Log baseline v0.5.1
GitHub
All tables
Infrastructure and platform / Diagnostic

AzureDiagnostics

Consolidated diagnostic logs from Azure resources including Key Vault, SQL, App Gateway, and more. Legacy collection mode with a 500-column cap; prefer resource-specific tables (AZFW*, AGW*, AKS*, AZKVAuditLogs) where the service offers them

Recommendation

AnalyticsData lakePrimarySecondaryPrimary ยท Analytics180 days retention

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

How the matrix works

C5 Network activity

Network activity: firewall, DNS, DHCP, web proxy, flow, load balancer, mail gateway and message flow, web access to internet-facing services

ACSC

  • 2. Network device logs
  • 8. Cloud platform logging
  • 12. Windows DNS server analytic event logs

CISA

  • 3. Network device infrastructure3a-3c DNS query and response, DHCP lease information, and firewall logs

MITRE data sources

  • Cloud Service: Cloud Service Modification
  • Network Traffic: Network Traffic Flow

T5 No lake support

The table would otherwise get T3 or T4, but it has no Auxiliary/Lake support.

Long-term retention uses the mirrored lake copy. Volume is reduced with ingest-time filtering or a narrower collection scope.

No lake support in the Azure Monitor table feature matrix

Fields detections use

High-value fields

anomalyScoreApplicationNameCallerIPAddressCategoryClientIPCorrelationIdDatabaseDurationMsHostNameLevelNameOperationNamePrincipalNamePropertiesrequestUri_sResourceResourceGroupResourceIdResourceTypeResultDescriptionResultSignatureResultTypeTimeGenerated

Most used in public rules

  1. Category45
  2. TimeGenerated41
  3. ResourceId25
  4. ClientIP23
  5. HostName20
  6. ApplicationName18
  7. PrincipalName18
  8. ActionName17
  9. AffectedRows17
  10. Database17
  11. IsSuccess17
  12. ResponseRows17

Split hints

Rows to keep in Analytics with a split rule.

Keep failures, Key Vault access, NSG flow denies, and high-severity events in Analytics

ResultType == "Failed" or Level == "Error" or Level == "Critical" or Category in ("AuditEvent", "NetworkSecurityGroupEvent", "NetworkSecurityGroupRuleCounter") or (OperationName has "SecretGet" or OperationName has "SecretSet" or OperationName has "SecretDelete" or OperationName has "KeyGet" or OperationName has "VaultGet")

Sources for this recommendation

  • Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
  • Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
  • Azure Monitor Logs table feature support Built-in table support for the Basic and Auxiliary plans. Classifications use it to keep datalake recommendations to tables with Auxiliary/Lake support.
  • Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.
  • Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
  • ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
  • CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.