Try it free

Security

  • Latest Dynatrace
  • Reference

Contains entity definitions for Azure Security stored in Smartscape on Grail. Entities are prefixed with AZURE_.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for Azure Security entity types.

smartscapeNodes "AZURE_MICROSOFT_ATTESTATION*"
| append [ smartscapeNodes "AZURE_MICROSOFT_CODESIGNING*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_CONFIDENTIALLEDGER*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_EASM*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_HARDWARESECURITYMODULES*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_KEYVAULT*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECRETSYNCCONTROLLER*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECURITY*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_WINDOWSESU*" ]

Permission fields

  • azure.subscription
  • azure.resource.group
  • dt.security_context

API collections

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_APICOLLECTIONS

API collections in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_APICOLLECTIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_APICOLLECTIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Advanced threat protection settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ADVANCEDTHREATPROTECTIONSETTINGS

Advanced threat protection settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ADVANCEDTHREATPROTECTIONSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ADVANCEDTHREATPROTECTIONSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Aggregations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_AGGREGATIONS

Aggregations in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_AGGREGATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_AGGREGATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Alert rule templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULETEMPLATES

Alert rule templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULETEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULETEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Alerts suppression rules

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ALERTSSUPPRESSIONRULES

Alerts suppression rules in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ALERTSSUPPRESSIONRULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ALERTSSUPPRESSIONRULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Applications

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_APPLICATIONS

Applications in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_APPLICATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_APPLICATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Assessment metadata

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ASSESSMENTMETADATA

Assessment metadata in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ASSESSMENTMETADATA"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ASSESSMENTMETADATA"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Assignments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ASSIGNMENTS

Assignments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ASSIGNMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ASSIGNMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Attestation provider

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_ATTESTATION_ATTESTATIONPROVIDERS

Azure Attestation service provider for verifying trustworthiness of platform components.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_ATTESTATION_ATTESTATIONPROVIDERS"

smartscapeNodes "AZURE_MICROSOFT_ATTESTATION_ATTESTATIONPROVIDERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Auto provisioning settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_AUTOPROVISIONINGSETTINGS

Auto provisioning settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_AUTOPROVISIONINGSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_AUTOPROVISIONINGSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Automations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_AUTOMATIONS

Automations in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_AUTOMATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_AUTOMATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Azure key vault secret provider classes

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECRETSYNCCONTROLLER_AZUREKEYVAULTSECRETPROVIDERCLASSES

Azure key vault secret provider classes in Azure Secret Sync Controller.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_AZUREKEYVAULTSECRETPROVIDERCLASSES"

smartscapeNodes "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_AZUREKEYVAULTSECRETPROVIDERCLASSES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Backup instance

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPINSTANCES

Individual protected workload instance in an Azure Backup vault.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPINSTANCES"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPINSTANCES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Backup job

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPJOBS

Backup or restore job execution record in an Azure Backup vault.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPJOBS"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPJOBS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Backup policy

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPPOLICIES

Backup policy defining schedule and retention rules for a Backup vault.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPPOLICIES"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPPOLICIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Backup vault

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS

Azure Backup vault storing backup data for supported workloads.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Billing statistics

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_BILLINGSTATISTICS

Billing statistics in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_BILLINGSTATISTICS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_BILLINGSTATISTICS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Bookmarks

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_BOOKMARKS

Bookmarks in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_BOOKMARKS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_BOOKMARKS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Cases

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CASES

Cases in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CASES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CASES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Cloud HSM clusters

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_HARDWARESECURITYMODULES_CLOUDHSMCLUSTERS

Cloud HSM clusters in Azure Dedicated HSM.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_HARDWARESECURITYMODULES_CLOUDHSMCLUSTERS"

smartscapeNodes "AZURE_MICROSOFT_HARDWARESECURITYMODULES_CLOUDHSMCLUSTERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Compliance results

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_COMPLIANCERESULTS

Compliance results in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_COMPLIANCERESULTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_COMPLIANCERESULTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Compliances

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_COMPLIANCES

Compliances in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_COMPLIANCES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_COMPLIANCES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Content packages

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPACKAGES

Content packages in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPACKAGES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPACKAGES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Content product packages

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTPACKAGES

Content product packages in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTPACKAGES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTPACKAGES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Content product templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTTEMPLATES

Content product templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTTEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTTEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Content templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTTEMPLATES

Content templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTTEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTTEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Custom recommendations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_CUSTOMRECOMMENDATIONS

Custom recommendations in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_CUSTOMRECOMMENDATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_CUSTOMRECOMMENDATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Data connector definitions

