Log baseline v0.5.1
GitHub
All tables
Endpoint / Security event

DeviceImageLoadEvents

DLL and image loading events on managed endpoints, useful for detecting DLL side-loading

Recommendation

AnalyticsData lakePrimarySecondaryPrimary ยท Data lake365 days retention

High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.

How the matrix works

C4 Endpoint and operating system activity

Endpoint and operating system activity: process, script, logon, service, scheduled task, registry, file

ACSC

  • 1. Endpoint detection and response (EDR) logs
  • 5. Microsoft Windows endpoints logs
  • 6. Virtualisation system logs
  • 13. Linux endpoint auditing logs
  • 14. Apple MacOS endpoint logs

CISA

  • 2. Operating systems2a-2j All listed operating system event types

MITRE data sources

  • Module: Module Load

T3 High-volume aggregation

Primary, high or very-high volume, and the generic detection use is aggregation, threat-intelligence matching, baselining, or investigation.

Lake supported in the Azure Monitor table feature matrix

Fields detections use

High-value fields

FolderPathInitiatingProcessFileNameFileNameDeviceNameInitiatingProcessParentFileNameDeviceIdActionTypeTimeGeneratedInitiatingProcessCommandLineSHA1SHA256

Most used in public rules

  1. FileName12
  2. FolderPath12
  3. InitiatingProcessFileName12
  4. DeviceName10
  5. SHA18
  6. TimeGenerated7
  7. DeviceId6
  8. InitiatingProcessCommandLine6
  9. InitiatingProcessParentFileName6
  10. ActionType5
  11. SHA2565
  12. InitiatingProcessAccountUpn2

Sources for this recommendation

  • Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
  • Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
  • Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.
  • Microsoft Defender XDR advanced hunting schema reference Table identity, description, preview state, lifecycle, and columns for Defender XDR advanced hunting tables, including the per-table reference pages linked from the index. Field analysis uses the columns for XDR-only tables such as EntraIdSignInEvents.