Endpoint / Security event
DeviceInfo
Device inventory data from Defender for Endpoint including OS, domain, and onboarding status
Recommendation
Context that analytics-tier detections or Sentinel features join against, or context tables the lake cannot hold.
How the matrix worksC9 Health, inventory, and reference context
Secondary: health, performance, metrics, diagnostics, inventory, posture snapshots, reference data, and aggregates derived from another collected table
T2 Enrichment or join target
Low-volume enrichment or join target for analytics-tier detections or Sentinel features.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
DeviceId29DeviceName23PublicIP14TenantId8OnboardingStatus6TimeGenerated6LoggedOnUsers5IsAzureADJoined3JoinType3MachineGroup3AadDeviceId2DeviceType2
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.
- Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
- Microsoft Defender XDR advanced hunting schema reference Table identity, description, preview state, lifecycle, and columns for Defender XDR advanced hunting tables, including the per-table reference pages linked from the index. Field analysis uses the columns for XDR-only tables such as EntraIdSignInEvents.