | 14 | 12 | 8 | |||||||||||
| 34 | 18 | 12 | 2 | |||||||||||
| 88 | 2 | 19 | 16 | 1 | 6 | 9 | 12 | 3 | 47 | |||||
| 103 | 16 | 22 | 2 | 22 | 2 | |||||||||
| 92 | 36 |
Tables per value rule
Each bar splits into Analytics and Data lake. Select a rule to filter the table.
Volume against the matrix Judgment
High volume does not force the lake. T1 keeps single-event detections in Analytics, and 43 tables have no lake option (T5).
Tables by ACSC section and CISA event type
A table counts toward every section or event type its value rule maps to, so one table can appear several times. Coverage shows collection priority. It says nothing about tier. See the value rules for the mapping.
ACSC priority logs for SIEM ingestion
- 1Endpoint detection and response (EDR) logsValue rules C1, C4
- 2Network device logsValue rules C1, C2, C3, C5
- 3Microsoft Domain ControllerValue rules C2
- 4Active Directory (AD) and Domain Service security logsValue rules C2
- 5Microsoft Windows endpoints logsValue rules C4
- 6Virtualisation system logsValue rules C3, C4, C7
- 7Operational technology loggingNo value rule maps here
- 8Cloud platform loggingValue rules C2, C3, C5, C6, C7
- 9Container logsValue rules C3, C7
- 10Database logsValue rules C7
- 11Mobile device managementValue rules C3
- 12Windows DNS server analytic event logsValue rules C5
- 13Linux endpoint auditing logsValue rules C4
- 14Apple MacOS endpoint logsValue rules C4, C7
CISA M-21-31 event types
- 1Identity, credential, and access management (ICAM)Value rules C2, C3, C8
- 2Operating systemsValue rules C4
- 3Network device infrastructureValue rules C5
- 4Cloud environments (general logging)Value rules C3
- 5Amazon Web Services (AWS)Value rules C3
- 6Cloud AzureValue rules C3
- 7Microsoft 365Value rules C6
- 8Google Cloud Platform (GCP)Value rules C3
What one row represents Judgment
Tables per volume driver, with the driver's default volume class. Both are judgment, not measured volume.