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORDEFINITIONS

Data connector definitions in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORDEFINITIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORDEFINITIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Data connectors

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORS

Data connectors in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Dedicated HSMs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_HARDWARESECURITYMODULES_DEDICATEDHSMS

Dedicated HSMs in Azure Dedicated HSM.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_HARDWARESECURITYMODULES_DEDICATEDHSMS"

smartscapeNodes "AZURE_MICROSOFT_HARDWARESECURITYMODULES_DEDICATEDHSMS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Defender EASM workspaces

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_EASM_WORKSPACES

Defender EASM workspaces in Microsoft Defender External Attack Surface Management.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_EASM_WORKSPACES"

smartscapeNodes "AZURE_MICROSOFT_EASM_WORKSPACES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Defender for cloud assessment

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ASSESSMENTS

Security assessment recommendation from Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ASSESSMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ASSESSMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Defender for cloud plan

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_PRICINGS

Microsoft Defender for Cloud pricing plan for a resource type.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_PRICINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_PRICINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Defender for storage settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_DEFENDERFORSTORAGESETTINGS

Defender for storage settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_DEFENDERFORSTORAGESETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_DEFENDERFORSTORAGESETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Deleted backup instances

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_DELETEDBACKUPINSTANCES

Deleted backup instances within Backup Vaults in Azure Backup (Data Protection).

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_DELETEDBACKUPINSTANCES"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_DELETEDBACKUPINSTANCES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Device security groups

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_DEVICESECURITYGROUPS

Device security groups in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_DEVICESECURITYGROUPS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_DEVICESECURITYGROUPS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Entities

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITIES

Entities in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Entity queries

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERIES

Entity queries in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Entity query templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERYTEMPLATES

Entity query templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERYTEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERYTEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

File imports

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_FILEIMPORTS

File imports in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_FILEIMPORTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_FILEIMPORTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Governance rules

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_GOVERNANCERULES

Governance rules in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_GOVERNANCERULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_GOVERNANCERULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Health reports

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_HEALTHREPORTS

Health reports in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_HEALTHREPORTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_HEALTHREPORTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Hunts

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_HUNTS

Hunts in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_HUNTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_HUNTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

IOT security solutions

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_IOTSECURITYSOLUTIONS

IOT security solutions in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_IOTSECURITYSOLUTIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_IOTSECURITYSOLUTIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Information protection policies

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_INFORMATIONPROTECTIONPOLICIES

Information protection policies in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_INFORMATIONPROTECTIONPOLICIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_INFORMATIONPROTECTIONPOLICIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Key vault

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_KEYVAULT_VAULTS

Azure Key Vault for secrets, keys, and certificate management.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_KEYVAULT_VAULTS"

smartscapeNodes "AZURE_MICROSOFT_KEYVAULT_VAULTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Ledgers

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_CONFIDENTIALLEDGER_LEDGERS

Ledgers in Azure Confidential Ledger.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_CONFIDENTIALLEDGER_LEDGERS"

smartscapeNodes "AZURE_MICROSOFT_CONFIDENTIALLEDGER_LEDGERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

MDE onboardings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_MDEONBOARDINGS

MDE onboardings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_MDEONBOARDINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_MDEONBOARDINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Managed HSM

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_KEYVAULT_MANAGEDHSMS

Azure Key Vault Managed HSM.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_KEYVAULT_MANAGEDHSMS"

smartscapeNodes "AZURE_MICROSOFT_KEYVAULT_MANAGEDHSMS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Managed ccfs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_CONFIDENTIALLEDGER_MANAGEDCCFS

Managed ccfs in Azure Confidential Ledger.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_CONFIDENTIALLEDGER_MANAGEDCCFS"

smartscapeNodes "AZURE_MICROSOFT_CONFIDENTIALLEDGER_MANAGEDCCFS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Metadata

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_METADATA

Metadata in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_METADATA"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_METADATA"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Microsoft Sentinel alert rule

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULES

Analytic rule detecting threats in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Microsoft Sentinel automation rule

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_AUTOMATIONRULES

Automation rule for orchestrating incident response in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_AUTOMATIONRULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_AUTOMATIONRULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Microsoft Sentinel incident

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_INCIDENTS

Security incident aggregated from Sentinel alerts.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_INCIDENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_INCIDENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Multiple activation keys

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_WINDOWSESU_MULTIPLEACTIVATIONKEYS

