Security operations / Health
GraphNotificationsActivityLogs
Microsoft Graph change notification delivery logs for webhook subscriptions in the tenant
Recommendation
Context that analytics-tier detections or Sentinel features join against, or context tables the lake cannot hold.
How the matrix worksC9 Health, inventory, and reference context
Secondary: health, performance, metrics, diagnostics, inventory, posture snapshots, reference data, and aggregates derived from another collected table
T5 No lake support
The table would otherwise get T3 or T4, but it has no Auxiliary/Lake support.
Long-term retention uses the mirrored lake copy. Volume is reduced with ingest-time filtering or a narrower collection scope.
No lake support in the Azure Monitor table feature matrix
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Azure Monitor Logs table feature support Built-in table support for the Basic and Auxiliary plans. Classifications use it to keep datalake recommendations to tables with Auxiliary/Lake support.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.