Log baseline v0.5.1
GitHub
All tables
Applications and workloads / Audit

Pathlock_TDnR_CL

Pathlock security-relevant SAP events enriched with business process context

Recommendation

AnalyticsData lakePrimarySecondaryPrimary ยท Analytics365 days retention

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

How the matrix works

C1 Detections and findings

Detections, alerts, incidents, security findings (vulnerability and posture findings), and detection pipeline health

ACSC

  • 1. Endpoint detection and response (EDR) logsEDR detections
  • 2. Network device logsIDS/IPS alerts
  • Risk considerationsCheck the health of priority sources

CISA

No event type

MITRE data sources

None recorded

T1 Near-real-time detection

Generic detections need near-real-time matching on single events.

Lake supported in the Azure Monitor table feature matrix

Fields detections use

High-value fields

AffectedUserAreaBnameCentralTsDataSourceDestIpEventidHostnameInstanceLogLineMessageV1MessageV2MessageV3MessageV4MsgIdMsgNoMsgTypeReportSrcIpSubidSysidTcodeTimeGenerated

Most used in public rules

  1. AffectedUser77
  2. Area77
  3. Bname77
  4. CentralTs77
  5. DataSource77
  6. DestIp77
  7. Eventid77
  8. Hostname77
  9. Instance77
  10. LogLine77
  11. MessageV177
  12. MessageV277

Sources for this recommendation

  • Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
  • Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
  • Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.