Multiple activation keys in Azure Extended Security Updates.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_WINDOWSESU_MULTIPLEACTIVATIONKEYS"

smartscapeNodes "AZURE_MICROSOFT_WINDOWSESU_MULTIPLEACTIVATIONKEYS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Office consents

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_OFFICECONSENTS

Office consents in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_OFFICECONSENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_OFFICECONSENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

On boarding states

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ONBOARDINGSTATES

On boarding states in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ONBOARDINGSTATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ONBOARDINGSTATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private link services for EDM upload

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFOREDMUPLOAD

Private link services for EDM upload in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFOREDMUPLOAD"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFOREDMUPLOAD"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private link services for IP policy sync

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC

Private link services for IP policy sync in Microsoft 365 Security and Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

smartscapeNodes "AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private link services for M365 compliance center

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365COMPLIANCECENTER

Private link services for M365 compliance center in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365COMPLIANCECENTER"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365COMPLIANCECENTER"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private link services for M365 security center

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365SECURITYCENTER

Private link services for M365 security center in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365SECURITYCENTER"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365SECURITYCENTER"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private link services for MIP policy sync

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC

Private link services for MIP policy sync in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private link services for O365 management activity API

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORO365MANAGEMENTACTIVITYAPI

Private link services for O365 management activity API in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORO365MANAGEMENTACTIVITYAPI"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORO365MANAGEMENTACTIVITYAPI"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private link services for SCC PowerShell

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORSCCPOWERSHELL

Private link services for SCC PowerShell in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORSCCPOWERSHELL"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORSCCPOWERSHELL"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Private links

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_PRIVATELINKS

Private links in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_PRIVATELINKS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_PRIVATELINKS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Recommendations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_RECOMMENDATIONS

Recommendations in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_RECOMMENDATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_RECOMMENDATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Regulatory compliance standards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_REGULATORYCOMPLIANCESTANDARDS

Regulatory compliance standards in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_REGULATORYCOMPLIANCESTANDARDS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_REGULATORYCOMPLIANCESTANDARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Resource guards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_RESOURCEGUARDS

Resource guards in Azure Backup.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_RESOURCEGUARDS"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_RESOURCEGUARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

SQL vulnerability assessments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SQLVULNERABILITYASSESSMENTS

SQL vulnerability assessments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SQLVULNERABILITYASSESSMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SQLVULNERABILITYASSESSMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Secret syncs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECRETSYNCCONTROLLER_SECRETSYNCS

Secret syncs in Azure Secret Sync Controller.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_SECRETSYNCS"

smartscapeNodes "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_SECRETSYNCS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Secure scores

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURESCORES

Secure scores in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURESCORES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURESCORES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Security ML analytics settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_SECURITYMLANALYTICSSETTINGS

Security ML analytics settings in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_SECURITYMLANALYTICSSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_SECURITYMLANALYTICSSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Security connectors

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURITYCONNECTORS

Security connectors in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURITYCONNECTORS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURITYCONNECTORS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Security contacts

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURITYCONTACTS

Security contacts in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURITYCONTACTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURITYCONTACTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Security standards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURITYSTANDARDS

Security standards in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURITYSTANDARDS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURITYSTANDARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Sensitivity settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SENSITIVITYSETTINGS

Sensitivity settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SENSITIVITYSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SENSITIVITYSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Server vulnerability assessments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTS

Server vulnerability assessments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Server vulnerability assessments settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTSSETTINGS

Server vulnerability assessments settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTSSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTSSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_SETTINGS

Settings in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_SETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_SETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Software inventories

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SOFTWAREINVENTORIES

Software inventories in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SOFTWAREINVENTORIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SOFTWAREINVENTORIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Source controls

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_SOURCECONTROLS

Source controls in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_SOURCECONTROLS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_SOURCECONTROLS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Standard assignments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_STANDARDASSIGNMENTS

Standard assignments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_STANDARDASSIGNMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_STANDARDASSIGNMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Standards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_STANDARDS

Standards in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_STANDARDS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_STANDARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Triggered analytics rule runs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_TRIGGEREDANALYTICSRULERUNS

Triggered analytics rule runs in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_TRIGGEREDANALYTICSRULERUNS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_TRIGGEREDANALYTICSRULERUNS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Trusted signing accounts

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_CODESIGNING_CODESIGNINGACCOUNTS

Trusted signing accounts in Azure Trusted Signing.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_CODESIGNING_CODESIGNINGACCOUNTS"

smartscapeNodes "AZURE_MICROSOFT_CODESIGNING_CODESIGNINGACCOUNTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Watchlists

