Security operations / Alert
SecurityAlert
Aggregated security alerts from all connected Microsoft and third-party providers
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC1 Detections and findings
Detections, alerts, incidents, security findings (vulnerability and posture findings), and detection pipeline health
ACSC
- 1. Endpoint detection and response (EDR) logsEDR detections
- 2. Network device logsIDS/IPS alerts
- Risk considerationsCheck the health of priority sources
CISA
No event type
MITRE data sources
None recorded
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
TimeGenerated52ProviderName48AlertName42ProductName35Entities33AlertSeverity32Description30Tactics21AlertLink19Type19RemediationSteps16Techniques16
Parsers that read this table
DragosNotificationsToSentinel1 rules
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.