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WATCHLISTS

Watchlists in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WATCHLISTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WATCHLISTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Work space manager assignments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERASSIGNMENTS

Work space manager assignments in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERASSIGNMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERASSIGNMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Work space manager configurations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERCONFIGURATIONS

Work space manager configurations in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERCONFIGURATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERCONFIGURATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Work space manager groups

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERGROUPS

Work space manager groups in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERGROUPS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERGROUPS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Work space manager members

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERMEMBERS

Work space manager members in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERMEMBERS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERMEMBERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE

Work space settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_WORKSPACESETTINGS

Work space settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_WORKSPACESETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_WORKSPACESETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

AttributeTypeDescriptionExamples

id

smartscapeId

stable
Display name: ID
A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.

<type>-017198AD253CBD63

id_classic

string

deprecated
Display name: Classic ID
The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the id field instead, which is the Smartscape ID.

<type>-017198AD253CBD63

name

string

stable
Display name: Name
The entity name.

localhost; easyTravel; product-catalog

type

string

stable
Display name: Type
The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.

TYPE_A

tags

record

stable
Display name: Tags
A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, release or name). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via tags:context field. Note that rule-based tags do not exist in the new model.

tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]; tags[tag_key-2] = context_C_tag_val-1; tags:context_A[tag_key-1] = context_A_tag_val-1

lifetime

timeframe

stable
Display name: Lifetime
The lifetime of the entity. This is a record with two nested fields: start and end, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.

{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }

references

record

stable
Display name: References
Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.

{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }

dt.security_context

string[]

resource stable
Display name: DT security context
The security contexts associated with the entity. For Smartscape entities, this field is always an array.
Tags: permission

[]

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

AttributeTypeDescriptionExamples

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.resource.id

string

resource experimental
Display name: Azure resource ID
A unique, immutable identifier assigned to each Azure cloud resource.

/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks

azure.resource.name

string

resource experimental
Display name: Azure resource name
User-provided name of the Azure cloud resource.

demo-aks

azure.resource.type

string

resource experimental
Display name: Azure resource type
The name of a resource type in the format: {resource-provider}/{resource-type}.

Microsoft.ContainerService/managedClusters

Azure entity fields

Contains all fields that are provided by all Azure entities.

AttributeTypeDescriptionExamples

azure.resource.kind

string

experimental
Display name: Azure resource kind
A kind of the Azure resource

app,linux

azure.resource.sku.name

string

experimental
Display name: Azure resource SKU name
Name of the Azure resource SKU

B_Gen5_1

azure.resource.sku.tier

string

experimental
Display name: Azure resource SKU tier
Tier of the Azure resource SKU

Basic

azure.resource.sku.capacity

string

experimental
Display name: Azure resource SKU capacity
Capacity of the Azure resource SKU

20

azure.status

string

experimental
Display name: Azure status
The status of the instance

Running; Stopped (deallocated)

azure.provisioning_state

string

experimental
Display name: Azure provisioning state
The provisioning status of the resource

Succeeded; DELETED; ERROR; INCOMPLETE

azure.object

string

experimental
Display name: Azure object
The full JSON content of Azure object

azure.properties.version

string

experimental
Display name: Azure properties version
The json content version

...

azure.subscription

string

resource stable
Display name: Azure subscription
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission primary-field

27e9b03f-04d2-2b69-b327-32f433f7ed21

azure.location

string

resource stable
Display name: Azure location
A specific geographical location of Azure cloud resource.
Tags: primary-field

westeurope

azure.availability_zones

string[]

resource experimental
Display name: Azure availability zones
Availability zones of Azure cloud resource.

['1']

azure.resource.group

string

resource stable
Display name: Azure resource group
A resource group is a container that holds related resources for an Azure solution.
Tags: permission primary-field

demo-backend-rg

azure.tenant.id

string

resource experimental
Display name: Azure tenant ID
Unique, immutable identifier assigned to the Azure tenant.

37c4add3-612a-483d-8b24-cccbb35d3306

Cloud entity fields

Fields that are provided by all Cloud workloads.

AttributeTypeDescriptionExamples

cloud.acquisition.status

string

experimental
Display name: Cloud acquisition status
The status of Smartscape nodes data acquisition by Data Acquisition Conroller OK - node is consistent DELETED - node was deleted in the cloud platform ERROR - there was an error acquiring node, but the node was upserted INCOMPLETE - there was an error acquiring node child resource (ie. EC2 Instance, with no EBS volumes due to missing permissions) , but the node was upserted.

OK; DELETED; ERROR; INCOMPLETE